Tagged Questions
1
vote
2answers
1k views
Error code: sec_error_untrusted_issuer
I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
1
vote
3answers
316 views
Do client certificates provide protection against MITM?
I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
3
votes
1answer
103 views
How can I use certificates to secure my webservices? What is available to javascript?
I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
1
vote
1answer
506 views
HTTPS and cache injection
I understand the downside of this attack and what wrong can be done.
But I dont understand how is it done ?
Well, I need to educate myself, any pointers would be useful.
3
votes
2answers
466 views
How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?
I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
5
votes
2answers
3k views
How to thwart sslstrip attack?
I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
7
votes
5answers
2k views
Does HTTPS Everywhere defend me against sslsniff-like attacks?
http://www.thoughtcrime.org/software/sslsniff/
If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
8
votes
4answers
2k views
Options when defending against SSLstrip?
I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?
