SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

3
votes
0answers
160 views

How secure is HTTP basic authentication over SSL? [duplicate]

Possible Duplicate: Is BASIC-Auth secure if done over HTTPS? I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
10
votes
4answers
897 views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
17
votes
3answers
8k views

Is there a way to mitigate BEAST without disabling AES completely?

It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like ...
1
vote
1answer
404 views

SSL Inspection - how should it be done?

I've seen several questions that deals with SSL Inspection, none of them really carried a detailed response on the secure way of doing so. The reason I'm asking is because of this: Cyberoam fixes ssl ...
-1
votes
2answers
86 views

What happens when and attacker changes the installed public keys in browser

I was reading about SSL. I understood that each browser comes with a predefined set of known public keys,which is then used to authenticate the messages. I was wondering what will happen when a virus ...
10
votes
2answers
1k views

How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?

http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data http://rt.com/news/uk-privacy-internet-freedom-186/ 'Black boxes' will be installed by internet services providers ...
1
vote
2answers
421 views

How to secure the connection between the proxy and application

I have designed a framework for my application where I have a proxy to communicate with the outside world. The connection between proxy and the application is encrypted using SSL. But the connection ...
0
votes
1answer
464 views

Why do we need to use HTTP CONNECT? [closed]

If we are writing a custom http client which connects with an https server. Should the custom client when deployed on machines which are behind web proxy need to send a HTTP CONNECT Request so as to ...
2
votes
1answer
2k views

SSL cert not turning green anymore

I'm running a drupal site and have asked about this issue pertaining specifically to the drupal aspect of it here. I know that the "Green" https url doesn't show up because the cert itself isn't ...
4
votes
2answers
4k views

Internal SSL Certificates?

As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
1
vote
1answer
2k views

How do I use OpenSSL with the Java Keytool?

I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
0
votes
2answers
389 views

How to safely collect bank account from website?

I want to collect bank account information from my customers on my website. I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or ...
8
votes
1answer
290 views

Why can the validity of an SSL certificate exceed the registration period of a domain?

I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
3
votes
2answers
2k views

Do most browsers handle mixed encrypted and unencrypted content correctly?

In Google Chrome, when I go to an encrypted page that contains unencrypted content, I get the following pop-down, which allows me to either load or not load the insecure content, making a clear ...
8
votes
2answers
2k views

What can an attacker do with a stolen SSL private key? What should the web admin do?

What can an attacker do with a stolen website certificate and key? What should the website admin do upon learning this?
2
votes
1answer
51 views

Does SGC Support reduce HTTPS security?

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption. This article says SGC should never be ...
2
votes
1answer
1k views

What is the industry standard approach to disable weak ciphers to mitigate vulnerabilities?

Particularly this question is focused for Windows Server 2008 R2. I know the registry can be used to modify particular entries to disable weak ciphers if they are known. I saw this tool: ...
1
vote
1answer
2k views

What are the consequences of disabling ssl v2 and weak ciphers?

It is my understanding that IIS has ssl v2 enabled by default. Also, TLS 1.0, if enabled, allows for at least one known major vulnerability titled "beast attack". If the weak and vulnerable ciphers ...
4
votes
3answers
900 views

What does it mean for a digital certificate to be “signed”?

When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
1
vote
1answer
337 views

Purpose and Uses of Root SSL Certificates

I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?). When and ...
1
vote
3answers
3k views

Block the HTTPS version of a website

I would like to block some websites from their HTTPS version and allow them on HTTP. The main websites involved are Youtube and Google Images/Videos. I am using K9 Web Protection on each computer, and ...
8
votes
4answers
1k views

Is using “HTTPS everywhere” extension secure?

I would like to know if one should use 'HTTPS everywhere' extension? Is it secure to use it? Are there any better alternatives? HTTPS Everywhere is a Firefox and Chrome extension that encrypts ...
6
votes
2answers
1k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
3
votes
3answers
879 views

Is a company website secure against sslstrip if it doesn't use ssl on homepage but ssl everywhere else?

Most ecommerce websites use SSL/TLS when you want to log. But most have homepage using http only. Is it enough to have SSL/TLS on login page and logged page to prevent sslstrip ?
2
votes
4answers
492 views

Should links to images contained in emails be secure?

We are generating emails which contain links to images: our client's branding, images showing other products offered by the client etc... What are the security pitfalls if these links in the emails ...
2
votes
3answers
162 views

Are my credentials unsafe if I am already logged-in before connecting to a public network?

Let's say I am already logged-in to my Gmail or Yahoo account using my 3G then I switched to a public WIFI in an airport or cafe. Is my username and password still vulnerable? What others kinds of ...
2
votes
1answer
178 views

Any problems with UCC (multidomain) SSL certs on iOS and Windows Phones?

Are they any known issues with UCC (multidomain) SSL certs on iOS or Windows Phone? Let's say I want to have Exchange server under outlook.mycompany.com and RemoteApp Portal under ...
-1
votes
2answers
288 views

Is SSL needed for connecting to my DVR System?

I was wondering if SSL is necessary to connect to my DVR System, by default, which can't be changed, I can connect to my DVR System with the help of dyndns.com. But going to the domain doesn't show ...
4
votes
2answers
192 views

TLS server key: possible to sign another TLS server key?

If I have a valid (verifiable) certificate C_K_s that links the server key K_s to "www.example.com", is it possible to : use K_s to sign K_d, and let S_K_d be this signature use K_d as the TLS ...
2
votes
1answer
689 views

Generate one CSR for two Windows servers

I have two Windows 2008 R2 servers which will be hosting a load balanced website. I will generate a private key and use it to generate a CSR using OpenSSL. How can I make this CSR (or the resulting ...
3
votes
2answers
156 views

In practice, does crypto software accept a *.com or or even a *. certificate?

Assuming this will be done with your own PKI, and not a public trusted CA. Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
2
votes
3answers
626 views

SSL inspection detection

an interesting question was recently asked about SSL inspection, and that got me wondering if it is actually possible, from the end user (or even server side), to detect if the SSL link is being ...
9
votes
4answers
2k views

SSL Inspection and privacy

I know my company is testing something called "SSL Inspection" based on Websense, which is our proxy. I can not provide more detail about this, but does this mean that in principle all my SSL traffic, ...
7
votes
2answers
2k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
4
votes
4answers
568 views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
2
votes
3answers
879 views

Is OpenSSL secure enough?

We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries. It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
1
vote
1answer
286 views

JS frontend for RESTful backend vs authorization

I'm building web-app. And i have concern about security issues. In world a lot of similar questions, but many of them does not have really clear answer(advise,suggestion). This is the reason why i ...
5
votes
3answers
752 views

Is TLS flawless enough to prevent eavesdropping carried out by an ISP?

I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic. Will that prevent ISP and ...
2
votes
6answers
838 views

Does Self-signed certificate differ from CA from a security point of view?

I know that if I use self-signed cert, browsers will warn about it to the user, but I want to know that from security viewpoint is self-signed cert as secure as certificate authority(CA)?
2
votes
3answers
142 views

Whether certificates can be used for regulating access

I am thinking of a mechanism where I need to authenticate the client and control the access. I am thinking of using SSL for this purpose. I want to know whether using SSL solves my purpose. My ...
1
vote
2answers
119 views

Does Convergence solve the problem of hacked CAs?

My question is about the Firefox AddOn Convergence. So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
6
votes
3answers
973 views

Securing a multi-tenant architecture

I'm a computer science student looking to expand an already developed web application into using multi-tenant architecture. Considering I'm far from being a security expert, which precautions can I ...
7
votes
2answers
10k views

How to mitigate SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability?

Disclaimer: I'm not a sysadmin, please try to give your answers in developer friendly language ;) I'm test scanning a fresh VPS image with Nessus and I'm getting plugin 58751. I tried figuring out ...
4
votes
3answers
174 views

Is using encryption the only viable option to thwart password sniffing?

I'm using HTTPS Everywhere on my browser to chose SSL versions of websites when available, but many sites don't offer a secure version. Is SSL the only viable option to thwart password/clear text ...
2
votes
2answers
850 views

'SSL Session Resumption using Cached Session IDs'

Is supporting 'SSL Session Resumption using Cached Session IDs' by SSL Servers secure ? Is Session Hijacking possible in any way if this feature used ?
2
votes
1answer
112 views

Spurious SSL Certificates when accessing sites through enterprise network

I've noticed recently when I log on to sites like Hotmail that IE has been telling me there is something wrong with my SSL certs. When I examine the certs, the Issuer appears as "Blue Coat" from ...
19
votes
3answers
13k views

What is ECDHE-RSA?

What is the difference between ECDHE-RSA and DHE-RSA? I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
5
votes
3answers
2k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
7
votes
1answer
181 views

Does dnssec protect against malicious registrars?

With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked). This is especially ...
4
votes
4answers
616 views

What's the safest way to access my US-based bank's website from within Mexico? VPN vs SSH vs HTTPS?

I will soon be moving to Mexico and living there for an extended period. During that time I will need to occasionally access my US-based bank's website. I'll always be connecting using my own laptop, ...