SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
6
votes
3answers
124 views
Security implications of an exploited router
So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
1
vote
3answers
139 views
Can attackers steal SSL certificate from server and use it for MITM attacks?
I'm writing an iOS app for private use to acts as a client for a PHP server. To secure the connection I'm using a self-signed SSL certificate.
Since the server is self-hosted, on the first connection ...
4
votes
1answer
131 views
TOR detection in network
After I read this link, I tried to understand how they manage detect TOR traffic
The most understandable source for me was this paper
He is saying TOR trafic can be detected by port, cipher suite ...
3
votes
2answers
33 views
Change 'Key Usage' of a certificate
Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
5
votes
5answers
111 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
1
vote
2answers
51 views
Force SSL/TLS client cert authentication even if server does not request it?
Usually the server specifies in the Server Hello message if a client certificate is needed/wanted.
Does anybody know if it is possible to perform an authentication via client cert if the server does ...
2
votes
1answer
37 views
Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA
I would like to ask if it is possible to use different CA for the client certificate and the web certificate?
For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
-1
votes
1answer
80 views
Wireshark Decode HTTPS Root Certificate
I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
7
votes
4answers
990 views
What kind of attack was this?
So our website was hacked, and these are the things that were done:
Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
4
votes
2answers
105 views
Multiple SSL connections in a single HTTPS web request
I set up Apache2 with SSL and tried to request the default Apache2 web page ("It works!") using https://[IP_ADDRESS].
The Chrome developer tool shows that only one HTTP connection is established, ...
-5
votes
0answers
52 views
SSL usage and step involved to enable in a web app [closed]
i want to know abt SSL usage and how it improves security link to useful materials will be much appreciated
4
votes
1answer
127 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
-1
votes
0answers
55 views
TLS Certificate in OSX Mail
My question hasn't been asked before here but when I googled for an answer I arrived at this thread @ macrumors.com. The question is quoted below:
I'm just curious, but in Lion's Mail there is a ...
3
votes
1answer
53 views
How is the TLS protected against length field of the header being modified?
I know this question looks very silly, but, it has been bothering me for a while and I am unable to come up with an answer by myself. So, here it goes..
Packets in the TLS protocol consist of a 5 ...
5
votes
3answers
86 views
What are the risks of a localhost signed cerificate?
In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections.
Suppose we use this CA to sign a key for "localhost" for use in ...
6
votes
1answer
213 views
Does HTTPS Encrypt PHP Arguments?
I am working on a web app that will need to have a secret key(s) passed from one server to another - I'll need to do this over PHP. Consider the following URL:
...
1
vote
1answer
71 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
8
votes
1answer
177 views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
3
votes
1answer
84 views
Why clients offer handshaking with SSL 2.0 protocol
According to the book, Data Center Fundamentals, page 369, SSLv3 support was added in Netscape 2.x and Internet Explorer 3.x, and TLS was added in Netscape 4.x and Internet Explorer 4.x.
I am ...
4
votes
1answer
138 views
If SSL encrypts urls, then how are https messages routed?
I've googled around and it seems like SSL encrypts URLs. (Correct?) As I understand it, if I go to a site like http://security.stackexchange.com then a DNS server looks at the URL, says hey, he wants ...
4
votes
2answers
109 views
Checking client hello for https classification
I need to detect https packets in network traffic . Until now I were marking all "443" as https but I don't want to use port information for these any more .
Will it be enough to check client hello ...
3
votes
1answer
77 views
Has a HTTP server access to SSL session ID?
I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
1
vote
2answers
94 views
Question about HTTPS [duplicate]
I have a question about HTTPS, which I need help understanding.
So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
0
votes
1answer
59 views
Best practice for securing user credentials once they reach the server using Basic Auth + SSL
I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
4
votes
3answers
99 views
What SSL options should not be used?
What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
2
votes
2answers
98 views
BEAST mitigation on a Cisco ACE 4710 load balancer
We are looking to mitigate BEAST (and similar) on our Cisco ACE appliance (running version A4(2.0)), which is the 'endpoint' for a handful of load-balanced services. Some of these service still run ...
1
vote
1answer
68 views
For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?
I am observing an issue in which the TLS handshake is failing between a Java Client and a web service hosted under IIS 7. Upon wiresharking the attempt it seems that the problem is the list of ...
5
votes
3answers
241 views
Is it possible to “protect” against MITM attacks over HTTP?
In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form.
The ...
3
votes
3answers
209 views
Self signed certificates for https
Where I work, currently for internal sites, self signed certificates are being used.
In Firefox, the info regarding the certificate are displayed:
site domain: xxx.com
Owner: Site doesn't supply ...
6
votes
3answers
276 views
Man-in-the-middle Blue coat proxy ssl or what?
I have just discovered that my workplace have enabled some new feature in the blue coat network proxy. It seems like all https certificates in chrome on windows is being issued by this internal ...
1
vote
2answers
167 views
SSL: How to send generated client certificate from server to avoid MITM?
The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
91 views
Generate openSSL certificates from within C code using commands?
This is an openSSL command for generating a private key and a certificate,
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
The question I have is whether there is some ...
2
votes
6answers
216 views
Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case.
Is there a way to determine and display the state of HTTPS on a page ...
11
votes
4answers
455 views
Handling passwords in a web application
I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
3
votes
7answers
509 views
Is it compulsory to have https on e-commerce site?
I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data.
I just saw a site that has an e-shop link, if i click it my browser says ...
4
votes
3answers
218 views
Are secret URLs secure over HTTPS?
Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread.
What level of ...
2
votes
2answers
92 views
Looking for general guidance on securing web API application for client applications and users
I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.
After a lot of googling ...
6
votes
2answers
104 views
Client authentication vs. user authentication
I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
1
vote
1answer
108 views
Why a web server HTTPS certificate can't sign its subdomain HTTPS certificates?
Why having a valid certificate for "exampe.com" I can't make a "child" certificate for "subdomain.example.com"?
What insecurities will arise if browsers start allowing domain's certificates to be ...
4
votes
2answers
72 views
Using SSL Certification in Multiple Locations
I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access.
The ...
1
vote
1answer
93 views
Following redirects from HTTPS to HTTP - Secure?
So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting)
This means, in theory, if you ...
6
votes
4answers
270 views
Man-in-the-middle scenario for TLS
Consider the following scenario: You want to securely communicate with a.com and you only trust the VeriSign root certificate.
a.com presents a certificate signed by VeriSign with CN=a.com, so you ...
1
vote
0answers
33 views
Using SSL on my sites for everything or just some things? [duplicate]
I have a server which provides a few services through the web, some of those services must be logged into to be able to use them. For these services I have implemented SSL using level 3 CACert ...
3
votes
1answer
155 views
SSL Encryption (for HTTPs) & Security vs Performance
I was looking into server performance when using various SSL Certificates. Specifically 1024-bits vs 2048 vs 4096. It turns out, it makes a big difference!
I've heard a lot of talk lately about ...
1
vote
1answer
142 views
Does Java's implementation of OCSP and CRL checking handle intermediate CAs?
I've read that Java provides OCSP and CRL checking for CertPaths via:
Security.setProperty("ocsp.enable", "true");
System.setProperty("com.sun.security.enableCRLDP", "true");
Do these implementations ...
2
votes
1answer
85 views
How do I diagnose client-side SSL errors?
Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
0
votes
2answers
60 views
Do keyservers keep logs of who adds whom to their keyrings?
Maybe it depends on the keyserver. Does that pose privacy issues?
0
votes
3answers
45 views
Is connection to keyserver encrypted?
When you retrieve someone's information from a keyserver to add him to your pgp keyring, that is made through unencrypted keyservers, unless the user uploaded it to https://keyserver.pgp.com/. Even ...
1
vote
2answers
45 views
Will using SSL to secure Wordpress admin area only still actually be secure?
The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas.
There ...
14
votes
3answers
1k views
What's an easy way to perform a man-in-the-middle attack on SSL?
I'd like to perform a man-in-the-middle attack on SSL connections between clients and a server.
Assuming the following:
I've got a certificate that the client will accept, via poor cert validation ...
