SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

14
votes
3answers
7k views

Authenticating a Proxy server over HTTPS

When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc. ...
2
votes
2answers
1k views

Use HTTP POST for Google Search queries

When searching on Google from a browser, the actual search query is visible in the address bar of the browser, even when using Google's secure search (https). Is there a way to submit the search query ...
2
votes
2answers
142 views

Is there a need for SSL on a local site?

Do I need SSL for a site that can only be accessed on the local network? All users log in with windows credentials using Windows Auth with PHP on IIS. And if I don't: What security is needed to make ...
3
votes
1answer
632 views

Preventing spoofing of remote server with PHP & cURL

I'm writing a PHP script that is requesting confidential data from a remote server. I'm using cURL to get the remote server's certificate information (for its output, please see below). Which array ...
3
votes
2answers
295 views

Is it possible to find out the oauth 2.0 client id and secret when an app is communicating with a web service?

I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to ...
1
vote
0answers
109 views

Why not buy cheap SSL certificates? [duplicate]

Possible Duplicate: Is there any technical security reason not to buy the cheapest SSL certificate you can find? The comparison in Godaddy's website, makes it clear: they're just cheaper ...
7
votes
3answers
275 views

Why not use a private CA?

I had a question when reading this article: Phony certificates fool faulty crypto in apps from AIM, Chase, and more (Basically, some Android apps, like Chase's banking app for example, may be ...
5
votes
1answer
365 views

Which attributes of a X509v3 certificate are never really used?

Are there any extensions/extended key usage attributes of a X.509Certificate that are rarely or never used in practice? Either due to never being part of an issued certificate or because they are ...
10
votes
2answers
1k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
3
votes
1answer
848 views

What are the Netscape Cert Type attributes? Why/when are they needed?

What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions? Example: There is the Client/Server Extended Key Usage (X.509) but there is ...
2
votes
1answer
394 views

Can Diffie-Hellman Anonymous be used as a cipher for SSL for one-way certifiate-based authentication

I want to use Diffie-Hellman anonymous cipher for SSL. I also want to use a one-way certificate for server authentication. Is this possible?
15
votes
4answers
3k views

What is the potential impact of these SSL certificate validation vulnerabilities?

I just finished reading through this paper by Georgiev et al, which demonstrates a wide range of serious security flaws in SSL certificate validation in various non-browser software, libraries and ...
1
vote
1answer
812 views

Why is Message Labs sending mail in plaintext?

I have several SMTP servers on various networks around the world, and all of them are getting mail through ESTMPS - extended SMTP using TLS. So the email coming from GMail, MSN, Yahoo, as well MOST ...
4
votes
2answers
167 views

What is the state of the Windows Update certificate after Flame?

May 28, The Flame malware is discovered in Iran and by Kaspersky Labs. June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
4
votes
3answers
929 views

Is a forced rewrite from http to https secure? What does SSLRequireSSL add?

I've read contradicting advice about forcing https connections in the following way: RewriteEngine On RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} To me it seems ...
9
votes
2answers
519 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
4
votes
3answers
2k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
0
votes
2answers
205 views

Analyzing SSL encryption

I have to analyze SSL encryption in my test network and want to prove the transported data is encrypted. What methods can I use to prove encryption is in place?
0
votes
1answer
143 views

Proxy Non-HTTPS logins through EC2

I've been thinking a lot about password security these days, and have been becoming more and more hesitant to use services that have login forms that are not on HTTPS. As I was researching security, ...
2
votes
3answers
2k views

Where does StartSSL generate the cerificate, server or client-side?

I.e. do really only I have the private key or do I have to trust that StartSSL (or any other provider) don't store it themselves?
3
votes
2answers
1k views

How does Firefox securely store my SSL certificate?

I'm currently testing a free personal SSL certificate (S/MIME client / authentication) from https://www.startssl.com, which installed directly into Firefox. Now when I store backup, I have to enter a ...
6
votes
2answers
488 views

ASN.1: ENUMERATED vs INTEGER

From the X.509 specs: CRLReason ::= ENUMERATED { unspecified (0), keyCompromise (1), cACompromise (2), affiliationChanged (3), ...
3
votes
2answers
2k views

What are the implications of adding a self signed certificate to the Windows Trusted Root Certification Authorities store?

I'm a budding website developer, so please bear with my ignorance. Say I had to encrypt my website with HTTPS and I got sick of having to click "Continue" every time a warning came up about an ...
24
votes
4answers
2k views

Manually adding 's' to 'http'

I did a Wireshark capture of my login into a drupal-based website. The website does not use https. And so, quite obviously, I was able to capture my username and password in plain text by simply ...
4
votes
2answers
3k views

Test website for SSL 2.0

I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled? The website is still in development so not visible outside our ...
3
votes
1answer
336 views

SSL VPN placement strategies

I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations: with firewall within the internal network within the DMZ Any reference also ...
10
votes
3answers
2k views

How secure is HTTP / HTTPS over 3G?

Suppose I log into a website, such as Twitter, from a 3G-enabled smartphone or similar device. How secure is this from interception? Can someone steal my password or login? What if I use HTTPS? What ...
2
votes
1answer
1k views

Is HTTPS secure enough for important information? [duplicate]

Possible Duplicate: Does an established ssl connection mean a line is really secure For example, Amazon.com doesn't use HTTPS for the whole site, but only the login page. I know they are ...
4
votes
2answers
585 views

Firefox lists '(unknown)' as the owner of google.com. Is my connection insecure?

I just went to accounts.google.com and I noticed that Firefox reports (unknown) as the owner of google.com. Should I be worried about this? Here's a Dutch screenshot of the certificate:
5
votes
3answers
1k views

Can a VPN decrypt my SSL traffic?

Are VPNs able to decrypt SSL traffic originating from my use of services such as Gmail, Dropbox and Skype, Google Talk and HTTPS-enabled websites? I'm asking because I always turn off these and other ...
5
votes
3answers
3k views

How is an X509 certificate signer verified?

Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is, ...
2
votes
1answer
125 views

How can I determine if a CA Cert can be used for DPI-SSL

I would like to know if a CA Cert I installed can be used to perform DPI-SSL decryption without my knowledge. Would there be any indication? Can you look at the cert properties to determine if it can ...
4
votes
3answers
4k views

Does using HTTPS, TLS, S/MIME, SSL e.t.c. protect you from Deep Packet Inspection and 'Big Data' analytics?

The title basically covers it. I want to know if using HTTPS, TLS, S/MIME, SSL will protect you from Deep Packet Inspection and Big Data Analytics? (I know that if someone fakes a cert or gets you to ...
353
votes
3answers
136k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
10
votes
3answers
5k views

SSL decryption in Wireshark

Is it possible to decrypt SSL traffic in Wireshark if you do not have the server certificate? I making some tests with SSL and Wireshark and people out there claim that Wireshark only decrypts SSL if ...
3
votes
1answer
140 views

Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?

Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
6
votes
3answers
427 views

What risks would exist in transmitting an encrypted PKCS12 via Https

I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate ...
29
votes
4answers
1k views

What is the impetus for major sites being HTTPS-exclusive now?

I've noticed that there are a good number of sites (Google, Twitter, Wikipedia) that are serving up every page over HTTPS. I can understand given that everyone is concerned over privacy now, but has ...
1
vote
1answer
1k views

SSL handshake failure [closed]

I am using shibbolet for single user authentication and it needs a ssl configuration which facilitates the user authentication process. Before it was working fine but now I am facing a SSL handshake ...
1
vote
1answer
73 views

For SSL certs, is some sort of connection to the issuing CA (or other network resource) required for the SSL connection to be established?

I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL". Background: I am deploying ...
20
votes
2answers
2k views

Is HTTP compression safe?

The CRIME attack taught us that using compression can endanger confidentiality. In particular, it is dangerous to concatenate attacker-supplied data with sensitive secret data and then compress and ...
4
votes
1answer
3k views

How to verify the SSL fingerprint by command line? (wget, curl, …)

Using a command line website downloader, such as wget, curl or any other one... In a script... I have the SHA-1 and the SHA-256 certficate fingerprint of a website. Due to security concerns (1) (2), ...
-1
votes
4answers
164 views

How secure is this login page? [closed]

Unfortunately I cant link to the page (it internal). But I can describe it! This is a lightspeed systems policy enforcement login page (content filter). The page is http and there is no iframe with ...
5
votes
5answers
689 views

HTTPS vs. HTTP - Is there a security reason for HTTPS for a site that only does Facebook login? [duplicate]

Possible Duplicate: What are the pros and cons of site wide SSL (https)? I am working on a site where all authentication is via facebook oauth2. I'd consider the nature of our content to be ...
11
votes
1answer
9k views

Tools to test for BEAST/CRIME that AREN'T Internet-based?

We have increasing pressure to identify and remediate any HTTPS server configurations that are vulnerable to BEAST (CBC) and CRIME (compression). We need to fix servers that are accessible to the ...
3
votes
1answer
137 views

CMC (RFC 5272) compatible CA server

I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
17
votes
2answers
10k views

Should I disable SSL compression because of CRIME?

I've read CRIME - How to beat the BEAST successor? and a few articles on the subject (linked below) and found no recommendations for system administrators. As a web host, should I disable SSL ...
2
votes
3answers
300 views

Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?

OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure. But basically, ...
4
votes
3answers
388 views

Does the following data stream look secure to you?

I understand the basic concept of SSL but maybe I am missing the point. Please could someone take a look at the following part of a test log to a server and tell me if it looks secure. My concerns are ...
11
votes
1answer
5k views

Are SSL encrypted requests vulnerable to Replay Attacks?

Are SSL encrypted requests vulnerable to Replay Attacks? If so, what are good options to prevent this?