SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

0
votes
0answers
60 views

What major vulnerabilities have there been to TLS libraries? [on hold]

I'm trying to compile a list of large security vulnerabilities in TLS (and SSL) libraries. Examples of things I'm looking for are: Heartbleed Goto fail The Firefox/NSS PKCS11 (IIRC) parsing bug
0
votes
0answers
15 views

DTLS CertificateVerify doubt

In DTLS 1.2 RFC 6347, section 4.2.6: CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: ...
0
votes
1answer
46 views

Understanding Hearthbleed attacks [duplicate]

In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct? Or can this be done ...
0
votes
1answer
45 views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
0
votes
1answer
67 views

Do I need an SSL Certificate for a HTTP only site?

The cert for our public facing site is about to expire soon. Our site is entirely http. The site runs on SharePoint, and with SharePoint working with NTLM, the credentials that are passed over the ...
2
votes
1answer
57 views

How do I securely deal with SSL certificate validation failure when the client date is incorrect?

I have an application that runs in mobile devices and connects to my server via HTTPS. At times the connection fail because the device has a date set in the past (before the 'valid from' date on my ...
2
votes
2answers
64 views

Identifying SSL traffic?

How does DPI basically identify SSL data traffic? Just by the number “443” in port section or the SSL traffic has some other particular properties other than “443”? Thanks in advance,
0
votes
0answers
69 views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...
0
votes
1answer
70 views

Python SSH vs SSL? [duplicate]

I read the What is the difference between SSL vs SSH? Which is more secure? , and it mentions there is the possibility they can be affected by similar attacks. Now that the heartbleed thing is out, ...
0
votes
1answer
52 views

Outbound Port 443 Open but Not Allowing SSH [on hold]

My college wireless network has a firewall blocking all outbound ports except 443 and 80. The wired network, however, has none of these restrictions. I can connect to HTTPS sites (obviously). On my ...
-1
votes
0answers
51 views

Secure connection failed (OCSP)

I've been getting a lot of failed connections lately, namely from Facebook and now Google (German site works, French does not). This happened to other sites as well but these two are the kind you do ...
3
votes
3answers
115 views

Risk in buying SSL cert from non well-know party

Let say I knew a guy is selling SSL cert in a very cheap price, assume they will generate a real and valid cert for me, since I need to submit my CSR to them and they pass to th CA, are there any ...
4
votes
1answer
145 views

What are the OpenSSL standard Diffie Hellmann parameters (primes)?

I recently generated some custom Diffie Hellmann parameters which are basically just long (in the below case 4096 bit) primes. Those are then used in the key exchange process. I used the following ...
0
votes
1answer
38 views

Apache 2.2 mod_ssl configuration Forward Secrecy/BREACH/BEAST/CRIME

I am looking for mod_ssl configuration which protects against common attacks like Breach, Beast and Crime. I already disabled gzip to avoid Crime but I'm unsure about the others. RC4 should only be ...
5
votes
2answers
141 views

Can Heartbleed expose a TOR user's IP address?

It is interesting to observe, that TOR exit nodes with out-of-date OpenSSL implementations can themselves be affected by the Heartbleed bug. Can Heartbleed expose a TOR user's IP address merely by ...
0
votes
1answer
29 views

Downloading list of pinned certificates

I'm thinking about implementing certificate pinning in a mobile app. The app will need to connect to several secure sites. Rather than having to update the app every time one of their certificates ...
1
vote
1answer
32 views

Is it bad to put a certificate as CA in Firefox?

I know I can add a self-signed certificate from a website to Firefox, but only in the CA list of it. Question: does this mean I have to ultimately trust that self-signed certificate? Can someone ...
2
votes
7answers
115 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
2
votes
2answers
97 views

What prevents me from using ARP poisoning to force a client to use HTTP?

So I was just thinking about how ARP poisoning can be used to intercept a clients request, forge an SSL cert, and send it back, with the caveat of not meeting certificate validation, but what if I ...
0
votes
1answer
146 views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
0
votes
0answers
17 views

error in net excess [closed]

Incorrect certificate for host. The server presented a certificate that doesn't match built-in expectations. These expectations are included for certain, high-security websites in order to protect ...
1
vote
2answers
61 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
2
votes
1answer
136 views

Why is the SSL handshake not shown in Wireshark?

I am trying to figure out if some Android applications with login functions are vulnerable to man in the middle attacks or not. I have set up a MITM proxy (as an attacker) on my lubuntu machine and ...
1
vote
1answer
61 views

Are there any “offline” open source software with I can check my HTTPS site? [closed]

There are many sites that can rank the HTTPS quality of a website. But are there any that is open-source and can be used "offline"? So example in an intranet environment. The tool needs to check for ...
1
vote
2answers
27 views

Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?

Put simply, CSRF tokens can be sniffed out of responses from the server unless the request/response are transmitted using encryption. Is this enough of a concern to worry about, or is it reasonable ...
0
votes
0answers
54 views

Squid upgrade HTTP to HTTPS [migrated]

I want to use Squid to upgrade HTTP request to HTTPS using my own certificate, in order to make clients handshake with a server (a reverse proxy) that requires mutual authentication. How can I ...
0
votes
1answer
40 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
1
vote
1answer
54 views

IE11 on windows 8.1 and ssl fallback

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 ...
7
votes
1answer
92 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
2
votes
1answer
49 views

TestSSLServer Results

I ran TestSSLServer.exe (from http://www.bolet.org/TestSSLServer/) against a web server in my organization. The results seemed self explanatory save for one section I'm not sure how to interpret. ...
0
votes
0answers
33 views

How do I renew an SSL certificate correctly? [closed]

I have an SSL certificate which is about to expire under GoDaddy. So what I did after I renewed was Generate a Keystore and CSR in Tomcat Install SSL in Tomcat The above is based on the steps ...
0
votes
0answers
31 views

nginx - How to prevent processing requests with undefined server names with HTTPS

How do I avoid nginx processing a request with an undefined server name using the https protocol. The following configuration makes this work for http requests: server { listen 80; ...
1
vote
0answers
59 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
2answers
87 views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
1
vote
1answer
47 views

Client authentication flaw in old Netscape SSL protocol

Below is a screenshot from the paper "Prudent Engineering Practice for Cryptographic Protocols" by Martin Abadi and Roger Needham. I can't see what's wrong with the protocol and what the fix achieves. ...
1
vote
4answers
229 views

Advantages of one time pad

I always hear that one time pad'ing something is so great because you won't know if you've successfully decrypted the data. I understand the idea that you can XOR any bits just the same as any other ...
0
votes
1answer
46 views

TLS sequence number

Watching at TLS 1.2 traffic using Wireshark, I figured out that in the Application Data record, the 64-bit sequence number in some connessions is sent and in others not. Does it depend on the Cipher ...
1
vote
1answer
343 views

Heartbleed detection [duplicate]

It is fairly easy to detect the heartbleed exploit if it all happens over cleartext, which it seems most things are doing for the time being. However, I believe that there are some heartbleed ...
1
vote
0answers
57 views

Ability to decrypt intercepted encrypted SSL traffic when having private key [duplicate]

I was reading some blog posts about the Heartbleed vulnerability (who's not nowadays) and was thinking about the following. Situation A If I would use a regular SSL/TLS connection the handshake will ...
57
votes
3answers
5k views

Heartbleed: Why does the client supply the length of the message at all?

"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
1
vote
1answer
48 views

Perplexities about TLS handshake

I analyzed the TLS (1.2) handshake and I didn't manage to understand the message after the Change Chipher Spec Here it is: It is called "Encrypted Handshake Message" by Wireshark and it is sent ...
0
votes
1answer
126 views

are there serious weaknesses in this free password management system?

I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
-1
votes
0answers
23 views

Heartbleed & SSL Certificates - What do we do to protect ourselves as end users? [duplicate]

I seem to be hearing a lot of mixed opinions on this subject, so I figure I will turn to you guys for some advice. From my understanding, we should consider any SSL certificate (generated by openssl) ...
-2
votes
3answers
50 views

Does HTTPS retrieval, among its other effects, sign a document? [duplicate]

Does HTTPS retrieval, among its other effects, sign a document? I'm asking in hopes of understanding in more specific details what TLS accomplishes. I will try to elaborate my question, as follows. ...
4
votes
1answer
158 views

Defending against private key leaks such as those enabled by Heartbleed

More and more evidence seems to be surfacing that the Heartbleed vulnerability leaks the private key portion of the SSL certificate in use. As such this can actually mean that if an attacker was also ...
0
votes
2answers
70 views

Firefox can import the .p12 format, but that contains a private key? Isnt this a security risk?

Everywhere I go, people tell me the private keys need to be kept away, possibly even locked into a safe then how come Firefox and other keystores expect you to give them a private key? Firefox is a ...
0
votes
2answers
159 views

Why don't more websites implement Perfect Forward Secrecy?

From what I understand, all it takes to enable PFS on a webserver is adding ephemeral cipher suites (ones that use DHE and ECDHE for the key exchange) to the list of cipher suites used in SSL/TLS ...
-2
votes
0answers
72 views

How does a hacker use the heartbleed bug? [duplicate]

So I was, reading about the new heartbleed bug, and I was really curious about how hackers actually use it. Basically, I'm wonder how someone would go about using this exploit to get information, like ...
0
votes
1answer
96 views

Why can't we create a new SSL implementation?

SSL implementations have been discussed a lot lately, due to Chrome's potential of switching off NSS ...
3
votes
1answer
204 views

Heartbleed - is this scenario possible? how bad would it be?

Let's make the following assumptions: A trusted root certificate was being served with a vulnerable version of OpenSSL. Prior to public disclosure, a malicious entity was aware of and exploited the ...