Linked Questions

4
votes
2answers
698 views

In a browser web server communication, who decides which encryption protocol to use [duplicate]

My IE browser has SSLv3.0, TLS 1.0,1.1 and 1.2 has enabled in the advanced settings. And (I was informed by my server admin) my web server can encrypt data in SSLv3.0 and TLS 1.0 Now which system ...
6
votes
1answer
5k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
8
votes
2answers
709 views

Question About HTTPS Security [duplicate]

I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong. I got to know that as part of ...
1
vote
1answer
3k views

What's the point of the pre-master key? [duplicate]

In SSL, the client generates a pre-master key from random data from itself and also the server. It then encrypts this with the server's public key, sends it to the server and then both client and ...
4
votes
3answers
530 views

How to fix SSL algorithm for more security [duplicate]

SSL uses Asymmetric Encryption like this : Server sends a copy of its asymmetric public key. Browser creates a symmetric session key and encrypts it with the server’s asymmetric public key. Server ...
-2
votes
2answers
2k views

SSL protocol : Port 443 [duplicate]

I want to usethe SSL protocol. SSL protocol uses port no. 443. During the initial handshake does the communication occurs on port no. 80 or it handshake starts on port 443. If not during the initial ...
3
votes
2answers
160 views

How can a connection be secure, if somebody observes it from the beginning? [duplicate]

If somebody observes a connention between client, and the server, then he can see the keys, by the following data encrypted is. As far as I know, if I connect to a server, then it sends me some keys, ...
0
votes
2answers
490 views

Is HTTPS based on a private key on the user side? [duplicate]

Is HTTPS it based on private key on user side? Where does the user get the private key in the first place? Suppose the user gets the private key by downloading a browser (Chrome, Firefox), then ...
3
votes
2answers
286 views

Why are SSL handshakes secure and why can't a hacker look at that and decrypt the data? [duplicate]

If I understand right, there is a "handshake" where both the server and the browser verify who they are and agree on an encryption key. Why cannot a hacker just watch the network for the keys going ...
1
vote
1answer
305 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
0
votes
1answer
285 views

How does ssl prevent MITM attacks [duplicate]

My understanding of how it works : A victim asks for the public key of a server. The attacker just forwards this request. The server now responds with a certificate which contains the Public key. The ...
1
vote
1answer
292 views

Can't I forge an SSL certificate? [duplicate]

I read What's keeping a malicious man in the middle server from forging a valid certificate?, but when the client goes to verify the certificate, can't an attacker intercept that connection and say ...
0
votes
2answers
198 views

SSL can stop MiTMs … but on the long run, can it really? [duplicate]

SSL uses CAs which sign certificates for the domains after they validate that the person requesting is truly the owner and by a public/private key pair a encrypted connection is achieved which cant be ...
1
vote
2answers
169 views

Question about HTTPS [duplicate]

I have a question about HTTPS, which I need help understanding. So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
0
votes
1answer
130 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...

15 30 50 per page