Tagged Questions

1
vote
2answers
44 views

Will using SSL to secure Wordpress admin area only still actually be secure?

The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas. There ...
4
votes
3answers
212 views

System time and certificates

Recently I accidentally changed the system time to a different month, and then I surfed to a secure site. I got a warning from Google Chrome that mentioned my system time and said the certificate ...
11
votes
2answers
6k views

Should I disable SSL compression because of CRIME?

I've read CRIME - How to beat the BEAST successor? and a few articles on the subject (linked below) and found no recommendations for system administrators. As a web host, should I disable SSL ...
-1
votes
1answer
285 views

MITM Attacks over SSL [duplicate]

Possible Duplicate: How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption? If I have a server (call it server 1) set up to receive ...
13
votes
3answers
4k views

Is there a way to mitigate BEAST without disabling AES completely?

It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like ...
8
votes
2answers
768 views

How to defend against SSL-Exhaustion attacks?

The problem of SSL-Exhaustion attacks is well known for years, but nobody really cared until THC released their exploit-tool recently. THC talks about counter measurements in their release: No real ...
5
votes
2answers
639 views

How eavesdropping will be performed how can I prevent from eavesdropping

I believe that eavesdropping in a man in middle attack and the message is passing from the client to server the man sitting at ISP or network hackers can look at what message I am sending. Heard that ...
6
votes
2answers
285 views

Design proposals for enhanced security for parts of Internet, e.g. for banking?

There is some recent discussion of some sort of "multilevel" internet, with e.g. a level defined for banking in which access is only granted after special authentication with "true names", special ...
7
votes
1answer
2k views

SSL replay attack when client/server random is missing

Hey studying the SSL protocol, I'm wondering how can someone be able to do a replay attack if the server nonce is missing? All the material I find says that nonces prevent it, but theres no examples ...
10
votes
6answers
305 views

Should we configure all devices to never request SSL 2.0, and reject it if offered?

In an effort to reduce man in the middle attacks, when will it be (or was it) an industry accepted practice to reject SSL 2.0 connections on the client and server side? Is configuring this on a proxy ...