Tagged Questions

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
3answers
121 views

Does semi-sensitive information demand encryption / security? [closed]

Since it's been requested that this question be rewritten: Is SSL (or some other encryption equivalent) required in the below case? From a small local business website, is there any damage that an ...
0
votes
1answer
457 views

How to MiTM SSL on a device with no proxy settings

I'm trying to MiTM a device on my network and having some problems. SSLstrip doesn't work because the URL is https://, and I can't use something like Fiddler because the device has no configurable ...
1
vote
1answer
409 views

Camellia and ECDHE_ECDSA -ECDSA in TLS1.2

I am setting up a server using nginx. I have it working with a self signed ecc certificate and if I connect it reports ECDHE-ECDSA which is what I wanted. But I was also wondering if I could use ...
0
votes
2answers
330 views

Is HTTPS based on a private key on the user side? [duplicate]

Is HTTPS it based on private key on user side? Where does the user get the private key in the first place? Suppose the user gets the private key by downloading a browser (Chrome, Firefox), then ...
3
votes
1answer
265 views

Safe way of accepting customer-supplied private keys?

We run a software as a service application that is used by medium to large companies. One part of our application is a messaging service that integrates into the customers own infrastructure. At the ...
2
votes
3answers
158 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
0
votes
1answer
89 views

how does IE or chrome verifies certificate? [duplicate]

If the HTTPS webserver uses self signed certificate, the web browser warns the user as follow. http://www.sslshopper.com/assets/images/iis7/iis7-self-signed-certificate-8-certificate-not-trusted.png ...
5
votes
3answers
807 views

How to Man in the Middle Internal AD Traffic

A coworker asked me why I thought encrypting internal AD Bind communication was important. I said because I follow a standard security practice, but couldn't actually articulate how an attacker would ...
2
votes
1answer
194 views

Fundamental differences between digital ID and SSL security certificates

I was reading http://www.symantec.com/verisign/digital-id and http://technet.microsoft.com/en-us/library/dd351044(v=exchg.150).aspx. The articles are treating ssl cert and 'digital id' as if they are ...
1
vote
2answers
236 views

Choosing the right X.509 certificate infrastructure for securing LAN communications between a PC and a device

Edit: seems like I was quite hasty when typing in my question at first, so here is an updated version of it. I am developing an application that runs on PCs which are on the same LAN as other ...
2
votes
0answers
62 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
5
votes
2answers
410 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
17
votes
3answers
3k views

Why can SSL certificates not be free of charge?

I am a newbie in this field. I am confused with why SSL certificates cannot be free of charge. In my understanding the certificate is just a text file consisting of cryptic numbers installed on a ...
10
votes
2answers
660 views

Why are we still using HTTP? [duplicate]

I've been reading a lot of online articles and blogs about advantages of using HTTPS (HTTP over SSL/TLS) and the performance issues involved in deploying a website over HTTPS. What I understood is ...
1
vote
0answers
198 views

Should I tunnel multiple TCP connections through a TLS/SSL tunnel or use TLS/SSL for each connection?

I am developing an application that runs on Windows PCs. The application is able to connect to some kind of devices within a LAN. It can create multiple TCP-connections to the device it is connected ...
2
votes
3answers
945 views

How to mitigate SSL based DDoS attacks?

as you probably know the problem with SSL based DDoS attacks is, that the traffic cannot be analysed and filtered by a DDoS mitigation service provider such as Prolexic, Akamai, Radware, etc. without ...
1
vote
2answers
200 views

Securing multiple connections with different protocols all together

I need to secure the communication between an application (runs on any PC and has been designed for Windows) and an external device (runs on UNIX). The application is running on Windows while the ...
1
vote
4answers
365 views

Achieving End to End encryption with TLS

The scenario is that a client browser (eg: a user trying to log in to a bank website) needs to be able to view certain sensitive information that resides in a mainframe sitting in the Internal network ...
1
vote
3answers
542 views

TLS 1.2 Server certificate and signature_algorithms

In the specification for TLS 1.2, it says the following: If the client provided a "signature_algorithms" extension, then all certificates provided by the server MUST be signed by a hash/signature ...
0
votes
1answer
178 views

Can I use a CDN for static content without sacrificing SSL keys?

I would like to use a CDN for the static content of a website. But obviously I do not wish to share my SSL key with any external service. What are my options? An ideal solution would be to link to ...
0
votes
1answer
257 views

Are web sites with non-https login pages secure? [closed]

I was looking at weibo.com (chinese equivalent of twitter). I was surprised to see that their login page (http://www.weibo.com/) or forgot password ...
0
votes
2answers
111 views

SSL/TLS Question [closed]

I am currently working on my SSL/TLS assignment and I got a question to ask. What is the use of a login password since it is not needed for establishing secret communication between your computer and ...
0
votes
1answer
112 views

vsftp encryption algorithm

I want to configure VSFTP for ftps protocol and it has some choices to select the encryption type: tlsv1, sslv2, sslv3. I read that tls version 1 has some security issues but in the man page it says ...
1
vote
2answers
66 views

Using SSL for a single request

I want to use distributed cluster configured like: xx.resource.server.com. xx - can be anything from aa to zz, most of the requests will be one time. I need the connection to be secure between client ...
1
vote
1answer
210 views

Long-lived SSL connections to dynamic IP addresses

I'm seeing some odd behaviour on my proxy server logs since I started blocking direct outbound connections to port 443 (thus forcing applications to use the proxy server for HTTPS connections). I'm ...
1
vote
0answers
468 views

Safe communication via rest api between two known servers

i would like to have some advice on the following scenario: I'm using kinvey as backend but because it doesn't provide the ability to run custom code i have set up another server. So basically when x ...
2
votes
2answers
327 views

https://www.truecrypt.org forwards to http://www.truecrypt.org

Why is the site doing this? Is that a security flaw? In general, I'd be wary about using a http site instead of a https, although regarding truecrypt specifically, I came to trust it. I wonder why not ...
5
votes
2answers
293 views

Can I trust large companies like Google not to store failed password attempts?

Let's say, for example, that I accidentally entered my Microsoft account password instead of my Google account password when logging in to some Google web service. After getting an error message, I ...
0
votes
1answer
115 views

SSL and Strategy to prevent destination URL from being revealed

Googling the subject "sniffing out / spying on SSL secured communications" one finds many references to being able to make some good guesses about the "target destination" once the path length is ...
17
votes
5answers
2k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
13
votes
6answers
2k views

How secure is redirecting user from http://normal.bank.com to https://secure.bank.com?

I have an application. Which works on http, http://normal.bank.com. But for log-in, performing any action, etc. I am rediecting user to https://secure.bank.com, where user can login and perform ...
0
votes
1answer
107 views

Which URL is revealed when using wildcard SSL?

Assume there are two servers; server1.com has a standard SSL certificate installed and server2.com has a wildcard SSL certificate (*.server2.com) installed. Next, assume you make from server 1 via ...
9
votes
3answers
3k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
4
votes
1answer
499 views

PFS on nginx: only RC4 gets used (TLS_ECDHE_RSA_WITH_RC4_128_SHA)

I'm trying to configure my webserver for perfect forward secrecy. I'm using ssl_ciphers ...
0
votes
2answers
1k views

Is it possible to intercept https traffic and see the links?

If a site uses https and transfers the customers credit card and ID in the url. Will an attacker be able to intercept those through a MITM attack? And through Sniffing.? Can the packets be sniffed ...
2
votes
1answer
127 views

SSL certificate for testing

I am building a node / express app, and for testing https routes, I would like to include a dummy ssl private key and certificate in the repository. This is so that the other developer, who is mainly ...
3
votes
1answer
334 views

Protect session id without SSL - Accepted answer on Stack Overflow seems wrong?

I'm learning more about security and in my search also using Google Search I found the following question and answer on Stack Overflow: ...
0
votes
1answer
100 views

Protected Client Server communication advice

I am hoping for a better understanding about SSL/TLS by setting up two devices, running two different applications, allowing communications to go over SSL/TLS. With OpenSSL I have created a ...
1
vote
2answers
238 views

Is SSL required for sites hosted behind WAF?

We have a website hosted behind WAF and we will be using HTTPS. The server already has a valid SSL. Do we need to install SSL on WAF servers also?
0
votes
2answers
208 views

Man-in-the-middle SSL generation on request possible

I am doing some research on man-in-the-middle focusing on SSL in particular. I have been looking into generating a certificate on request when a client connects and requests a secured page. ...
1
vote
1answer
209 views

SSL/TLS in Jabber

Just wondering: is entire traffic between me and the Jabber server I use encrypted, or only login and password? Given that the server supports encryption, and my IM client is configured to ask for ...
1
vote
1answer
51 views

How to properly implement TLS on an ejabbered server

The official ejabbered documentation instructs the user to generate a self-signed certificate like this: openssl req -new -x509 -newkey rsa:1024 -days 3650 -keyout privkey.pem -out server.pem openssl ...
1
vote
2answers
951 views

Do i need SSL certificate signed by a CA for hybrid mobile apps?

I have just stepped into ssl domain and started exploring how to implement ssl. My question is i understand ssl certificates signed by CA actually allow the client or browser to validate that the ...
1
vote
2answers
205 views

Understanding certificate security

I am reading Computer Networks by Tanenbaum and Weatherall. In chapter 8 they describe secure communication using public key exchange via certificates. They describe a situation where Alice is sending ...
4
votes
3answers
2k views

Safe to expose Active Directory via LDAPS externally?

We currently access Active Directory via LDAPS internally for authentication and user data retrieval. Is it common, or safe, to expose this publicly over LDAPs? Addendum 1: Our business case, ...
1
vote
2answers
121 views

Is there any point to keeping a “Verified by X” image on the page for a page secured by SSL?

So, I saw this on a page: (The redacted part says the name of the entity that owns the domain) The page recently got SSL certs verified by GeoTrust. The image is on ...
2
votes
2answers
2k views

Basic self-signed certificate questions

A few basic questions around self-signed certificates Question 1 Does a self-signed certificate has to have a CA? I realize that a "real" certificate must as it otherwise can be chain validated but ...
1
vote
1answer
235 views

Export ciphers prevalance

I would like to clarify the consequences of not supporting export ciphers. When I run a qualys ssl test on ebay.com, I notice that the following cipher suites are supported. ...
1
vote
1answer
248 views

Can an SSL client send CLIENT HELLO with version 3.2 and NOT negotiate 3.1

Can an SSL client send CLIENT HELLO with version 3.2 and NOT negotiate 3.1. For sslv2 and 3, one could do that by sending ssl23 CLIENT HELLO or SSL3. Please provide input on how one can support 3.2 ...
0
votes
1answer
133 views

TLS_RSA type ciphersuite and PFS

Today while I'm reading about the RSA factoring challenge. I thought to myself that if whoever depends on RSA-512 (By using TLS_RSA_xxxx) to secure their TLS connection years ago, the info they wish ...