• ?

    user

    2 years ago
    If you are talking about user tampered devices, if the device is tampered you can't prevent leaking of credentials
  • NewCastle252

    NewCastle252

    2 years ago
    That is correct, if it's tampered key loggers, screen recorders, cookie stealing, memory leaking, etc. will be possible
  • NewCastle252

    NewCastle252

    2 years ago
    But it's like an extra security layer
  • NewCastle252

    NewCastle252

    2 years ago
    Seems a bit odd to try to circumvent your own corporate proxy, why not just avoid the proxy? Is not always possible if you have an corporate device without admin privileges maybe you can't disable the cert or proxy
  • ?

    user

    2 years ago
    You mean, if you have users accessing your app through a device which the user would consider unsafe? I thought you meant the proxy was on your side, i.e. in your infrastructure
  • NewCastle252

    NewCastle252

    2 years ago
    Ah yes, no it's for trying to secure user devices a bit more
  • NewCastle252

    NewCastle252

    2 years ago
    My infrastructure: - some proliants servers - a laptop - a bedroom
  • ?

    user

    2 years ago
    I mean this seems like it is going in the path of crypto space, in which case most companies declare bankruptcy and commit to having air-gapped devices. or OTP, FIDO, etc.. integrations to handling the signing, rather than creating the infrastructure yourself
  • NewCastle252

    NewCastle252

    2 years ago
    It's just a fun project for me trying to learn a bit more about security and just something I wanted to create
  • ?

    user

    2 years ago
    oh well in that case, go to town 🙂