Tagged Questions

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
1answer
384 views

Poodle - possible to protocol downgrade if SSLv3 is disabled but still have SSLv3 ciphers enabled?

My title pretty much sums it up. If I have: A server with the SSLv3 protocol disabled BUT still have SSLv3 ciphers enabled. Would that mean that a protocol downgrade attack can still occur?
5
votes
2answers
1k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
1
vote
1answer
157 views

SSLStrip vs HSTS

I've heard about the new SSLStrip and how it is able to bypass HSTS. Where can I find an article that talks about this? How does this work? Where can I download it? Moxie's website has not been ...
1
vote
1answer
66 views

Is having a GUID in a https url secure enough? [duplicate]

Is having a GUID in a https url secure enough? Are there any security risks of using this way of authenticating users? https://mywebsite.com/......?Guid=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Also what ...
15
votes
3answers
1k views

How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?

How many hostnames can be supported by a wildcard ssl certificate? Is there any limit ?
3
votes
1answer
158 views

Performing POODLE attack

I trying to perform POODLE attack on a hosted server that I've configured to support only SSLv3. The scenario is I logged on my server and it sends the cookie in response that will be stored by the ...
-1
votes
1answer
31 views

How do server know the CSR sender is approved client?

Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The prblem is anyone can POST a CSR to the server and then ...
3
votes
0answers
202 views

POODLE: Disabling SSLv3 in Apache [migrated]

Everybody seems to be talking about the POODLE vulnerability today. And everybody recommends disabling SSLv3 in Apache using the following configuration directive: SSLProtocol All -SSLv2 -SSLv3 ...
17
votes
3answers
4k views

Why doesn't the TLS protocol work without the SSLv3 ciphersuites?

While disabling SSLv3 from our ssl.conf files to overcome the Poodle vulnerability, I also disabled the SSLv3 ciphers using !SSLv3. With the ciphers disabled, we were not able to access the website ...
-1
votes
1answer
22 views

Does DH parameter file need to be unique per private key?

There is scant information available online on the DH parameters used in DHE ciphers (and the kind that's available is aimed at cryptographers, not systems administrators). Basically, as a sysadmin, I ...
1
vote
1answer
74 views

Can Cipher Suites defined in TLSv1.2 be negotiated by clients that only support TLSv1.0?

If my server has only the cipher suites enabled which are defined by TLSv1.2 does that force a client to also use TLSv1.2 or else not be able to connect or can the connection fallback to TLSv1.1 or ...
1
vote
2answers
83 views

Is 'correct' TLS Configuration dependant mainly on the Server?

Here is a link to a screen grab of SSL Configuration Checker by GlobalSign for my domain: SSL Configuration Checker: http://i.imgur.com/CbVjVee.png. Following recent discussions with the host, they ...
1
vote
2answers
200 views

POODLE vulnerability in major social networking

Social networking is a corner stone for a majority of our daily lives, be it communicating with friends, sharing photos or even using social networking for advertising and business promotion. Whilst ...
2
votes
2answers
697 views

Disable SSLv3 system-wide for all clients?

After reading about Poodle secutrity bug, I have disabled SSLv3 on my servers and browsers. But there are several clients that do not expose settings detailed enough via their own means of ...
2
votes
0answers
72 views

Does Firefox support TLS on non-standard ports? [migrated]

My presumption was that TLS 1.0+ is supported by Firefox on ports other than 443. However, a tweet crossed my path that seems to debunk this. Turns out that Firefox does not support TLS on any ...
3
votes
2answers
76 views

Could SSL-like encryption be used for not password-protected wireless access points?

I'm looking at ways an outsider (i.e. someone without a possible password) of the network could sniff the communication within the network, specifically focusing on WLAN. This is what I understand ...
16
votes
2answers
8k views

How do I use “openssl s_client” to test for (absence of) SSLv3 support?

In order to mitigate the "Poodle" vulnerability, I'd like to disable SSLv3 support in my (in this case, TLS, rather than HTTPS) server. How can I use openssl s_client to verify that I've done this?
0
votes
0answers
39 views

What's the impact of POODLE to the Internet? [duplicate]

POODLE can be exploited on SSL 3.0 and TLS 1.0, as the latter falls back to SSL 3 after multiple connection errors. I wonder how many use these protocols for encrypted data transfer, will it be a ...
178
votes
4answers
50k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What ...
0
votes
2answers
43 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
0
votes
1answer
42 views

Creating secure communication line for mobile payment

Is SSL the most efficient way for creating a encrypted communication between the user's mobile to the backend server? I understand that there is a flaw in SSL, so I was wondering is there other ...
7
votes
1answer
161 views

How does WPA2-Enterprise protect against an evil twin attack?

Original question title: What information do EAP-TLS certificates contain I recently read a couple of topics on stackoverflow, concerning the verification of Wi-Fi access points: How Are Wi-Fi ...
0
votes
1answer
50 views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
1
vote
2answers
73 views

Why would Comodo SSL certs have two intermediate CAs (chain length 4)?

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs. What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a ...
5
votes
0answers
116 views

When does iOS check validity of enterprise certificates?

This article should give a little more context (and see my comment on it, same username, for additional info): http://www.engadget.com/2014/10/08/ios-update-will-block-emulators/ iOS developers are ...
4
votes
3answers
121 views

SSL Certificate - is passphrase necessary and how does apache know it?

I want to generate a Certificate Signing Request for my server and in order to do so, I first need a secure private key. When I create a private key by using openssl genrsa -des3 -out server.key 2048, ...
4
votes
2answers
381 views

Privacy of Image search with https

I am connected to the internet in the office where I don't want the administrator of the network to find out the contents I check (for example images). First I use a Firefox private browsing window ...
1
vote
2answers
171 views

SSL ciphers for nginx to support CloudFlare and CloudFront

Could someone suggest an optimal ssl cipher configuration for my nginx server that supports both CloudFlare and CloudFront? I have tried a few of the suggestions in other threads, but CloudFront ...
-1
votes
0answers
35 views

how to intercept SSL and enter outlook.com or gmail.com after confirmed with mobile phone

after configure config t interface FastEthernet0/21 no monitor session 2 monitor session 2 source interface FastEthernet0/21 monitor session 2 filter vlan 10 monitor session 2 destination interface ...
1
vote
1answer
102 views

Using SSL-port (443) for non-SSL traffic, bad idea?

We have a webapp that is build to use SSL for certain (but not all) types of requests. The webapp is using multiple subdomains, the number can change. This combination of features makes that the ...
2
votes
3answers
75 views

Should I use SSL in a secured file sharing service?

I am developing a secured file sharing project using Java RMI. The files' content has to be secured. The server will store the encrypted files and the client will be able to upload/download/list files ...
1
vote
2answers
61 views

Force connected devices to use http rather than https

I am very new to MITM attacks and have been faffing around on my home network today.. When sniffing my iPhone trying to connect to some mail accounts I have noticed that it shows a message stating ...
-2
votes
2answers
149 views

Is “HTTPS” ~100% secure? [duplicate]

Before I login to a trusted website, I always check that the address bar has a green padlock and the URL has no typos. E.g: After I've seen the green padlock and checked the domain ...
1
vote
0answers
45 views

Best practices for OAuth 2.0

I understand that OAUth 2.0 really just relies on SSL to encrypt the contents of the bearer token. However, are there any other best practices one should follow when securing OAuth 2.0? I know you ...
5
votes
2answers
427 views

Website Certificate Revocation check - Big deal? [duplicate]

As I was about to make payment for my flight ticket, I noticed something strange with the British Airways website's SSL cert. My browser (Google Chrome) was unable to check whether the certificate has ...
-2
votes
2answers
83 views

SSL protocol : Port 443 [duplicate]

I want to usethe SSL protocol. SSL protocol uses port no. 443. During the initial handshake does the communication occurs on port no. 80 or it handshake starts on port 443. If not during the initial ...
4
votes
4answers
1k views

Is it a security risk to use an unknown web browser?

The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain. I know that nobody agrees with me as there are no articles about that in Google, but it looks ...
0
votes
2answers
67 views

is Digital Signature vulnerable on the Internet?

We all know about how Digital Signing works. I just have some questions about vulnerability risk. At first, As I know, the Signature and the Data are separated and we can split the document into two ...
1
vote
0answers
33 views

How can I make my computer trust a firewall web server certificate? [migrated]

Every time I log into my firewall I get a message that says: The site's security certificate is not trusted! I know this is because my firewall doesn't have an identity certificate from a ...
0
votes
2answers
38 views

How are “Certificate Signing” key usage certificates restricted to what domains they can sign?

Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate ...
1
vote
1answer
40 views

SSL - Main and Child servers network

There is an embedded device which acts a client. It communicates to a server via POST method whenever it has any data to be transmitted to the server. Embedded device: 1. Acts a Client 2. Does not ...
1
vote
1answer
101 views

advantages of http basic authentication over token-based (e.g. oauth2)?

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a ...
2
votes
1answer
101 views

How to secure my ajax call to the backend?

In my website I'm using an ajax call to get some information from the backend. Even if I'm using SSL someone can intercept the call and replace the real response with a fake one. Is there a way to be ...
0
votes
5answers
125 views

Are most MiTM attacks done to impersonate web sites, or simply decrypt traffic?

The more I read about impersonating web sites the more I get confused. Does an attacker need the private key of the server in order to impersonate a website or does having the private key simply give ...
4
votes
0answers
79 views

Why doesn't the 802.11 standard implement TLS for wireless handshakes between clients and routers?

Why aren't wireless handshakes sent using TLS? It seems like it would be relatively simple to implement, perhaps having the vendor insert the private key into the routers. That way WPA/WPA2/WEP ...
3
votes
3answers
477 views

How to fix SSL algorithm for more security [duplicate]

SSL uses Asymmetric Encryption like this : Server sends a copy of its asymmetric public key. Browser creates a symmetric session key and encrypts it with the server’s asymmetric public key. Server ...
22
votes
2answers
678 views

Effect on PCI compliance of not checking SSL certificate?

PCI DSS states: "[You must...] verify that only trusted SSL/TLS keys/certificates are accepted." Long story short, our payment service provider just asked us to please stop verifying their ...
1
vote
1answer
71 views

How can we represent SSL and Firewall in OSI Model? [closed]

I want to draw an architecture diagram for a general ERP application. In that I have come across a confusing point: where should I place the SSL and Firewall? I tried to figure out exactly where ...
1
vote
1answer
42 views

SSL certificate expired on the embedded device (a client)

I need some inputs for the scenario when the certificate expires which is stored on the embedded device on the network which is a client. Following is the explaination of the setup. The setup ...
4
votes
1answer
63 views

Is it true that certificates requested with a specific CSR can only be used on the machine where the CSR was generated?

Assume that I have created a CSR and I am going to buy an SSL certificate with it. Would I be able to use the SSL certificate on another machine than where the CSR was created? Someone I know ...