SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
1answer
614 views

how to make socat ignore client certificate?

I'm trying to set up a listener to check if an application checks the server's certificate (I'm strongly assuming it is not). So I've created a self-signed certificate fake.pem for a listener and am ...
7
votes
4answers
3k views

How likely/possible is it that the NSA have broken common encryption techniques such as SSL/TLS?

Jumping on the NSA/Prism questions bandwagon - There's been a lot more attention drawn to facilities such as Room 641A which indicate that the NSA has been, amongst other things, applying mass ...
0
votes
3answers
712 views

SSL vs TLS, which is less vulnerable to DOS attacks?

When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks. However, all I seem to find ...
2
votes
1answer
310 views

Is there a Skype plugin that uses TLS and ZRTP

I'm curious, if one can upgrade the security Skype offers to avoid a man in the middle snooping in on the calls by both parties using a client side plugin? Does one exist for this purpose? A bit of ...
1
vote
1answer
567 views

What is the difference between an HTTPS traffic setup with Stunnel and a SSL-VPN

We have a scenario where we cannot connect to our stunnel server running on port 443 on our network, which only allows access to Internet via a proxy server. On the contrary, when we tried a SSL VPN ...
3
votes
1answer
759 views

MITM and replay attacks prevention

I have a client (a mobile app) and a server, the app connects to the server via SSL. The server uses a self-signed certificate, and the client has a file (I'm not entirely sure what, something to do ...
12
votes
3answers
1k views

Multi-tenancy, SSL Certificates, and Subject Alternative Name

The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension. From the spec: The subject alternative name ...
3
votes
1answer
612 views

How to MiTM insert an iframe using burp or another tool?

So, I am trying to obtain a cookie without the secure flag enabled over HTTPS. After reading about it, I came across an answer: You visit https://secure.example.com/ which drops a cookie on your ...
5
votes
2answers
917 views

Is it possible to force a new SSL session

Using tools like Wireshark, it's possible to decrypt SSL traffic as the client by logging the (pre)master secret, without using a mitm attack or the server's private key. But I found that for some ...
1
vote
1answer
98 views

Secure authentication cookie for web site

Hello i want to know if this auth token is secure enough for a site of millions of logged in users: ...
7
votes
2answers
754 views

Is “Fingerprint Check” enough to verify HTTPS certificates?

So I'm at place A, see this sign: and I'm writing the fingerprints to a piece of paper (this website is just an example): Ok. Then, I go to place B (other country, etc.) then I check this ...
9
votes
3answers
219 views

What simple security considerations can I / should I make for a read-only API?

Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
5
votes
3answers
474 views

Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?

Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate ...
2
votes
1answer
70 views

Remote network security option

I'm a bit confused with some different network security techniques. Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be ...
6
votes
3answers
447 views

Security implications of an exploited router

So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
2
votes
3answers
2k views

Can attackers steal SSL certificate from server and use it for MITM attacks?

I'm writing an iOS app for private use to acts as a client for a PHP server. To secure the connection I'm using a self-signed SSL certificate. Since the server is self-hosted, on the first connection ...
4
votes
1answer
667 views

TOR detection in network

After I read this link, I tried to understand how they manage detect TOR traffic The most understandable source for me was this paper He is saying TOR trafic can be detected by port, cipher suite ...
3
votes
2answers
626 views

Change 'Key Usage' of a certificate

Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
5
votes
5answers
2k views

How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
2
votes
2answers
1k views

Force SSL/TLS client cert authentication even if server does not request it?

Usually the server specifies in the Server Hello message if a client certificate is needed/wanted. Does anybody know if it is possible to perform an authentication via client cert if the server does ...
4
votes
1answer
473 views

Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA

I would like to ask if it is possible to use different CA for the client certificate and the web certificate? For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
-1
votes
1answer
278 views

Wireshark Decode HTTPS Root Certificate

I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
7
votes
3answers
2k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
4
votes
3answers
899 views

Multiple SSL connections in a single HTTPS web request

I set up Apache2 with SSL and tried to request the default Apache2 web page ("It works!") using https://[IP_ADDRESS]. The Chrome developer tool shows that only one HTTP connection is established, ...
8
votes
2answers
4k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
5
votes
2answers
920 views

What is the difference between SSL and X.509 Certificates?

I used openssl to create a X.509 certificate but I don't quite understand the relationship between a X.509 and a SSL certificate. Are they the same? Is a SSL certificate just a X.509 certificate that ...
3
votes
1answer
185 views

How is the TLS protected against length field of the header being modified?

I know this question looks very silly, but, it has been bothering me for a while and I am unable to come up with an answer by myself. So, here it goes.. Packets in the TLS protocol consist of a 5 ...
6
votes
3answers
1k views

What are the risks of a localhost signed cerificate?

In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections. Suppose we use this CA to sign a key for "localhost" for use in ...
7
votes
1answer
402 views

Does HTTPS Encrypt PHP Arguments?

I am working on a web app that will need to have a secret key(s) passed from one server to another - I'll need to do this over PHP. Consider the following URL: ...
1
vote
1answer
111 views

SSL Communication and Proxy

Let us say that I have a client and a server communicating using SSL. If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
15
votes
1answer
8k views

Configure SSL Mutual (Two-way) Authentication

A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
4
votes
1answer
2k views

Why clients offer handshaking with SSL 2.0 protocol

According to the book, Data Center Fundamentals, page 369, SSLv3 support was added in Netscape 2.x and Internet Explorer 3.x, and TLS was added in Netscape 4.x and Internet Explorer 4.x. I am ...
4
votes
1answer
2k views

If SSL encrypts urls, then how are https messages routed?

I've googled around and it seems like SSL encrypts URLs. (Correct?) As I understand it, if I go to a site like http://security.stackexchange.com then a DNS server looks at the URL, says hey, he wants ...
3
votes
2answers
2k views

Checking client hello for https classification

I need to detect https packets in network traffic . Until now I were marking all "443" as https but I don't want to use port information for these any more . Will it be enough to check client hello ...
3
votes
1answer
215 views

Has a HTTP server access to SSL session ID?

I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
2
votes
2answers
1k views

How to you manually decrypt a SOAP message using openssl?

So I have a SOAP message like this (key data and encrypted data has been truncated): <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" ...
1
vote
2answers
137 views

Question about HTTPS [duplicate]

I have a question about HTTPS, which I need help understanding. So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
1
vote
1answer
231 views

Best practice for securing user credentials once they reach the server using Basic Auth + SSL

I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
4
votes
3answers
238 views

What SSL options should not be used?

What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
2
votes
2answers
435 views

BEAST mitigation on a Cisco ACE 4710 load balancer

We are looking to mitigate BEAST (and similar) on our Cisco ACE appliance (running version A4(2.0)), which is the 'endpoint' for a handful of load-balanced services. Some of these service still run ...
2
votes
2answers
825 views

For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?

I am observing an issue in which the TLS handshake is failing between a Java Client and a web service hosted under IIS 7. Upon wiresharking the attempt it seems that the problem is the list of ...
8
votes
3answers
745 views

Is it possible to “protect” against MITM attacks over HTTP?

In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form. The ...
3
votes
3answers
733 views

Self signed certificates for https

Where I work, currently for internal sites, self signed certificates are being used. In Firefox, the info regarding the certificate are displayed: site domain: example.com Owner: Site doesn't supply ...
5
votes
3answers
2k views

Man-in-the-middle Blue coat proxy ssl or what?

I have just discovered that my workplace have enabled some new feature in the blue coat network proxy. It seems like all https certificates in chrome on windows is being issued by this internal ...
2
votes
2answers
409 views

SSL: How to send generated client certificate from server to avoid MITM?

The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
352 views

Generate openSSL certificates from within C code using commands?

This is an openSSL command for generating a private key and a certificate, openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key The question I have is whether there is some ...
8
votes
3answers
3k views

Preventing a spoofing man in the middle attack?

I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
3
votes
6answers
395 views

Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?

I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case. Is there a way to determine and display the state of HTTPS on a page ...
11
votes
4answers
1k views

Handling passwords in a web application

I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
4
votes
7answers
2k views

Is it compulsory to have https on e-commerce site?

I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data. I just saw a site that has an e-shop link, if i click it my browser says ...