Tagged Questions
4
votes
3answers
90 views
Man in the middle attacks for Out of band Authentication
I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows:
"In ...
3
votes
4answers
378 views
How to “demonstrate” man-in-the-middle attack?
I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project).
Over the years a bunch ...
1
vote
2answers
100 views
Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?
I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
1
vote
2answers
120 views
Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?
It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a tcpdump of the actual traffic I've ...
8
votes
5answers
214 views
How do RSA fingerprints protect from MITM attacks?
I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site.
Like when you do a git push, it ...
1
vote
2answers
337 views
Signed request vs HTTP digest auth for API authentication?
By signed request I mean something like this (simplified example):
Client creates a sig in his request:
$sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
