5
votes
2answers
120 views

Security sanity check

A company whose services I'm trying to integrate uses this protocol: An AES key is embedded in an Android library. To authenticate itself, the library sends a SHA1 hash of the key over plain HTTP. ...
0
votes
2answers
127 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
3
votes
3answers
271 views

Why isn't it possible for a third party to decrypt HTTPS traffic? [duplicate]

I really don't know much about HTTPS. But I always hear people saying that it is 100% safe and bullet proof. My question is: Is that true or even possible. I mean there are lots of tools that allow ...
-1
votes
0answers
77 views

exploiting HTTP HOST header based redirection in apache reverse proxy for intranet resource

I'm looking for suggestion on a POC which I'm doing. I'm trying to solve a use case where in a user accesses the intranet websites from some corporate mobile app when he is not on corporate network ...
1
vote
2answers
39 views

HTTP Header disabling non-SSL (or TLS) content on this page

Is there an HTTP Response header that disallows any non-SSL content from being displayed on the current page? The idea is some times external content that needs to be on the website (cough, ad ...
0
votes
2answers
106 views

Is the lack of https reason enough to abort form submission?

Preamble: Am in awe about the quality of both questions and answers on https / SSL on this site. My humble question below pales in comparison. Both on professional and amateur websites I've ...
0
votes
1answer
115 views

HTTPS encryption and internet proxy [closed]

I'm not sure if this is the right place to ask this question. Please tell me, and I'll delete it. I want to modify a Word document hosted on my OneDrive account. I see that it is using a SSL ...
6
votes
3answers
1k views

Why can't we do MiTM attacks when using secure connection

I have this silly question that is bothering me. When not using secure connection (HTTP for example) cookies can be intercepted and used to connect to the site as if we have the id and password. We ...
3
votes
2answers
372 views

Why do we need WTLS?

Please excuse my probably gross misunderstanding of how all this works. I just started reading SSL & TLS Essentials by Stephen Thomas, and in chapter 1 he talks about how TLS is a separate ...
2
votes
2answers
186 views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
0
votes
2answers
50 views

Self signed certificate secure when just client sends sensitive information?

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for ...
2
votes
2answers
105 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
4
votes
3answers
103 views

Preventive security action in Android App

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list. Bank is a very special client. ...
0
votes
1answer
91 views

Do I need an SSL Certificate for a HTTP only site?

The cert for our public facing site is about to expire soon. Our site is entirely http. The site runs on SharePoint, and with SharePoint working with NTLM, the credentials that are passed over the ...
1
vote
2answers
94 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
0
votes
2answers
273 views

Why don't more websites implement Perfect Forward Secrecy?

From what I understand, all it takes to enable PFS on a webserver is adding ephemeral cipher suites (ones that use DHE and ECDHE for the key exchange) to the list of cipher suites used in SSL/TLS ...
1
vote
2answers
125 views

How Web-proxy and Virtual-Hosting are complications for HTTPS?

While studying HTTPS and related transport layer security protocols(SSL/TLS), I came to know that HTTPS suffers from two complications - Web-Proxy and Virtual-Hosting. I can understand how ...
1
vote
3answers
245 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
0
votes
3answers
139 views

HTTP/HTTPS on the same site

Suppose a site allows connection to be established with HTTP or HTTPS .If you establish a connection to http://www.example.com or https://www.example.com then all further link's on the page displayed ...
3
votes
5answers
243 views

Free SSL Certificate when encryption is needed and not trust?

My understanding is that SSL certificates are expensive because you are paying a 3rd party to vouch for your identity, and apparently the most secure form of trust is the trust you have to pay for. ...
3
votes
3answers
187 views

If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?

Now that Google, Twitter, and some other sites require a TLS connection to access their sites, when you go to http://www.twitter.com it redirects to https://www.twitter.com/. If an attacker had access ...
1
vote
3answers
146 views

Https forms on tens of domains

What is the optimal way (cost-wise, too) to secure page forms (https) on a large number of domains&subdomains? Are certificates required for all domains? Is putting all the page forms on a single ...
2
votes
3answers
131 views

Is it secure for a site to serve the login page with HTTP, but have the actual site in HTTPS? [duplicate]

On some websites, the login page (where you enter your login details) is served by a regular HTTP connection with no encryption. However, once I login, the page immediately switches to a secure HTTPS ...
0
votes
1answer
143 views

CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible?

Sorry if this is a very amateur question. I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting ...
33
votes
5answers
4k views

Why do some websites enforce lack of SSL?

When trying to visit https://www.ebay.com, I noticed that I get redirected to HTTP immediately. Here's what cURL says about that: $ curl --max-redirs 0 -v -L https://www.ebay.com * Rebuilt URL to: ...
1
vote
1answer
111 views

Legitimate use case of man-in-the-middle attack for DPI?

I am working on a device that should sit between the end-user and the server, and that will do deep packet inspection. It is basically a parental control node. This device will be sold to the user, so ...
1
vote
1answer
62 views

Can I reliably identify Apple devices that have not patched against the gotofail vulnerability based on user agent string?

The title pretty much says it. Do the security patches to address the gotofail security issue in multiple Apple products employing SSL change the User Agent string for the respective systems? And, of ...
0
votes
1answer
172 views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
1
vote
0answers
97 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
1answer
92 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
1
vote
2answers
720 views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
-1
votes
4answers
314 views

Secure communication between server and client [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
1
vote
1answer
85 views

Is it dangerous to sync my data with my personal server through unencrypted http?

Since Apple force iPhone users to use iCloud to sync contacts & calendar, I moved to a local ownCloud instance that works well. However, it would be more convenient if I could sync everywhere and ...
1
vote
2answers
366 views

Actually, isn't it bad to redirect http to https? [duplicate]

I have a two-part question about question #570288 over on ServerFault. Question: Is it bad to redirect http to https? Accepted answer (185 up-votes): [...] Hell no. It's very good. Part 1 ...
0
votes
1answer
144 views

HTTPS Proxy Everwhere?

I am configuring a HTTPS proxy, which I want to use for my laptop wherever I go. The idea is that since its encrypted, I should be safe from eavesdroppers, even on open wireless networks. Think of it ...
2
votes
1answer
140 views

In Same Origin Policy, why are different protocols considered a security violation?

I can understand why content from different domains is considered to be unstrusted for the same origin policy. But, how can be content from diferent protocols from the same site/domain be dangerous? ...
3
votes
2answers
441 views

Should login pages be cacheable?

I'm considering the relative benefits/disadvantages of making a login page cacheable. Note that here I'm referring to the page containing the form into which the user enters their username and ...
1
vote
2answers
120 views

Can non-https assets be tampered with?

Why load assets such as images, javascript, css etc, over HTTPS? Is it possible for these assets to be tampered with if I use HTTP? The only way I could conceive of tampering with HTTP loaded assets ...
1
vote
2answers
71 views

HTTPs token Parameters : UDIAuthToken

For HTTPs I saw the URL was configured in https://test.com/xml/Transformer=TEST&UDIAuthToken= < string of alphanumeric chars, 160 in count > << this a dummy hostname, with dummy ...
2
votes
3answers
307 views

Does HTTPS encryption work when there is invalid or there is no certificate?

When I have a website run on https and there is no certificate, there is wrong certificate or out of date like here does encryption still work or not?
1
vote
1answer
4k views

Speaking Plain HTTP over an SSL enabled Server port [closed]

atm I'm facing a problem with IE and Firefox because they don't redirect my Links correctly. I'm requesting my application via: https://myapp.example.de/context In my webapplication I have links ...
2
votes
3answers
148 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
10
votes
2answers
570 views

Why are we still using HTTP? [duplicate]

I've been reading a lot of online articles and blogs about advantages of using HTTPS (HTTP over SSL/TLS) and the performance issues involved in deploying a website over HTTPS. What I understood is ...
15
votes
5answers
1k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
15
votes
2answers
690 views

Twitter's HTTP response vs Google's HTTP response

I was looking at the HTTP responses form https://twitter.com and https://encrypted.google.com. These two responses have interesting similarities and differences in their security definitions. Both ...
1
vote
2answers
93 views

non-MiTM Reverse SSL

Do non-MiTM Reverse SSL Proxies exist? Or do all proxies that do SSL-SSL mappings decode and then re-encode HTTPS traffic? If this is the case and I want to map https://mypublicdomain.com -> ...
3
votes
2answers
485 views

Is there a problem with issuing a HSTS header in PHP?

I want to trial a HSTS policy on my blog without enabling it site wide initially. As a HSTS policy is just a HTTP response header would there be any problem with sending the header in PHP like so: ...
1
vote
3answers
238 views

What information can be seen from HTTPS to HTTP?

Assuming a secured page https://google.com/redirect.php?keyword=apple which redirects the visitor to a non-secured website http://apple.com, would an eavesdropper (anyone watching over the network) be ...
1
vote
2answers
106 views

Using HTTPS GET from app to server

When developing Webpages, they say you should use POST for "destructive" actions, and GET for actions that only retrieve information. Is the same true for apps? Is it a total no-no to use GET for ...
0
votes
1answer
178 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...