0
votes
1answer
42 views

Understanding Hearthbleed attacks [duplicate]

In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct? Or can this be done ...
1
vote
2answers
56 views

Proving SSL need

I need to prove the need we have to install SSL certificates in our webservers. For that I've been requested to try obtaining sample credentials (in lab enviroment) during a http authentication ...
1
vote
3answers
137 views

Why can't someone break email or https encryption by somehow getting access to the encryption key?

To repeat, "Why can't someone break email or https encryption by somehow getting access to the encryption key?" In other words, why can't someone intercept the key, or the algorithm to create the ...
0
votes
1answer
89 views

SSL and Strategy to prevent destination URL from being revealed

Googling the subject "sniffing out / spying on SSL secured communications" one finds many references to being able to make some good guesses about the "target destination" once the path length is ...
1
vote
2answers
472 views

Sniffing From Squid SSL

I created a Squid proxy and a self-signed SSL certificate. The SSL certificate on the server is a private certificate linked to the ssl-bump feature. I am using tshark to dump the SSL traffic, but I ...
5
votes
3answers
2k views

Capturing and decrypting my own SSL traffic

When I use browser or wget to access another site, some sites will only use HTTPS / SSL automatically. When a site doesn't provide content without encryption, how do I capture what my computer sends ...
2
votes
1answer
1k views

Should we block all plaintext authentication and require authentication over an encrypted channel?

Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over? I recently configured my servers to ...
2
votes
3answers
163 views

Are my credentials unsafe if I am already logged-in before connecting to a public network?

Let's say I am already logged-in to my Gmail or Yahoo account using my 3G then I switched to a public WIFI in an airport or cafe. Is my username and password still vulnerable? What others kinds of ...
3
votes
8answers
2k views

how can you view an HTTP request in transit?

In Google Chrome, sometimes you will see the https: protocol in the URL bar with a red strike through it. Clicking on the info button says that not all elements on the page are encrypted, and may be ...
4
votes
1answer
351 views

Sniffing IMAPS traffic! Are there any tools for this?

I've got a problem where someone has implemented a custom IMAP Server. I need to write a custom application to get a list of emails, and fetch messages. Problem is, every library I've tried to use ...
1
vote
3answers
4k views

Facebook login on HTTP? [duplicate]

Possible Duplicate: Is the Facebook login form using SSL without https in the URL? If you access http://www.facebook.com/, in the top right side there is the login section. You can enter ...
20
votes
2answers
15k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...