Tagged Questions

2
votes
1answer
81 views

How do I diagnose client-side SSL errors?

Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
2
votes
2answers
378 views

Protecting against SSL Strip [duplicate]

I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe? Does it depend on the cert strength? Do you ...
6
votes
3answers
363 views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
0
votes
1answer
177 views

DrayTek Vigor 2920 HTTPS allowed

In my office we have a DrayTek Vigor 2920 router, with CSM setup to only allow certain keywords (keyword objects) to certain IP groups. This all works fine, however we've discovered that all HTTPS ...
2
votes
1answer
192 views

SSL VPN placement strategies

I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations: with firewall within the internal network within the DMZ Any reference also ...
1
vote
1answer
59 views

For SSL certs, is some sort of connection to the issuing CA (or other network resource) required for the SSL connection to be established?

I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL". Background: I am deploying ...
2
votes
3answers
185 views

Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?

OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure. But basically, ...
4
votes
1answer
137 views

How does my antivirus determine which CTL is used?

I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
0
votes
0answers
228 views

Pcap file inspection [closed]

I have 3 packet capture, generated with Wireshark, of an example intrusion but I'm struggling to figure out whats going on. I also tried running the pcap files in snort to see if it detected ...
2
votes
3answers
152 views

Are my credentials unsafe if I am already logged-in before connecting to a public network?

Let's say I am already logged-in to my Gmail or Yahoo account using my 3G then I switched to a public WIFI in an airport or cafe. Is my username and password still vulnerable? What others kinds of ...
4
votes
3answers
152 views

How (if at all) can an attacker manipulate an already established SSL/TLS Connection?

First off, this is a purely academic question. My first answer would be that he cannot since he does not have the session key. Could he at least kill the connection, such as by sending spoofed FIN ...
2
votes
1answer
191 views

Is SSL session based only? Is there a (formal) definition of an SSL connection?

In various docs on SSL there is a mention of connection. But from the context I am not sure if this means the underlying TCP connection or the SSL connection. I am thinking that there is no SSL ...
1
vote
1answer
275 views

How to use sslstrip with Internet Connection Sharing?

I'm trying to make sslstrip work with Internet Connection Sharing.ve shared internet connection to router and another pc connected to that router, all are Linux, so Internet <-> pc1 <-> ...
5
votes
2answers
785 views

Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?

I have read the TCP Connection Establishment on Wikipedia In brief the packets to start are SYN, with a (hopefully) random sequence number A from the client. SYN-ACK, responding, with A+1 and ...
3
votes
1answer
1k views

Recommended Cipher Suites for TLS 1.0, 1.1 and 1.2

There are a lot of cipher suites defined in the in the specifications itself of TLS 1.0, 1.1 and 1.2. And furthermore, there exist RFCs which add even more cipher suites to a specific version (e.g. ...
15
votes
3answers
606 views

What are the risks of using a CDN to speed up my website? How do I avoid them?

Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN. What ...
5
votes
2answers
639 views

How eavesdropping will be performed how can I prevent from eavesdropping

I believe that eavesdropping in a man in middle attack and the message is passing from the client to server the man sitting at ISP or network hackers can look at what message I am sending. Heard that ...
4
votes
2answers
400 views

Which is the easiest secure file transport protocol to implement (SFTP, FTPS, HTTPS, FTP over SSH, FTP over IPsec)

I have to select a secure file transfer protocol, to be implemented in a pre-boot system. I have access to libraries with the basic network functionalities (IP, TCP, UDP, etc...). I might also have ...
1
vote
5answers
2k views

How to properly encrypt a communication channel between a client and a server (without SSL)?

I have a poor knowledge in the world of cryptography, I'm just starting to learn it so I'm a newbie :) As a project for getting into the field of cryptography I want to write a client\server program ...
20
votes
3answers
2k views

How does Convergence (CA replacement) prevent its notaries from being MITM'd as well?

I have been looking into Convergence and how it works, but I cant figure out how it is effective against a MITM attack that happens near the target system. My understanding is that Convergence works ...
6
votes
2answers
285 views

Design proposals for enhanced security for parts of Internet, e.g. for banking?

There is some recent discussion of some sort of "multilevel" internet, with e.g. a level defined for banking in which access is only granted after special authentication with "true names", special ...
13
votes
1answer
487 views

Are there any security problems with Google false start for TLS?

Google recently announced false start in Chrome browsers which increased TLS performance by 30% http://news.softpedia.com/news/Google-Chrome-s-SSL-False-Start-201253.shtml I know TLS has been poked ...
5
votes
1answer
589 views

TLS at layer 4 BUT 802.1X EAP-TLS at layer 2?

In the CISSP books, SSL/TLS has been through the arguments and fell rest onto the transport layer 2 instead of the session. OK - Fine. Port security 802.1X and EAP is a data link layer 2 ...
2
votes
1answer
1k views

How to find out if a connection encrypted?

I'm sniffing a connection that uses ICEP (ZeroC ICE Protocol), and its packet bodies compressed using BZ2 (GNU BZip 2) algorithm. I want to find out whether packets encrypted, or not. ICEP can use ...
23
votes
3answers
14k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
11
votes
7answers
9k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
10
votes
4answers
536 views

What is the risk of a packet being sniffed when travelling over the internet without SSL/TLS?

We all know to use SSL/TLS to stop people eavesdropping on our connection, but how likely is it that an attacker will actually sniff your unencrypted password or cookie if you don't? If we exclude ...
7
votes
1answer
1k views

SFTP, FTPS and SecureFTP differences and security implications

What are the basic differences and security implications of using SFTP, FTPS and SecureFTP.
10
votes
6answers
305 views

Should we configure all devices to never request SSL 2.0, and reject it if offered?

In an effort to reduce man in the middle attacks, when will it be (or was it) an industry accepted practice to reject SSL 2.0 connections on the client and server side? Is configuring this on a proxy ...