SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

4
votes
3answers
388 views

Does the following data stream look secure to you?

I understand the basic concept of SSL but maybe I am missing the point. Please could someone take a look at the following part of a test log to a server and tell me if it looks secure. My concerns are ...
11
votes
1answer
5k views

Are SSL encrypted requests vulnerable to Replay Attacks?

Are SSL encrypted requests vulnerable to Replay Attacks? If so, what are good options to prevent this?
5
votes
5answers
2k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
4
votes
2answers
645 views

Picking cipher suites for HTTPS

I'm trying to work out the best approach to choosing which cipher suites to provide, and what the issues might be. It's my understanding that during the SSL handshake, the client will (normally) ...
5
votes
2answers
528 views

HTTPS Sensitive Information and Caching

I have a website where I need to share a sensitive key with the user. Of course, I'm using HTTPS on the page. The key is put into the HTML server-side in ASP.NET. My concern is, if the user's computer ...
2
votes
3answers
163 views

How should SSL traffic be treated once it has been terminated?

Ideally, how should SSL traffic be treated once it has been terminated at an SSL appliance especially if the traffic contains sensitive information like personal financial information before it's ...
26
votes
4answers
19k views

How do I secure my REST API?

In Detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After googling for a while, I feel ...
4
votes
2answers
496 views

Should your client SSL Trusted Authority contain only root and intermediate certificates?

I'm getting conflicting information and it seems people are using certificates a little differently depending on how much effort they want to expend in managing them, and maybe the application being ...
192
votes
3answers
43k views

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
3
votes
1answer
265 views

Is OpenVPN secure if both the certificate and private key, are publicly known?

My ISP is rubbish and the state of the internet in the UK seems to be heading to 1984. I've started looking at VPNs and stumbled on IPredator as a cheapy test. It gives you the option of OpenVPN and ...
3
votes
2answers
806 views

How realistic and possible is this sort of attack

I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me. Nessus rated this finding's risk as Medium. The finding was, that a service ...
8
votes
4answers
813 views

Are Java applets more secure than regular forms for login?

In Norway we have something called BankID which is a login solution for banks and other stuff. It consists (from a users point of view) of a Java applet where you enter your SSN (person number), a one ...
5
votes
2answers
836 views

Adding custom data in X.509 certificate

I am using SSL with client authentication. I need to send some extra data while sending the client certificate? Can I send it in the certificate? Can I use the extension fields in certificate for that ...
3
votes
2answers
205 views

Unecrypted connection to server - safe?

I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL. Now I always need an heroku addon to add my SSL certificates which costs $20/month. Cloudflare ...
3
votes
1answer
88 views

SSL Based Denial of Services due to Message Digest

On a very high level, its known that SSL/TLS uses message digests to verify the integrity of the messages sent. However, the question I have in mind is : How does SSL ensure a DoS does not happen ...
7
votes
6answers
770 views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
9
votes
5answers
8k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
25
votes
2answers
15k views

Why is it possible to sniff an HTTPS / SSL request?

I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone ...
2
votes
1answer
1k views

Should we block all plaintext authentication and require authentication over an encrypted channel?

Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over? I recently configured my servers to ...
4
votes
2answers
857 views

Is it okay to just secure (using SSL) the login page, but not the rest of the site? [duplicate]

Possible Duplicate: What are the pros and cons of site wide SSL (https)? I'm creating a custom PHP/MySQL CMS for a client (because Wordpress is overkill for this client's particular needs). ...
2
votes
2answers
159 views

What number of bits does a browser use to generate a key?

The question comes from the accepted answer in this thread: My understanding of how HTTPS works (gmail for example) The Gmail server sends your client a certificate. The certificate includes the ...
21
votes
3answers
39k views

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm What exactly is the difference here and why are two encryption bits ...
2
votes
3answers
728 views

Is SSL Tamper Detectable?

I know how SSL provides security against people reading your messages - by encryting the message with a SYMMETRIC KEY, which was exchanged during SSL Handshake with the help of ASYMMETRIC KEYS. But I ...
1
vote
2answers
2k views

Avast says I don't need to use encrypted connections for my e-mail accounts

I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't ...
0
votes
1answer
282 views

How does a Web Security Gateway analyse SSL Encrypted Traffic?

Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
4
votes
3answers
540 views

Further potential problems with Windows 8 SmartScreen

Some research was recently published that showed that Windows 8's SmartScreen feature sends certain details about every single application that you install to Microsoft. Ignoring the obvious privacy ...
1
vote
1answer
509 views

Https green bar loads then goes away

I have properly configured SSL, and it loads pages when you put https. My problem is that when the page is loading. The bar will turn green, once the page is fully loaded. The green bar goes away. The ...
4
votes
1answer
2k views

Disable DES-CBC-SHA in schannel

I have several IIS servers in house This includes IIS 6 and 7.x. When I have my external PCI scans run I'm still receiving alerts for having the weak protocol DES-CBC-SHA enabled. I have the ...
7
votes
2answers
30k views

How to determine if a browser is using an SSL or TLS connection?

I want to know whether my browser is using SSL or TLS connection if I see HTTPS. I want to know for IE, Firefox, Chrome and Safari. I want to know the protocol version.
3
votes
3answers
454 views

What is the actual security of this login page?

Please visit https://devforums.apple.com If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show. Does this ...
15
votes
4answers
4k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
7
votes
3answers
432 views

How secure is HTTPS with weak ciphersuites?

Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
23
votes
4answers
5k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
4
votes
1answer
167 views

How does my antivirus determine which CTL is used?

I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
49
votes
9answers
10k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
8
votes
4answers
4k views

HTTP Basic auth password storage more secure than Digest auth

If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
6
votes
2answers
4k views

Securing a REST API: is api_secret signing and ssl enough?

for securing a RESTful API I thought of the following authentication procedure for each call: All data is SSL-encrypted Every HTTP request made by the client will have a signature such as ...
8
votes
2answers
6k views

Is BEAST really fixed in all modern browsers?

BEAST is said to be fixed in all modern browsers: Chrome and Firefox IE in Jan 2012 Opera in Dec 2011. It's also fixed in OpenSSL since 2002. Do these fixes mean that it's safe to use ciphers in ...
3
votes
1answer
212 views

Client-side cross-site access in SSL environment - when it's still possible to do?

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
3
votes
1answer
352 views

Are SSL Certificates (Private and Public key) generated by OpenSSL and makecert compatible?

Are RSA SSL Certificates (Private and Public key) generated by makecert compatible with OpenSSL decryption ie. can I decrypt them with the openssl_* methods? I am working on two-way SSL authentication ...
6
votes
2answers
369 views

What kind of certificate do I need to be able to sign my own subdomain certificates?

We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...). ...
0
votes
1answer
424 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
2
votes
3answers
222 views

Denial of Service on SSL services

When the SSL handshake takes place, is there a point where the computational work done by the client is significantly less than the computational work done by the server? Could such an imbalance be ...
4
votes
1answer
1k views

Any reason not to use same key for multiple SSL domains on one server?

Assume I've generated a server key for use by Apache for SSL. The server will be handling several different domains that use SSL via unique IPs (no SNI). I want to generate a CSR for each domain from ...
3
votes
2answers
1k views

Java Applet for mutual authentication with smart card

I need to develop a java applet, for a mutual authentication between Tomcat 6 (server) and a SmartCard "IDGo 300" (client). In order to do this I thought the following scheme: 1.Tomcat (server) send ...
3
votes
8answers
645 views

Explain SSL advantages for e-commerce to layperson?

I need to explain why having a SSL certificate is a good investment for an e-commerce. How do I do this when the other person is a intelligent business owner but not that tech smart?
-1
votes
1answer
383 views

MITM Attacks over SSL [duplicate]

Possible Duplicate: How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption? If I have a server (call it server 1) set up to receive ...
1
vote
4answers
286 views

Should i use SSL for local access?

I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip). Should i use SSL for the communications between the sites and the service, or would that ...
3
votes
1answer
363 views

Loginless Client/Server Architecture (iOS)

I'm currently in the phase of planing a project involving loginless service. Users would be identified by an unique device id created on the client (ios). What are the security concerns? sockets ...
10
votes
4answers
8k views

How are Chrome and Firefox validating SSL Certificates?

How are Chrome and Firefox validating SSL Certificates? Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?