Tagged Questions

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

5
votes
2answers
3k views

Which is better for server-to-server-communication: IPSec or TLS?

Maybe you could help me with a small problem. Would you recommend IPSec or TLS for a Server-to-Server-Connection? I need two or three arguments for reasoning a decision within my final paper, but ...
1
vote
3answers
246 views

What information can be seen from HTTPS to HTTP?

Assuming a secured page https://google.com/redirect.php?keyword=apple which redirects the visitor to a non-secured website http://apple.com, would an eavesdropper (anyone watching over the network) be ...
4
votes
2answers
488 views

Is cookie information hackable by “Man in middle” Attack over HTTPS?

Just I want to know, is it possible to extract header data by 'Man in middle attack' in HTTPS connection and is there any other way or hack to achieve same thing? If there is way to hack, is it ...
6
votes
2answers
2k views

1024-bit DHE vs 2048-bit RSA

Currently with apache/mod_ssl, if DHE is enabled then a 1024-bit ephemeral key will be used. I found the following quote in Adam Langley's blog: Ideally the DH group would match or exceed the RSA ...
1
vote
2answers
276 views

Could a user never store a password if a username/email hash was used instead?

So I was just thinking about token_authenticatable setup from devise (rails gem), and this thought occurred to me: Could we strengthen web security by hashing username/password with javascript before ...
5
votes
3answers
2k views

SSL VPN Detection and possible to block

Is it possible to determine the difference between a VPN on port 443 compared to standard SSL traffic? In order to access SSL websites you need port 443 open but if you setup a VPN Service on port ...
0
votes
1answer
143 views

Can the random keys generated during handshake be guessed

During the handshaking of an SSL connection, the server sends its public key, the client generates a random password, encrypts it with the pk, and sends it back, then the server decrypts it and all is ...
1
vote
3answers
493 views

How does SSL protect against network level attacks on integity?

I would like to know if there is any way to demonstrate how an attacker may attack the integrity of a website due to an unencrypted connection and how SSL will avoid this. For the aspect of ...
5
votes
2answers
841 views

Website: Pre-Shared-Key Authentication

We have this web-application with high valuable (business) data. All communication is encrypted through TLS/SSL. While I consider this a really safe protocol, it can still be compromised if someone ...
14
votes
5answers
3k views

Are self-signed certificates actually more secure than CA signed certificates now?

Are self-signed certificates actually more secure than CA signed certificates now? I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government ...
7
votes
2answers
3k views

How to detect the NSA MITM attack on SSL?

As Bruce Schneider reported here... https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html ...the NSA reportedly performed a MITM attack on a company in brazil and decrypted their SSL ...
6
votes
2answers
478 views

Should you use VPN if the website uses HTTPS?

If I visit the website which uses https, is there a point using an VPN? In places like coffee shop where internet is not secure. Because I think https already encrypts data?
1
vote
1answer
330 views

OpenSSL DH modp size

If OpenSSL is configured to use a DH for key exchange, e.g. TLS_DHE_RSA_WITH_AES_128_CBC_SHA, where does it take the size for modp (or even modp itself) from? The following is a screenshot from ...
7
votes
3answers
605 views

What can a web application developer do to protect user information from powerful adversaries like the NSA or China

Some well funded intelligence services with potentially untrustworthy employees intercept and store encrypted data for years, in hopes of cracking it with future technology. What can I do to make this ...
6
votes
1answer
267 views

Any not totally insecure browser vulnerable to BEAST?

People still worry about BEAST quite a lot when configuring web servers to the point of preferring RC4 over AES-CBC. But most browsers mitigate BEAST even while using TLS 1.0. Is there a browser ...
2
votes
1answer
706 views

Configuring GCM cipher suites in Jetty based server

I have a Jetty based secure http service, and I wish to support GCM cipher suites. I know that Jetty internally use JSSE based ciphers, and there are many GCM ciphers coming with JSSE as documented ...
9
votes
2answers
766 views

Can custom elliptic curves be used in common TLS implementations?

Recent developments have cast some doubt on the elliptic curves specified by NIST and used in many standards like TLS (for signatures with ECDSA and key agreement with ECDHE). It seems like the ...
1
vote
1answer
902 views

OpenSSL: Enable cipher suites per protocol version

Is there a way to explicitly configure OpenSSL to allow AES (or in general, block ciphers) only for clients that use a TLS version >= 1.1? This would protect against the BEAST attack, while still ...
7
votes
3answers
907 views

How do you verify if an app is using secure comms?

Any modern day browser provides feedback to the end user confirming whether or not you are using HTTPS and some basic validation of the cert. When using a mobile application it seems the end user ...
2
votes
2answers
3k views

how to experiment with BEAST attacks

from basic research my understanding is: it is vulnerable in TLS 1.0 in SSL 3 Attacker can inject javascript and pass some known text to some server where attacker will get the encrypted version of ...
12
votes
1answer
16k views

How does SSLstrip work?

I've been reading up on SSLstrip and I'm not 100% sure on my understanding of how it works. A lot of documentation seems to indicate that it simply replaces occurrences of "https" with "http" in ...
1
vote
2answers
922 views

Sniffing From Squid SSL

I created a Squid proxy and a self-signed SSL certificate. The SSL certificate on the server is a private certificate linked to the ssl-bump feature. I am using tshark to dump the SSL traffic, but I ...
1
vote
2answers
128 views

SSL-certificates for overlapping domain regions?

Suppose, a server hosts https://www.master.com/ and thus is equipped with a (single domain) SSL certificate. Furthermore, suppose there are some web apps below master.com: ...
0
votes
0answers
91 views

SSL is cracked. What is the alternative? [duplicate]

According to Der Spiegel: SSL should be cracked Exactly how much the two intelligence agencies can actually read along from the encrypted traffic in the network, is not entirely clear. But ...
4
votes
2answers
714 views

Single domain SSL certificates, actually support 2 subdomains?

While browsing for SSL certificates, specifically domain validation type (the cheapest), I noticed that they advertise as valid for a single domain/subdomain, but then I noticed that they are valid ...
4
votes
2answers
372 views

Login security without SSL

I have a web app without SSL (I know it's not good, I try to take it as a challenge). The login is two step. First the admin sshs into the server and runs a maintenance companion program that provides ...
2
votes
1answer
411 views

What extra protection is added to an REST API over HTTPS by the use of some kind of HMAC?

I'm designing a RESTFUL API that will always be used over HTTPS, what security advantages over the use of HTTP Basic Auth could be brought to my system by using such kind of message authentication ...
4
votes
2answers
171 views

Can the client certificate authentication process treated as a user digitally signed the content(and then get verified on the server)?

The authentication was triggered by certain event (like approving button) on the form. In the process of client certificate authentication (in IIS), user was asked to use their PIN (private key) and ...
-3
votes
1answer
206 views

Different AES 256 algorithms produce different results?

I've tried 3 AES 256-bit CBC encryption programs, and I seem to be getting different results for each one with the same 32-character password, which consists of all @ signs. They are: Polaris SSL ...
1
vote
0answers
360 views

Does ZRTP provide useful protection, given that the SAS is not verified?

Firstly, some important backstory. I'm producing a corporate version of an IM/VOIP/Screensharing client using the Open Source Jitsi. We are going to be using a central server and have already ...
10
votes
4answers
1k views

What was SSL 1.0?

What was SSL 1.0? SSL 2.0 and 3.0 are well-known and well-documented. But what did the SSL 1.0 protocol look like? Wikipedia says there was a SSL 1.0 but doesn't say anything about how it worked. ...
3
votes
2answers
617 views

Why does Google SSL cert change so frequently?

For the last few months I have been using the Firefox addon Certificate Patrol to watch for changes to sites' SSL certs - so as to know if I am being MTIMed, against which SSL otherwise provides no ...
3
votes
2answers
488 views

Is HTTPS still secured with a known server certificate (private key)?

I see that some product are shipped with a default server certificate. I guess that a lot of these installed products still use the default server certificate in a real environment. If your server ...
1
vote
3answers
216 views

How do I mitigate a MITM on https?

I am trying to view a https site (which worked perfectly fine till yesterday) and Chrome is showing me that the site's security certificate is not trusted. I am on a home network. How can I know if ...
1
vote
1answer
204 views

xmpp ssl cipher negotiation

Does anyone know how ssl ciphers are nogitiated via the xmpp protocol. When I capture packets, I see: <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/> There is no hello server/client or ...
1
vote
1answer
243 views

Reason for using Asymmetric encryption along with SHA256

I got a document with integration with another application. They mentioned I need to hash and then encrypt data with my private key before sending it over HTTPS. By doing this, they are making sure ...
0
votes
1answer
30 views

How come MIM is getting through outlook SSl security

Hello I am using outlook with ssl security to connect to a mail server but whenever I launch a MIM attack and accept the fake certificate my password is shown. How is this possible? Shouldn't I be ...
0
votes
2answers
122 views

How is the key obtained when I login via VPN?

So, I configure my VPN (let say which uses PPTP protocol), enter the server name, username and password. Then, I visit a website. Before that, my request is encrypted using AES with some key. That ...
0
votes
1answer
149 views

Average user reaction to SSL certificate error pages [closed]

With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to ...
1
vote
2answers
2k views

Man in the middle attack still possible against ssl?

I've heard about ssl strip in the past that allowed for man in the middle attacks to take place against browsers, but those vulnerabilities were patched long time ago. So my question is...are there ...
8
votes
3answers
356 views

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
2
votes
2answers
1k views

Please help verify my understanding of Domain Validation (DV) SSL Certificate

This is what I understand so far from reading various knowledgebase and article about DV SSL. Can anyone please help clarify if any of these is wrong? DV SSL (and SSL certificate in general) is only ...
1
vote
3answers
131 views

Using HTTPS GET from app to server

When developing Webpages, they say you should use POST for "destructive" actions, and GET for actions that only retrieve information. Is the same true for apps? Is it a total no-no to use GET for ...
2
votes
2answers
5k views

Diffie-Hellman and its TLS/SSL usage

I'm struggling to understand the (non-)use of Diffie-Hellman (DH) in TLS. DH has been around for a long time now, why does almost nobody use it, yet? DH is only being used for "key sharing", why ...
0
votes
1answer
148 views

Does the VPN provider will have access to my content? [duplicate]

I am planning to buy a VPN service just to circumvent the filtering applied by the government. However as I am planning to use OpenVPN on my dd-wrt router, all of my data will pass through this ...
0
votes
3answers
8k views

How to prevent man-in-the-middle attacks beside of SSL?

I would like to discuss this scenario: There is a HTTPS service which responds with signed keys to an authenticated client. These signed keys can be used for another service to return very sensible ...
6
votes
2answers
630 views

ECC based Client Certificate import in Chrome/Mozilla in windows

I have deployed a PKI server and successfully able to generate the ECC based user or client certificates. but non of the web browser support ECC as public key. I have tried different tools and also ...
7
votes
1answer
703 views

Is Postgres password-based authentication secure?

According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password: The password-based authentication methods are md5 and password. These ...
5
votes
3answers
8k views

Is it possible to use wildcard certificates on multiple devices?

I have a server that I want to use a wildcard cert on. It runs multiple services. I purchase a wildcard cert so that I can protect mail.something.dom, www.something.dom, im.something.dom, ...
0
votes
3answers
5k views

How to sniff traffic on my wireless network?

For educational purposes, I want to see what packages are sent over my home wifi with VPN on and off. What program should I use for this?