1
vote
2answers
113 views

Will an IP packet to the own IP address ever leave the computer?

I am working on a system that consists of several applicaitons communicating with each other. Some of these applications will run on the same server and some will run on a different one. So there is ...
0
votes
2answers
69 views

Encryption mechanism

I want to send data over the Internet securely. For that, I am using an public key of the receiver to encrypt the data. In this case, if an intruder in the network modifies the data, like placing the ...
0
votes
1answer
23 views

How is the Premaster secret used in TLS generated?

I believe that it uses some combination of the random values sent in the hello messages. From RFC 2246: (TLSv1.0) RSA encrypted premaster secret message Meaning of this message: If RSA is ...
4
votes
2answers
118 views

Safety of using online proxy?

Lets say for example I have to use a public online proxy like https://www.zend2.com to load a php webpage controlled by me containing sensitive data over https. How would i make sure that the proxy ...
0
votes
1answer
22 views

In TLS1.2 AES-GCM mode, what happened when input is not exactly the multiple of its block size?

I know that AES-GCM mode does not need padding, and its output are exactly the length of input data plus the tagging. But I am a little bit lost, as AES itself is block cipher, it could only operate ...
65
votes
5answers
6k views

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
1
vote
0answers
15 views

PBKDF2 hashing over TLS for encrptig password [closed]

i wanna use PBKDF2 hashing over TLS for encrypting password and session and that way stop hackers from breaking into my connection. How to do it in java.
0
votes
0answers
23 views

Key differences between IPSec and HAIPE?

HAIPE is derived off IPSec but can someone draw up the differences between using IPSec with Suite B crypto and HAIPE with Suite B? We can drop Suite A or classified info for this question; staying ...
29
votes
3answers
1k views

Why do WordPress installations retrieve the crypto secrets remotely on installation?

It seems that WordPress retrieves all the crypto constants remotely (via HTTPS): // setup-config.php $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' ); Are there ...
12
votes
2answers
974 views

Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?

I've noticed that websites start to use 256-bit symmetric encryption, but often still end up using 2048-bit RSA keys. http://www.keylength.com/en/3/ The link above displays the ECRYPT II ...
0
votes
1answer
129 views

Does an HTTPS proxy encrypt traffic between proxy client and server for HTTP requests?

To bypass censorship in a DIY fashion, I plan to set up private proxies for my personal use. One of the possible methods I would try is to use an HTTPS proxy (not a web proxy, to be explicit) hosted ...
3
votes
2answers
126 views

Phone Applications having SSL/TLS enabled behind the scenes?

Please Note: This question is slightly based on me being a tin foiled hat with the issues that has arisen from the leaks, documents, and questioning trust thanks to Edward Snowden. Thanks to adding ...
1
vote
1answer
39 views

Protecting encryption of outdated software with a server

I have a 1st generation iPad, and I usually use it for web browsing when I'm home. The 1st gen iPad can't run newer versions of iOS (I'm stuck with iOS 5). I went to a website that tells if your SSL ...
0
votes
1answer
75 views

Why middleman cannot capture the encryption key of https/tor traffic? [duplicate]

When we use Tor or https traffic , the encryption- decryption key has to be exchanged between the browser and the website server. Why somebody who can capture entire traffic , say ISP or somebody who ...
0
votes
0answers
24 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
0
votes
2answers
106 views

Is the lack of https reason enough to abort form submission?

Preamble: Am in awe about the quality of both questions and answers on https / SSL on this site. My humble question below pales in comparison. Both on professional and amateur websites I've ...
32
votes
5answers
4k views

HTTPS still NSA-safe? [closed]

There are exerpts, that say that using https can be broken by the NSA by now. So is https still a solution for secure web-browsing? source: ...
0
votes
1answer
86 views

Why has Convergence stalled out? [closed]

Convergence is a well-thought out system to replace certificate authorities built by Marlin Moxiespike back in 2011. Since it's debut, it seems to have largely stalled out, with no additional major ...
0
votes
1answer
70 views

SSL decryption without installing a certificate on each client

Given a proxy performing MITM SSL decryption and inspection, is it possible to install a wildcard certificate (*.domain.com) on the proxy signed by a root CA (such as VeriSign or GoDaddy) such that ...
1
vote
3answers
59 views

OpenSSL encrypting small packets bandwidth overhead

I have an c/c++ program used for encrypting data for communicating between two ends. Encryption is done using OpenSSL (0.9.8d-fips, Sep 2006). Think it'll be worthy to mention that I'm not much ...
0
votes
3answers
215 views

How Safe Are Encrypted Websites Really?

I was at a coffee shop and had to (I mean had to) check something on my bank account and another account. I figured since the two websites I was viewing were encrypted, and because my computer (I'm on ...
0
votes
3answers
131 views

Encryption and Layers understanding

If I'm right the SSL encryption take place in the application layer, but we can also have encryption in the Internet Layer. Why are we using both, and why sites that doesn't have SSL are considered ...
2
votes
2answers
94 views

Encrypt and Authenticate localhost-traffic?

I have some app-components on the same machine but in different languages which need to communicate. I am using socket communication over localhost to do so. The data transferred is confidential. ...
1
vote
4answers
320 views

Advantages of one time pad

I always hear that one time pad'ing something is so great because you won't know if you've successfully decrypted the data. I understand the idea that you can XOR any bits just the same as any other ...
1
vote
0answers
57 views

Ability to decrypt intercepted encrypted SSL traffic when having private key [duplicate]

I was reading some blog posts about the Heartbleed vulnerability (who's not nowadays) and was thinking about the following. Situation A If I would use a regular SSL/TLS connection the handshake will ...
0
votes
1answer
159 views

are there serious weaknesses in this free password management system?

I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
2
votes
1answer
57 views

How does the Perspective addon work?

I've just installed the Perspetive addon in firefox. When I'm vistit, for example google, Perspective says the following message: Warning: Perspectives has NOT seen this certificate consistently. ...
0
votes
2answers
123 views

Are SSL encrypted communications through a company network safe?

If I'm using Skype, Facebook, or another type of communication at my work, can the network administrator see my Skype and Facebook conversations, although its encrypted with SSL? I found this text: ...
43
votes
5answers
3k views

How does a country block its citizens from accessing a site?

Following Turkey's recent social site blocks, I am wondering how can you efficiently accomplish that as a country. Similar for a big company. Blocking IPs → easy to circumvent, (proxys, tunnels, ...
1
vote
3answers
164 views

Protecting form post values when on https

I am dealing with a multi-step form, and I need to pass information from step 1 to step 2, then from step 2 to step 3, and so on. Step 1 contains a membership number and ID number entry, as well as ...
63
votes
12answers
20k views

Is Google overreaching by forcing me to use TLS?

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? ...
1
vote
2answers
183 views

SSL/TLS : Authentication mechanism

I have these doubts regarding authentication in SSL/TLS : Will there be an authentication involved for all SSL connections ? For eg. when I browse the internet, using the most up-to-date browser, ...
18
votes
5answers
2k views

Why should one not use SSL? [duplicate]

I see a lot of posts all over the web asking whether or not they should be using SSL to secure their website, or if it's really necessary to do so when the content of their site does not contain or ...
41
votes
12answers
6k views

Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data? [duplicate]

Lots of sites these days, that don't deal with sensitive data, enable encryption. I think it's mostly to make (paranoid?) users feel safer. In cases where there is a user's account being logged in, ...
1
vote
1answer
112 views

Using Encrypt-then-MAC in SSL

SSL typically makes use of MAC-then-Encrypt technique instead of Encrypt-then-MAC (which is usually considered ideal for most of the scenarios). I myself don't have a full insight knowledge about the ...
0
votes
1answer
73 views

Are there software solutions take encrypted credit card data taken straight off a square credit card reader and insert them into a standard web form? [closed]

Does anyone know how you can take the encrypted output of a square card reader and insert it directly into a standard web form?
1
vote
0answers
178 views

Designing a security and encryption strategy for MongoHQ

I'm trying to design the best strategy to achieve the following goals: Securing data-on-the-wire between my server and MongoHQ. Encrypting all data-at-rest with MongoHQ (possibly key values as ...
2
votes
0answers
97 views

Can HTTPS or VPN connection be sniffed through UTM device? [duplicate]

Someone told me that if my device communicates with a server on Internet via VPN connection or HTTPS, all the contents that I have sent can be sniffed and decrypted by the UTM device (or more ...
1
vote
1answer
722 views

Are post requests secure?

If a post request is sent from a client on a website without SSL, is the request secure? For example, I visit a site badsecurity.com, and I login using a password: Will this password be encrypted ...
0
votes
1answer
42 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
1
vote
0answers
99 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
2answers
729 views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
1
vote
3answers
138 views

Using public/private key without signed certificate

I am working on a java program and I am now working on its network security. I want to use a secure connection since it transfers a lot of sensitive information. On all security guides it is mentioned ...
0
votes
2answers
44 views

DHE Verification

I'm just struggling to get my head around this. In certificate signing with static Diffie Hellman the public key and certificate information is sent to the CA who verifies the certificate ...
0
votes
2answers
308 views

Google's usage of RC4

I was reading about Google's usage of RC4 and an answer on stackexchange website stated the following: I know Google uses RC4 for most of its services, and this is the reason one shouldn't keep ...
3
votes
2answers
773 views

Risks of client-side encryption using Stanford Crypto Library

I'm building a simple web application for encrypted chat. Each message will undergo 256-bit AES encryption on the client side, using the Stanford Javascript Crypto Library. No unencrypted data or ...
2
votes
3answers
309 views

Does HTTPS encryption work when there is invalid or there is no certificate?

When I have a website run on https and there is no certificate, there is wrong certificate or out of date like here does encryption still work or not?
0
votes
2answers
196 views

Difference between free ssl and non-free ssl? [duplicate]

I am making a choice between StartSSL and positiveSSL($4.99/yr). I want to know the difference between them. As I know, SSL is used to encrypted the connection between client and server so that data ...
0
votes
1answer
194 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
-3
votes
1answer
93 views

What are the risks if a weak ciphers are accepted by a technology that uses SSL

The TLSSLed tool found that the host that I use has SSL connection that accepts 8 different TLSv1 and SSLv3 ciphers that are weak by their length (40 bits). How can an attacker exploit this fact?