SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
1
vote
2answers
95 views
Question about HTTPS [duplicate]
I have a question about HTTPS, which I need help understanding.
So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
0
votes
1answer
68 views
Best practice for securing user credentials once they reach the server using Basic Auth + SSL
I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
4
votes
3answers
109 views
What SSL options should not be used?
What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
2
votes
2answers
124 views
BEAST mitigation on a Cisco ACE 4710 load balancer
We are looking to mitigate BEAST (and similar) on our Cisco ACE appliance (running version A4(2.0)), which is the 'endpoint' for a handful of load-balanced services. Some of these service still run ...
1
vote
1answer
82 views
For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?
I am observing an issue in which the TLS handshake is failing between a Java Client and a web service hosted under IIS 7. Upon wiresharking the attempt it seems that the problem is the list of ...
5
votes
3answers
288 views
Is it possible to “protect” against MITM attacks over HTTP?
In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form.
The ...
3
votes
3answers
239 views
Self signed certificates for https
Where I work, currently for internal sites, self signed certificates are being used.
In Firefox, the info regarding the certificate are displayed:
site domain: xxx.com
Owner: Site doesn't supply ...
6
votes
3answers
338 views
Man-in-the-middle Blue coat proxy ssl or what?
I have just discovered that my workplace have enabled some new feature in the blue coat network proxy. It seems like all https certificates in chrome on windows is being issued by this internal ...
1
vote
2answers
196 views
SSL: How to send generated client certificate from server to avoid MITM?
The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
118 views
Generate openSSL certificates from within C code using commands?
This is an openSSL command for generating a private key and a certificate,
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
The question I have is whether there is some ...
2
votes
6answers
229 views
Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case.
Is there a way to determine and display the state of HTTPS on a page ...
11
votes
4answers
470 views
Handling passwords in a web application
I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
3
votes
7answers
528 views
Is it compulsory to have https on e-commerce site?
I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data.
I just saw a site that has an e-shop link, if i click it my browser says ...
4
votes
3answers
230 views
Are secret URLs secure over HTTPS?
Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread.
What level of ...
2
votes
2answers
112 views
Looking for general guidance on securing web API application for client applications and users
I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.
After a lot of googling ...
6
votes
2answers
130 views
Client authentication vs. user authentication
I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
1
vote
1answer
117 views
Why a web server HTTPS certificate can't sign its subdomain HTTPS certificates?
Why having a valid certificate for "exampe.com" I can't make a "child" certificate for "subdomain.example.com"?
What insecurities will arise if browsers start allowing domain's certificates to be ...
4
votes
2answers
80 views
Using SSL Certification in Multiple Locations
I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access.
The ...
1
vote
1answer
97 views
Following redirects from HTTPS to HTTP - Secure?
So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting)
This means, in theory, if you ...
6
votes
4answers
292 views
Man-in-the-middle scenario for TLS
Consider the following scenario: You want to securely communicate with a.com and you only trust the VeriSign root certificate.
a.com presents a certificate signed by VeriSign with CN=a.com, so you ...
1
vote
0answers
33 views
Using SSL on my sites for everything or just some things? [duplicate]
I have a server which provides a few services through the web, some of those services must be logged into to be able to use them. For these services I have implemented SSL using level 3 CACert ...
3
votes
1answer
183 views
SSL Encryption (for HTTPs) & Security vs Performance
I was looking into server performance when using various SSL Certificates. Specifically 1024-bits vs 2048 vs 4096. It turns out, it makes a big difference!
I've heard a lot of talk lately about ...
1
vote
1answer
217 views
Does Java's implementation of OCSP and CRL checking handle intermediate CAs?
I've read that Java provides OCSP and CRL checking for CertPaths via:
Security.setProperty("ocsp.enable", "true");
System.setProperty("com.sun.security.enableCRLDP", "true");
Do these implementations ...
2
votes
1answer
106 views
How do I diagnose client-side SSL errors?
Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
0
votes
2answers
69 views
Do keyservers keep logs of who adds whom to their keyrings?
Maybe it depends on the keyserver. Does that pose privacy issues?
0
votes
3answers
57 views
Is connection to keyserver encrypted?
When you retrieve someone's information from a keyserver to add him to your pgp keyring, that is made through unencrypted keyservers, unless the user uploaded it to https://keyserver.pgp.com/. Even ...
2
votes
2answers
62 views
Will using SSL to secure Wordpress admin area only still actually be secure?
The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas.
There ...
14
votes
3answers
2k views
What's an easy way to perform a man-in-the-middle attack on SSL?
I'd like to perform a man-in-the-middle attack on SSL connections between clients and a server.
Assuming the following:
I've got a certificate that the client will accept, via poor cert validation ...
1
vote
1answer
67 views
How to insert custom packets into SSL handshake?
I am trying to communicate with an SSL server whose protocol is non-standard. I want to insert custom packets into the handshake. I am using several SSL tools, so changing source code on every tool ...
-2
votes
1answer
75 views
What mode of operation is secure for block ciphers?
as RC4 is not secure and AES-CBC is same thing the only solution is using EAX mode for AES. but why mozilla NSS don't support EAX mod ? is there any secure EAX implementation ? and why wikipedia says ...
2
votes
1answer
205 views
Is TLS 1.2 client authentication really different from that earlier ersion of TLS
From wikipedia link (cannot post due to stackexchange constraints). "http://www.yassl.com/yaSSL/Blog/Entries/2010/10/7_Differences_between_SSL_and_TLS_Protocol_Versions.html" and and also from the ...
2
votes
1answer
110 views
Would introducing client certificates for a mobile app improve security?
I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...
5
votes
1answer
316 views
Why is NIST removing & not updating TLS guidance? What is the replacement?
The document NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations was retired without superseding it with a newer document.
In ...
1
vote
1answer
122 views
Can I use any ssl certificate to sign and encrypt AS2 message?
I'm absolutely new to this topic of ssl certificates, so please be patient with me.
My task is to install an AS2 communication with some business partner. Therefore we need message signing and ...
3
votes
1answer
722 views
How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?
I read a lot of issue [1] currently stating that RC4 is broken and is at risk.
I just checked my web server (nginx) and it is using the default settings, which is
DHE-RSA-AES256-SHA
How does this ...
3
votes
5answers
155 views
Does using ssl matter if I am connected using a VPN?
Say I have an internal server that I am using for source control. If I only access that server through a VPN connection, do I still need to have SSL setup on the source control server to ensure that ...
0
votes
1answer
97 views
Setting up two way SSL
I am trying to setup two way SSL to communicate with partner web service. I understand I have to provide server certificate on client side. However, questions are:
Is self signed certificate okay?
...
2
votes
1answer
106 views
Certificate Chains When Importing Signed CSR Response
I'm interfacing with a secure web service, and authenticating using a client certificate. I'm confused about step #3 in the client configuration:
Generate a private key into keystore
Generate a CSR ...
5
votes
4answers
912 views
Why don't major browsers currently support TLS above version 1.0?
TLS 1.0 seem to be vulnerable to Beast, Lucky13 and maybe other attacks and is simply outdated. Common workaround used e.g. by Google was to use RC4 which was also recently broken, but none of the ...
0
votes
2answers
122 views
Two-way SSL Performance
We are planning to use 2 way ssl instead of username/password token for authentication. Does anyone know what is the performance penalty for using 2 way SSL?
3
votes
5answers
313 views
Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?
I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"?
Furthermore, are there any practical ...
0
votes
2answers
119 views
Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]
I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
0
votes
1answer
66 views
Implementing secure login for an API
I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
0
votes
1answer
106 views
Is this a secure method for authenticating clients?
I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy.
Client sends a ...
2
votes
1answer
108 views
SSL certificates published in Mandiant's APT1 report
You probably heard about excellent report "APT1: Exposing One of China's Cyber Espionage Units" published by the Mandiant company (you can download it here). Report is great and I recommend it to ...
1
vote
2answers
105 views
What threats are posed by SSL connections?
I'm working on implementing an Exchange 2010 solutions which includes Outlook Web Access, Exchange ActiveSync and Outlook Anywhere. These services use SSL and would be presented on the Internet so our ...
5
votes
2answers
192 views
RC4 bias protection with padding in TLS
On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said:
One way to "fix" RC4, which has been suggested many times, is to drop ...
15
votes
1answer
667 views
TLS: RC4 or not RC4?
I was reading another interesting article by Matthew Green today, saying that
if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop
As far as I'm aware ...
2
votes
2answers
84 views
Should I use SSL on my database server?
Say I have a website and a database, both hosted on rackspace.
Since all communication with the database is from the web server and not the internet, is it safe to assume that I do not need SSL ...
1
vote
1answer
214 views
Web Applications (http): Don't get how token based authentication is secure
See something like this:
http://stackoverflow.com/questions/10826293/restful-authentication-via-spring/10864088#comment21706215_10864088
Or more specific:
Token-based authentication - Securing the ...
