SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

3
votes
2answers
157 views

Should I use SSL on my database server?

Say I have a website and a database, both hosted on rackspace. Since all communication with the database is from the web server and not the internet, is it safe to assume that I do not need SSL ...
1
vote
1answer
5k views

Web Applications (http): Don't get how token based authentication is secure

See something like this: http://stackoverflow.com/questions/10826293/restful-authentication-via-spring/10864088#comment21706215_10864088 Or more specific: Token-based authentication - Securing the ...
90
votes
2answers
51k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
3
votes
4answers
238 views

Secure single page in a site if site is hacked?

I've been tasked with trying to find a way to secure a single page in our site if somehow, a hacker gets access to our files. This "single page" will be run on a different server. Requirements: ...
5
votes
5answers
569 views

How risky is it not to install ssl?

I would like to have more insight about when a server should install ssl, in particular when it is worth the money to pay for a valid certificate. As my clients often have little understanding of why ...
5
votes
1answer
2k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
2
votes
1answer
306 views

What is the cost of SSL encryption?

So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an ...
4
votes
3answers
595 views

Why are SSL certificates valid only from a certain date?

Each SSL certificate is valid starting from a specific date and up to the expiration date. What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
4
votes
1answer
4k views

Use client SSL certificates as web application authentication

I'm working on a web application with simple API needing authentication. For my application nature, users have two RSA keys, for signing and encrypting messages. My protocol works based on it. The ...
1
vote
1answer
213 views

Key authentication with ssl

Can i authenticate myself in SSL with a key, just like in SSH?
6
votes
1answer
867 views

Choosing an SSL certificate provider

Does it make any difference which provider I get my SSL/TLS certificate from? In particular, what are the pros and cons getting an SSL certificate from Verisign vs getting one from Thawte? Which one ...
2
votes
1answer
809 views

Windows Update - Interception

I'm trying to monitor the HTTP requests/responses made when performing a Windows Update. I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp: netsh ...
5
votes
2answers
1k views

Entering sensitive information into non-SSL site that uses secure iFrame

There is a website that tenants can use to pay their rent. That website uses an http address but apparently uses a third-party product, which embeds an iframe into the page. The source of that iframe ...
4
votes
1answer
2k views

What elliptic curves are supported by browsers?

Wireshark'ed Firefox 3 request. Their names are nowhere documented. Elliptic curve: secp256r1 (0x0017) Elliptic curve: secp384r1 (0x0018) Elliptic curve: secp521r1 (0x0019) What are the supported ...
3
votes
1answer
305 views

What are those nul bytes doing in Certificate Subject CN?

While doing some research with SSL certificates, I found some weird certificates containing nul bytes in their Subject field. One example is www.refah - bank.ir (did the Iranian government fake this ...
4
votes
1answer
154 views

How powerful are top Verisign executives?

I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a ...
0
votes
1answer
947 views

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange? Can the server be configured to use weak key sizes for ...
7
votes
2answers
3k views

How to set “Not Before” value to past when creating certificate request

We have lots of embedded TLS clients on the field. TLS Servers must be authenticated. Because long power cuts may reset clock of those devices, we have requirement to use certificates with validity ...
1
vote
1answer
254 views

How effective is Activesync Certificate revocation using CRL or OCSP

We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords. One way to remedy an account lockout issue is to issue and deploy certificates ...
8
votes
5answers
317 views

Threat model for huge warnings on untrusted SSL certificates and no warnings for plain HTTP connections?

Why do untrusted/expired SSL certificates get such a huge warning in modern browsers even with "DO NOT VISIT THIS SITE!" messages, whereas a regular HTTP connection, which is more prone to ...
51
votes
10answers
8k views

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
1
vote
3answers
629 views

SMTP and SSL/TLS

If I understand correctly, communication between SMTP servers may be encrypted but is not required. Because it is optional, does it really have benefits? When server A connects to server B, both of ...
1
vote
2answers
101 views

How can I set up signed downloads?

Scenario I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
5
votes
1answer
430 views

Certification authority only for certain domains

Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
2
votes
2answers
4k views

HTTPS verification failed - get certificate information iPad/iPhone

I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
6
votes
2answers
348 views

Is IP restriction enough or should I SSL my web authentication?

I want to connect to my home install of phpmyadmin. I restricted the connection for this to my 2 IPs. But I don't really understand this whole OSI layering. I do know that the IP is saved in the ...
2
votes
2answers
100 views

Actual issue? Phone switches from 3G to router makes session switch from https to http

I heard that a security issue exists in some cases when a mobile phone has: Connected to a website via https via 3G Connects to a router I'm told that that in this particular scenario the router ...
1
vote
1answer
685 views

How configure tomcat 7 SSL to use AES-NI?

My server has AES-NI and I would like tomcat 7 to make use of this but I am not really sure how to make that happen or where to even start looking. I am quite familiar with tomcat administration, and ...
2
votes
3answers
121 views

Is password authentication worse that signed messaging if done over SSL?

Let there is a public API: HTTP-based via SSL there are no browsers, just connections between custom written programs The first authentication scheme that came to my mind was... client signs their ...
3
votes
1answer
190 views

Exporting data beyond a cryptographic boundary

Scenario We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
-1
votes
2answers
496 views

What is ASN.1 usage in SSL protocl and What's the risk of using it?

I heard that ASN.1, which is part of browser SSL libraries, introduces the potential risk of compromise our system even if we use no-script. but what is ASN.1 exactly doing? Why do we need to use ...
9
votes
4answers
2k views

Can URLs be sniffed when using SSL? [duplicate]

I know that http requests can be sniffed, so sniffer can see the requested URL from the victim. So 2 days ago I my bank made me a web-account to see, send money etc... The thing I saw is my session ...
1
vote
1answer
447 views

How to troubleshoot why Thunderbird rejects a PKCS#12 certificate with “Could not verify this certificate for unknown reasons”?

After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a ...
3
votes
3answers
166 views

Is it safe to mix authentication methods?

Is it a good idea to "combine" authentication methods? Example we can use username/password method to authenticate a user from a server. What if we used this as a first authentication step to get ...
2
votes
2answers
2k views

Why is this SSL handshake failing with iPad? [closed]

I do have a tomcat server that listen on an SSL socket with TLS protocol. When connecting with all desktop browser everything work right. When connecting with Safari on iPad, the SSL handshake fails. ...
1
vote
2answers
651 views

What security issues are there when reading cookie with .htaccess?

I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
2
votes
1answer
433 views

Pure SRP authentication without TLS

IF using a SRP for client/server application authentication without TLS. Will it be vulnerable to man-in-middle attack, since if using SRP, the public info doesn't really useful to calculate the ...
8
votes
3answers
712 views

How practical/important is the Lucky Thirteen TLS attack?

I was reading this article which talks about a new attack against TLS being called Lucky Thirteen. It claims to allow repeatable MitM attacks against HTTPS connections. It's described as being fairly ...
2
votes
6answers
284 views

Protecting an admin area from the public

We are about a month away from launching a pretty important site, which comes with an admin console to help us manage the site. Now I'm not very interested at just leaving the admin out in the open ...
3
votes
2answers
3k views

Protecting against SSL Strip [duplicate]

I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe? Does it depend on the cert strength? Do you ...
4
votes
1answer
349 views

For a desktop application, why use an SSL certificate from a trusted authority?

When a web browser connects to a server and downloads an SSL certificate, a third-party trusted authority ensures that the client is talking to the host that it's looking for. If the host uses a ...
9
votes
6answers
758 views

Does not having https moot this entire site?

On a bank website the other day, I noticed that they were giving out a phone number on a page that wasn't over https. This seemed really wrong to me, since it would allow somebody to change the phone ...
0
votes
2answers
521 views

OpenID without SSL certificate

Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed? Just to make things clear, ...
1
vote
1answer
451 views

How to filter https traffic in mod-security WAF?

I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
-1
votes
3answers
134 views

Secure transmission for desktop applications

Suppose I have a desktop application that does password hashing for login authentication. Is the password normally hashed before it travels to the wires or does it travel to the wires first in plain ...
2
votes
2answers
428 views

Which is better for SSL: TLS_EDH or TLS_SRP?

DH is vulnerable to a man-in-middle attack due to no server authentication; and RSA does not have forward secrecy. People suggest used Ephemeral DH but what are the differences between Ephemeral DH ...
-3
votes
2answers
324 views

Cannot use HTTPS or download stuff from sourceforge with a mac, what kind of soft does that? [closed]

I'm at a public library (france). I have a http library login to access that wifi. I just want to download some SFML zip to make some app, but many things are blocked, mainly https. I can't even ...
2
votes
2answers
3k views

Ssl certificate rekey or revoke

I want to be sure to understand well the situation where SSL certificate is compromised. If I ask for a rekey, I suppose the old certificate will remain valid. The future communications with the new ...
14
votes
3answers
14k views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
4
votes
1answer
282 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...