SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

-3
votes
2answers
168 views

NSA and facebook chats [duplicate]

Can you guess how the NSA can read Facebook chats, while Facebook does use SSL encryption? Requesting information directly from the Facebook HQ is possible (see also who betrayed Facebook in favor of ...
1
vote
1answer
1k views

Backing up SSL certificate private key files

What are some recommended practices for backing up SSL certificate private key files? I'm working in an environment where the public web servers are not backed up, because in theory the public ...
1
vote
1answer
495 views

Transparently authenticating users or devices on mobile devices

I have an interest in using EAP-TLS to authenticate both users and devices separately on mobile devices (phones, iPods, tablets, etc.). My issue is how to delineate between user authentication and ...
2
votes
1answer
404 views

Does the NSA X-Keyscore apply for HTTPS traffic? [closed]

See X-Keyscore: NSA tool collects "nearly everything a user does on the internet". http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-data Does anyone have a clue how they ...
5
votes
1answer
7k views

Getting “SSL: alert [”write“]: fatal : bad record mac” during openssl Handshake

I am getting SSL: alert ["write"]: fatal : bad record mac from the OPENSSL logs during the handshake and Client is not sending the Application data and its creating the handshake again and again. ...
0
votes
1answer
304 views

How to get an exhaustive list of ciphers for TLS 1.0, TLS 1.1 and TLS 1.2

After TLS 1.0, there have been a number of RFCs e.g RFC 5932, RFC 6430 etc. Is there any place where one can get an exhaustive list of ciphers for each of the versions. Or at least an exhaustive list ...
1
vote
2answers
2k views

Public keys on OpenSSL vs PGP?

It is my understanding that PGP permits multiple public keys, and in SSL you can only extract one public key? Is this correct? Is there any brief high level run down between the two. I don't feel as ...
3
votes
2answers
571 views

A protocol to authenticate users without login/password

A casual message exchange on reddit yesterday got me thinking whether it might be possible to design a protocol that removes the need for users to remember a unique password for every service (s)he ...
7
votes
1answer
840 views

What's the hash for in ECDHE-RSA-AES-GCM-SHA?

Presumably the SHA is for deriving the AES key from the shared secret. Where else is the hash used? ECDH just does ECC (no hashing). RSA does masking and padding but this doesn't involve the ...
5
votes
2answers
730 views

Root SSL certificates and browser support

I have given three certs to be install on nginx AddTrustExternalCARoot.crt PositiveSSLCA2.crt www_example_com.crt So I concat them into a chained cert cat www_example_com.crt PositiveSSLCA2.crt ...
1
vote
2answers
130 views

Question about authentication cookies? [duplicate]

Say, I have a website where users are required to login to access certain functionality. Once they are logged in, they are issued an authentication cookie. Some of the pages on the authenticated ...
5
votes
2answers
342 views

Avoiding MITM attacks when using HTTPS over mobile

There are a variety of other questions that address elements of this security issue, but none that seem (to a non-expert) to address the substantial core of the issues raised in this article: ...
17
votes
2answers
545 views

How do I ensure there is sufficient entropy on an embedded system at first boot?

I'm working on an embedded system that will generate an SSL key the first time the system boots. I would like to avoid the problems discovered by Heninger et al. and Lenstra et al. where embedded ...
2
votes
2answers
190 views

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
5
votes
1answer
536 views

Retrieving client certificate using Tcpdump results in zero length certificate

I am trying to proxy a mobile app (with Fiddler), which sends a client certificate to the server it connects to. I would think that capturing traffic with Tcpdump, retrieving the client certificate ...
3
votes
2answers
453 views

Should I customize my Root CA's thumbprint/fingerprint? (SHA1 or MD5)

My goal is to make a certificate's thumbprint "easier" to verify, and not reduce security in doing so. Given that the RSA-based Bitcoin technology has a concept called a "Vanity address" where the ...
4
votes
1answer
3k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
6
votes
1answer
204 views

SFTP or FTPS for connecting to a VPS?

I'm going to be hosting one of my websites on a VPS soon and I want to make it as secure as possible. Only I will need access to the VPS, and I can't see that changing in the near future. Because it ...
3
votes
2answers
2k views

Checking SSL\TLS servers for null encryption support

I have a web server supporting SSL 3 and TLS protocols , the following are the supported cipher suites. TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can i ...
1
vote
1answer
135 views

SSL Handshake takes much longer in LAN than in WAN [closed]

Here is the structure we have, 3 servers in location A (172.22.25.X) and 3 servers in location B (192.168.140.X). One of the 3 servers in each location creates an SSL connection to the other 4 ...
4
votes
1answer
196 views

Unique SSL keys for load-balanced hosts

Given a setup with multiple SSL-terminating load-balancers in a failover configuration, is it a bad idea to have a unique TLS private key for each one of the hosts? They would all share the same FQDN. ...
1
vote
2answers
492 views

Prevent my site to be sniffed and changed by man-in-the-middle-attacks

I want to secure site which is locally used for Prepaid Services, the site has been hacked many times, for the first step, I implemented SSL and its now working fine, however, I want to be sure that ...
7
votes
1answer
10k views

TLS Handshake gets torn down

I am trying to debug a TLS handshake between two SIP trunk endpoints: .75 and .82. Mutual authentication is being used. .75 sends: Client Hello Certificate, Client Key Exchange Certificate ...
4
votes
1answer
897 views

Intercepting and reading SSL traffic generated by Android

I am trying to use my PC to capture, decrypt and analyse traffic from SSL sessions on my android tablet. So far, I have a ZAP proxy server set up, with a CA generated. On my android device, I have ...
7
votes
4answers
1k views

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
3
votes
3answers
3k views

Disabling SSL v2 and weak ciphers on client PC's

Is it a requirement to also disable SSL v2 and weak ciphers on client PC's? I have seen quite a few posts for disabling them on servers, but nothing about a regular client PC, say, running Windows XP ...
2
votes
1answer
849 views

Why can I see the Basic Auth credentials in plaintext when using SSL

I just read this about the security about Basic Authentication over SSL: Is BASIC-Auth secure if done over HTTPS? And I don't get it. I just installed ProxyDroid (http proxy) on my rooted android ...
3
votes
2answers
2k views

Exploiting HTTP content in HTTPS page [closed]

I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content (say, https://Secure-Site.com loading an image from http://Not-A-Secure-Site.com) ...
2
votes
2answers
212 views

Is it possible to automate use of passphrase-encrypted private keys?

Suppose I have a public/private keypair, which I would like to use to serve HTTPS from a webserver. The part I'm worried about is this: the private key is encrypted with a passphrase, so that if an ...
18
votes
8answers
2k views

Should a site have SSL if it doesn't have a login form?

We have a site at work that is used for the following: Our homepage, which is just some info and contact info. Job applications are also handled on our site. There is no place where you can login ...
2
votes
2answers
2k views

Checking if TLS 1.1 and 1.2 implementation in a webserver is upto standards

I am testing a webserver[proprietary] which offers SSL support and they say it supports TLS 1.1 and 1.2 which i have verified by firing requests from IE with only the target protocol enabled . ...
7
votes
6answers
362 views

How important is it to protect demo data by HTTPS enabled server?

If the application is not in production mode, there is no commercial contract signed with customer yet, and you just want to give a link to the customer (or give the demo yourself) so that they can ...
9
votes
5answers
4k views

SSL/TLS - Distinction between self-signed cert and self-signed CA, and other questions?

I have a small personal website which I wish to serve securely over HTTPS. At the moment I do not wish to use a third party CA to sign my certs. I was reading this document on generating a self-signed ...
2
votes
3answers
2k views

Is a self-signed SSL certificate much better than nothing? [duplicate]

I have a server which hosts my own internal code among other things. Since it's only me using it, I've generated a self-signed SSL certificate and key, hoping that it'd give me a bit more security ...
-2
votes
1answer
732 views

Are GET parameters secure over https? [duplicate]

Since GET parameters are passed in the url, how can they be secure from someone with access to network logs. He would be able to see what urls are accessed, even if he cannot see the request and ...
7
votes
1answer
617 views

AWS VPC - should connections between instances be over SSL?

Say I have a few EC2 instances in an AWS VPC network, each assigned its own private address for the subnet at creation. Say one of them is a DB, and another one some kind of web app talking to the DB. ...
19
votes
5answers
5k views

Can HTTPS server configured without a server certificate?

I have noticed that, a HTTPS connection can be set up with the server configured to use a certificate, and when additional security is required, the server can ask the client to provide a client ...
8
votes
1answer
558 views

Is it possible to recognise and prevent MitM attacks on devices which use self-signed SSL certs?

I use both Linux and Windows at work on a large enterprise LAN. The majority of the network configuration is out of my reach. Certain SaaS applications that are hosted locally on the enterprise LAN, ...
1
vote
1answer
349 views

Assuming no MITM, is Gmail communication 100% secure and private?

I sometimes have to use my personal Gmail account from my company workstation, where I know for fact they are using content-aware firewall(s) like Palo Alto, and potentially other nasty things like ...
12
votes
4answers
10k views

Remove RC4 from SSL/TLS ciphers in Chromium

Recently I started to live without RC4 within my Firefox session. Discussion about it can be found here. While it is quite easy in Firefox (Enter about:config and then rc4), I found no possibility to ...
2
votes
3answers
2k views

Uploading files through an HTTPS web application

We have a client facing web site. A certificate is required to land on the login page, where upon you then need a username and a password to further login. System has Apache servers acting as load ...
5
votes
1answer
375 views

SSL - Null Prefix Attacks Still Possible?

At DEFCON 17 (2009) Moxie Marlinspike gave a talk were he was able to use a malformed certificate signing request to get SSL certs signed for domains he doesn't own. The gist of it was that for the ...
2
votes
3answers
922 views

SSL vs Encryption

I am working on creating an android mobile application which needs to connect to a server from time to time. The application makes use of sensitive data which I would not like to get into the wrong ...
9
votes
2answers
12k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
6
votes
2answers
181 views

Should I test my SSL certificate for “RSA Shared Primes” before using it?

There are several papers from 2012 that say it's possible to factor several moduli by factoring shared primes. The link above includes python sourcecode to verify and test for this fact. Given this ...
7
votes
3answers
4k views

Can someone explain a little better what exactly is accomplished by generation of DH parameters?

I'm setting up a node.js server: https.createServer({ ... ciphers: 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH', honorCipherOrder: true }, app).listen(443); ...
15
votes
3answers
770 views

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
1
vote
2answers
478 views

Why is malwarebytes.org's SSL certificate from someone else?

I tried downloading and updating malwarebytes from https://www.malwarebytes.org but their certificate seems to be incorrect. This is the warning: This is probably not the site you are looking for! ...
5
votes
2answers
221 views

Configuring election website to prevent MITM attacks

Consider an election web site that will be used for voting over the Internet. What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks ...
13
votes
2answers
1k views

Is there a tool to verify browser TLS/SSL configuration

I am looking for a tool to verify the configuration of ssl/tls settings in the browser. I have found a few sites that enumerate supported ciphers and the preferences but none of them seem to provide ...