1
vote
2answers
56 views

How to prevent attacks before HSTS is established for the first time? [on hold]

What is the best way to accomplish this and prevent attacks like SSL Strip?
0
votes
2answers
150 views

Why don't more websites implement Perfect Forward Secrecy?

From what I understand, all it takes to enable PFS on a webserver is adding ephemeral cipher suites (ones that use DHE and ECDHE for the key exchange) to the list of cipher suites used in SSL/TLS ...
1
vote
2answers
51 views

How Web-proxy and Virtual-Hosting are complications for HTTPS?

While studying HTTPS and related transport layer security protocols(SSL/TLS), I came to know that HTTPS suffers from two complications - Web-Proxy and Virtual-Hosting. I can understand how ...
1
vote
3answers
107 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
0
votes
3answers
116 views

HTTP/HTTPS on the same site

Suppose a site allows connection to be established with HTTP or HTTPS .If you establish a connection to http://www.example.com or https://www.example.com then all further link's on the page displayed ...
3
votes
5answers
181 views

Free SSL Certificate when encryption is needed and not trust?

My understanding is that SSL certificates are expensive because you are paying a 3rd party to vouch for your identity, and apparently the most secure form of trust is the trust you have to pay for. ...
3
votes
3answers
174 views

If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?

Now that Google, Twitter, and some other sites require a TLS connection to access their sites, when you go to http://www.twitter.com it redirects to https://www.twitter.com/. If an attacker had access ...
1
vote
3answers
142 views

Https forms on tens of domains

What is the optimal way (cost-wise, too) to secure page forms (https) on a large number of domains&subdomains? Are certificates required for all domains? Is putting all the page forms on a single ...
2
votes
3answers
100 views

Is it secure for a site to serve the login page with HTTP, but have the actual site in HTTPS? [duplicate]

On some websites, the login page (where you enter your login details) is served by a regular HTTP connection with no encryption. However, once I login, the page immediately switches to a secure HTTPS ...
0
votes
1answer
83 views

CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible?

Sorry if this is a very amateur question. I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting ...
33
votes
5answers
4k views

Why do some websites enforce lack of SSL?

When trying to visit https://www.ebay.com, I noticed that I get redirected to HTTP immediately. Here's what cURL says about that: $ curl --max-redirs 0 -v -L https://www.ebay.com * Rebuilt URL to: ...
1
vote
1answer
76 views

Legitimate use case of man-in-the-middle attack for DPI?

I am working on a device that should sit between the end-user and the server, and that will do deep packet inspection. It is basically a parental control node. This device will be sold to the user, so ...
1
vote
1answer
60 views

Can I reliably identify Apple devices that have not patched against the gotofail vulnerability based on user agent string?

The title pretty much says it. Do the security patches to address the gotofail security issue in multiple Apple products employing SSL change the User Agent string for the respective systems? And, of ...
0
votes
1answer
152 views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
1
vote
0answers
66 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
1answer
67 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
1
vote
2answers
235 views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
-1
votes
4answers
143 views

Secure communication between server and client [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
1
vote
1answer
71 views

Is it dangerous to sync my data with my personal server through unencrypted http?

Since Apple force iPhone users to use iCloud to sync contacts & calendar, I moved to a local ownCloud instance that works well. However, it would be more convenient if I could sync everywhere and ...
1
vote
2answers
184 views

Actually, isn't it bad to redirect http to https? [duplicate]

I have a two-part question about question #570288 over on ServerFault. Question: Is it bad to redirect http to https? Accepted answer (185 up-votes): [...] Hell no. It's very good. Part 1 ...
0
votes
1answer
108 views

HTTPS Proxy Everwhere?

I am configuring a HTTPS proxy, which I want to use for my laptop wherever I go. The idea is that since its encrypted, I should be safe from eavesdroppers, even on open wireless networks. Think of it ...
2
votes
1answer
85 views

In Same Origin Policy, why are different protocols considered a security violation?

I can understand why content from different domains is considered to be unstrusted for the same origin policy. But, how can be content from diferent protocols from the same site/domain be dangerous? ...
2
votes
2answers
226 views

Should login pages be cacheable?

I'm considering the relative benefits/disadvantages of making a login page cacheable. Note that here I'm referring to the page containing the form into which the user enters their username and ...
1
vote
2answers
111 views

Can non-https assets be tampered with?

Why load assets such as images, javascript, css etc, over HTTPS? Is it possible for these assets to be tampered with if I use HTTP? The only way I could conceive of tampering with HTTP loaded assets ...
1
vote
2answers
63 views

HTTPs token Parameters : UDIAuthToken

For HTTPs I saw the URL was configured in https://test.com/xml/Transformer=TEST&UDIAuthToken= < string of alphanumeric chars, 160 in count > << this a dummy hostname, with dummy ...
1
vote
3answers
248 views

Does HTTPS encryption work when there is invalid or there is no certificate?

When I have a website run on https and there is no certificate, there is wrong certificate or out of date like here does encryption still work or not?
0
votes
1answer
2k views

Speaking Plain HTTP over an SSL enabled Server port [closed]

atm I'm facing a problem with IE and Firefox because they don't redirect my Links correctly. I'm requesting my application via: https://myapp.example.de/context In my webapplication I have links ...
2
votes
3answers
142 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
9
votes
2answers
492 views

Why are we still using HTTP? [duplicate]

I've been reading a lot of online articles and blogs about advantages of using HTTPS (HTTP over SSL/TLS) and the performance issues involved in deploying a website over HTTPS. What I understood is ...
15
votes
5answers
1k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
15
votes
2answers
660 views

Twitter's HTTP response vs Google's HTTP response

I was looking at the HTTP responses form https://twitter.com and https://encrypted.google.com. These two responses have interesting similarities and differences in their security definitions. Both ...
1
vote
2answers
90 views

non-MiTM Reverse SSL

Do non-MiTM Reverse SSL Proxies exist? Or do all proxies that do SSL-SSL mappings decode and then re-encode HTTPS traffic? If this is the case and I want to map https://mypublicdomain.com -> ...
3
votes
2answers
328 views

Is there a problem with issuing a HSTS header in PHP?

I want to trial a HSTS policy on my blog without enabling it site wide initially. As a HSTS policy is just a HTTP response header would there be any problem with sending the header in PHP like so: ...
1
vote
3answers
226 views

What information can be seen from HTTPS to HTTP?

Assuming a secured page https://google.com/redirect.php?keyword=apple which redirects the visitor to a non-secured website http://apple.com, would an eavesdropper (anyone watching over the network) be ...
1
vote
2answers
102 views

Using HTTPS GET from app to server

When developing Webpages, they say you should use POST for "destructive" actions, and GET for actions that only retrieve information. Is the same true for apps? Is it a total no-no to use GET for ...
0
votes
1answer
153 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...
23
votes
4answers
5k views

BREACH - a new attack against HTTP. What can be done?

Following on from CRIME, now we have BREACH to be presented at Black Hat in Las Vegas Thursday (today). From the linked article, it suggests that this attack against compression will not be as simple ...
1
vote
2answers
108 views

Question about authentication cookies? [duplicate]

Say, I have a website where users are required to login to access certain functionality. Once they are logged in, they are issued an authentication cookie. Some of the pages on the authenticated ...
2
votes
2answers
743 views

Exploiting HTTP content in HTTPS page [closed]

I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content (say, https://Secure-Site.com loading an image from http://Not-A-Secure-Site.com) ...
16
votes
8answers
2k views

Should a site have SSL if it doesn't have a login form?

We have a site at work that is used for the following: Our homepage, which is just some info and contact info. Job applications are also handled on our site. There is no place where you can login ...
6
votes
5answers
2k views

SSL/TLS - Distinction between self-signed cert and self-signed CA, and other questions?

I have a small personal website which I wish to serve securely over HTTPS. At the moment I do not wish to use a third party CA to sign my certs. I was reading this document on generating a self-signed ...
-2
votes
1answer
432 views

Are GET parameters secure over https? [duplicate]

Since GET parameters are passed in the url, how can they be secure from someone with access to network logs. He would be able to see what urls are accessed, even if he cannot see the request and ...
4
votes
2answers
7k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
2
votes
1answer
409 views

Are there any vulnerabilities when making cross-domain HTTP requests during an SSL connection?

I recently starting using the Calomel SSL Validation plugin for Firefox to test the SSL security on the sites I visit. When navigating to American Express' log in page, I noticed Calomel reports the ...
8
votes
1answer
315 views

Build a secure channel without SSL/TLS

I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service). 1. ...
4
votes
3answers
917 views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a https web server that allows only admin's IP numbers. Can anyone connect that web ...
-1
votes
1answer
241 views

Wireshark Decode HTTPS Root Certificate

I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
4
votes
1answer
1k views

If SSL encrypts urls, then how are https messages routed?

I've googled around and it seems like SSL encrypts URLs. (Correct?) As I understand it, if I go to a site like http://security.stackexchange.com then a DNS server looks at the URL, says hey, he wants ...
8
votes
3answers
698 views

Is it possible to “protect” against MITM attacks over HTTP?

In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form. The ...
4
votes
7answers
2k views

Is it compulsory to have https on e-commerce site?

I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data. I just saw a site that has an e-shop link, if i click it my browser says ...