SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

3
votes
3answers
822 views

Self signed certificates for https

Where I work, currently for internal sites, self signed certificates are being used. In Firefox, the info regarding the certificate are displayed: site domain: example.com Owner: Site doesn't supply ...
5
votes
3answers
2k views

Man-in-the-middle Blue coat proxy ssl or what?

I have just discovered that my workplace have enabled some new feature in the blue coat network proxy. It seems like all https certificates in chrome on windows is being issued by this internal ...
2
votes
2answers
451 views

SSL: How to send generated client certificate from server to avoid MITM?

The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
447 views

Generate openSSL certificates from within C code using commands?

This is an openSSL command for generating a private key and a certificate, openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key The question I have is whether there is some ...
8
votes
3answers
3k views

Preventing a spoofing man in the middle attack?

I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
3
votes
6answers
430 views

Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?

I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case. Is there a way to determine and display the state of HTTPS on a page ...
12
votes
4answers
2k views

Handling passwords in a web application

I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
5
votes
7answers
3k views

Is it compulsory to have https on e-commerce site?

I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data. I just saw a site that has an e-shop link, if i click it my browser says ...
6
votes
3answers
586 views

Are secret URLs secure over HTTPS?

Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread. What level of ...
2
votes
2answers
463 views

Looking for general guidance on securing web API application for client applications and users

I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization. After a lot of googling ...
6
votes
2answers
459 views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
1
vote
1answer
602 views

Why a web server HTTPS certificate can't sign its subdomain HTTPS certificates?

Why having a valid certificate for "exampe.com" I can't make a "child" certificate for "subdomain.example.com"? What insecurities will arise if browsers start allowing domain's certificates to be ...
4
votes
2answers
104 views

Using SSL Certification in Multiple Locations

I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access. The ...
1
vote
1answer
226 views

Following redirects from HTTPS to HTTP - Secure?

So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting) This means, in theory, if you ...
7
votes
4answers
1k views

Man-in-the-middle scenario for TLS

Consider the following scenario: You want to securely communicate with a.com and you only trust the VeriSign root certificate. a.com presents a certificate signed by VeriSign with CN=a.com, so you ...
1
vote
0answers
37 views

Using SSL on my sites for everything or just some things? [duplicate]

I have a server which provides a few services through the web, some of those services must be logged into to be able to use them. For these services I have implemented SSL using level 3 CACert ...
5
votes
1answer
3k views

SSL Encryption (for HTTPs) & Security vs Performance

I was looking into server performance when using various SSL Certificates. Specifically 1024-bits vs 2048 vs 4096. It turns out, it makes a big difference! I've heard a lot of talk lately about ...
1
vote
1answer
1k views

Does Java's implementation of OCSP and CRL checking handle intermediate CAs?

I've read that Java provides OCSP and CRL checking for CertPaths via: Security.setProperty("ocsp.enable", "true"); System.setProperty("com.sun.security.enableCRLDP", "true"); Do these implementations ...
2
votes
3answers
3k views

How do I diagnose client-side SSL errors?

Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
1
vote
2answers
89 views

Do keyservers keep logs of who adds whom to their keyrings?

Maybe it depends on the keyserver. Does that pose privacy issues?
1
vote
3answers
98 views

Is connection to keyserver encrypted?

When you retrieve someone's information from a keyserver to add him to your pgp keyring, that is made through unencrypted keyservers, unless the user uploaded it to https://keyserver.pgp.com/. Even ...
3
votes
2answers
251 views

Will using SSL to secure Wordpress admin area only still actually be secure?

The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas. There ...
29
votes
4answers
24k views

What's an easy way to perform a man-in-the-middle attack on SSL?

I'd like to perform a man-in-the-middle attack on SSL connections between clients and a server. Assuming the following: I've got a certificate that the client will accept, via poor cert validation ...
1
vote
1answer
254 views

How to insert custom packets into SSL handshake?

I am trying to communicate with an SSL server whose protocol is non-standard. I want to insert custom packets into the handshake. I am using several SSL tools, so changing source code on every tool ...
-2
votes
1answer
164 views

What mode of operation is secure for block ciphers?

as RC4 is not secure and AES-CBC is same thing the only solution is using EAX mode for AES. but why mozilla NSS don't support EAX mod ? is there any secure EAX implementation ? and why wikipedia says ...
3
votes
1answer
630 views

ECDH and Forward Secrecy

I just read about ECDH and while getting a overview over the process, I noticed that this key exchange method does neither provide any forward secrecy, nor does it protect against replay-attacks, ...
2
votes
1answer
569 views

Is TLS 1.2 client authentication really different from that earlier ersion of TLS

From wikipedia link (cannot post due to stackexchange constraints). "http://www.yassl.com/yaSSL/Blog/Entries/2010/10/7_Differences_between_SSL_and_TLS_Protocol_Versions.html" and and also from the ...
4
votes
1answer
868 views

Would introducing client certificates for a mobile app improve security?

I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...
5
votes
2answers
1k views

Why is NIST removing & not updating TLS guidance? What is the replacement?

The document NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations was retired without superseding it with a newer document. In ...
1
vote
1answer
1k views

Can I use any ssl certificate to sign and encrypt AS2 message?

I'm absolutely new to this topic of ssl certificates, so please be patient with me. My task is to install an AS2 communication with some business partner. Therefore we need message signing and ...
3
votes
1answer
7k views

How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?

I read a lot of issue [1] currently stating that RC4 is broken and is at risk. I just checked my web server (nginx) and it is using the default settings, which is DHE-RSA-AES256-SHA How does this ...
4
votes
5answers
590 views

Does using ssl matter if I am connected using a VPN?

Say I have an internal server that I am using for source control. If I only access that server through a VPN connection, do I still need to have SSL setup on the source control server to ensure that ...
0
votes
1answer
157 views

Setting up two way SSL

I am trying to setup two way SSL to communicate with partner web service. I understand I have to provide server certificate on client side. However, questions are: Is self signed certificate okay? ...
2
votes
1answer
2k views

Certificate Chains When Importing Signed CSR Response

I'm interfacing with a secure web service, and authenticating using a client certificate. I'm confused about step #3 in the client configuration: Generate a private key into keystore Generate a CSR ...
14
votes
4answers
20k views

Why don't major browsers currently support TLS above version 1.0?

TLS 1.0 seem to be vulnerable to Beast, Lucky13 and maybe other attacks and is simply outdated. Common workaround used e.g. by Google was to use RC4 which was also recently broken, but none of the ...
0
votes
2answers
796 views

Two-way SSL Performance

We are planning to use 2 way ssl instead of username/password token for authentication. Does anyone know what is the performance penalty for using 2 way SSL?
2
votes
5answers
1k views

Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?

I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"? Furthermore, are there any practical ...
0
votes
2answers
414 views

Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
0
votes
1answer
113 views

Implementing secure login for an API

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
0
votes
1answer
145 views

Is this a secure method for authenticating clients?

I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy. Client sends a ...
2
votes
1answer
165 views

SSL certificates published in Mandiant's APT1 report

You probably heard about excellent report "APT1: Exposing One of China's Cyber Espionage Units" published by the Mandiant company (you can download it here). Report is great and I recommend it to ...
1
vote
2answers
250 views

What threats are posed by SSL connections?

I'm working on implementing an Exchange 2010 solutions which includes Outlook Web Access, Exchange ActiveSync and Outlook Anywhere. These services use SSL and would be presented on the Internet so our ...
5
votes
2answers
495 views

RC4 bias protection with padding in TLS

On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said: One way to "fix" RC4, which has been suggested many times, is to drop ...
24
votes
1answer
5k views

TLS: RC4 or not RC4?

I was reading another interesting article by Matthew Green today, saying that if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop As far as I'm aware ...
3
votes
2answers
157 views

Should I use SSL on my database server?

Say I have a website and a database, both hosted on rackspace. Since all communication with the database is from the web server and not the internet, is it safe to assume that I do not need SSL ...
1
vote
1answer
5k views

Web Applications (http): Don't get how token based authentication is secure

See something like this: http://stackoverflow.com/questions/10826293/restful-authentication-via-spring/10864088#comment21706215_10864088 Or more specific: Token-based authentication - Securing the ...
90
votes
2answers
51k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
3
votes
4answers
238 views

Secure single page in a site if site is hacked?

I've been tasked with trying to find a way to secure a single page in our site if somehow, a hacker gets access to our files. This "single page" will be run on a different server. Requirements: ...
5
votes
5answers
568 views

How risky is it not to install ssl?

I would like to have more insight about when a server should install ssl, in particular when it is worth the money to pay for a valid certificate. As my clients often have little understanding of why ...
5
votes
1answer
2k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...