Tagged Questions

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

9
votes
2answers
576 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
4
votes
3answers
2k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
0
votes
2answers
226 views

Analyzing SSL encryption

I have to analyze SSL encryption in my test network and want to prove the transported data is encrypted. What methods can I use to prove encryption is in place?
0
votes
1answer
153 views

Proxy Non-HTTPS logins through EC2

I've been thinking a lot about password security these days, and have been becoming more and more hesitant to use services that have login forms that are not on HTTPS. As I was researching security, ...
2
votes
3answers
3k views

Where does StartSSL generate the cerificate, server or client-side?

I.e. do really only I have the private key or do I have to trust that StartSSL (or any other provider) don't store it themselves?
3
votes
2answers
2k views

How does Firefox securely store my SSL certificate?

I'm currently testing a free personal SSL certificate (S/MIME client / authentication) from https://www.startssl.com, which installed directly into Firefox. Now when I store backup, I have to enter a ...
6
votes
2answers
610 views

ASN.1: ENUMERATED vs INTEGER

From the X.509 specs: CRLReason ::= ENUMERATED { unspecified (0), keyCompromise (1), cACompromise (2), affiliationChanged (3), ...
3
votes
2answers
2k views

What are the implications of adding a self signed certificate to the Windows Trusted Root Certification Authorities store?

I'm a budding website developer, so please bear with my ignorance. Say I had to encrypt my website with HTTPS and I got sick of having to click "Continue" every time a warning came up about an ...
26
votes
4answers
2k views

Manually adding 's' to 'http'

I did a Wireshark capture of my login into a drupal-based website. The website does not use https. And so, quite obviously, I was able to capture my username and password in plain text by simply ...
4
votes
2answers
3k views

Test website for SSL 2.0

I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled? The website is still in development so not visible outside our ...
3
votes
1answer
409 views

SSL VPN placement strategies

I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations: with firewall within the internal network within the DMZ Any reference also ...
10
votes
3answers
3k views

How secure is HTTP / HTTPS over 3G?

Suppose I log into a website, such as Twitter, from a 3G-enabled smartphone or similar device. How secure is this from interception? Can someone steal my password or login? What if I use HTTPS? What ...
2
votes
1answer
1k views

Is HTTPS secure enough for important information? [duplicate]

Possible Duplicate: Does an established ssl connection mean a line is really secure For example, Amazon.com doesn't use HTTPS for the whole site, but only the login page. I know they are ...
4
votes
2answers
721 views

Firefox lists '(unknown)' as the owner of google.com. Is my connection insecure?

I just went to accounts.google.com and I noticed that Firefox reports (unknown) as the owner of google.com. Should I be worried about this? Here's a Dutch screenshot of the certificate:
5
votes
3answers
1k views

Can a VPN decrypt my SSL traffic?

Are VPNs able to decrypt SSL traffic originating from my use of services such as Gmail, Dropbox and Skype, Google Talk and HTTPS-enabled websites? I'm asking because I always turn off these and other ...
5
votes
3answers
4k views

How is an X509 certificate signer verified?

Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is, ...
2
votes
1answer
134 views

How can I determine if a CA Cert can be used for DPI-SSL

I would like to know if a CA Cert I installed can be used to perform DPI-SSL decryption without my knowledge. Would there be any indication? Can you look at the cert properties to determine if it can ...
4
votes
3answers
5k views

Does using HTTPS, TLS, S/MIME, SSL e.t.c. protect you from Deep Packet Inspection and 'Big Data' analytics?

The title basically covers it. I want to know if using HTTPS, TLS, S/MIME, SSL will protect you from Deep Packet Inspection and Big Data Analytics? (I know that if someone fakes a cert or gets you to ...
394
votes
3answers
169k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
10
votes
3answers
5k views

SSL decryption in Wireshark

Is it possible to decrypt SSL traffic in Wireshark if you do not have the server certificate? I making some tests with SSL and Wireshark and people out there claim that Wireshark only decrypts SSL if ...
3
votes
1answer
145 views

Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?

Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
6
votes
3answers
519 views

What risks would exist in transmitting an encrypted PKCS12 via Https

I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate ...
29
votes
4answers
1k views

What is the impetus for major sites being HTTPS-exclusive now?

I've noticed that there are a good number of sites (Google, Twitter, Wikipedia) that are serving up every page over HTTPS. I can understand given that everyone is concerned over privacy now, but has ...
1
vote
1answer
1k views

SSL handshake failure [closed]

I am using shibbolet for single user authentication and it needs a ssl configuration which facilitates the user authentication process. Before it was working fine but now I am facing a SSL handshake ...
1
vote
1answer
78 views

For SSL certs, is some sort of connection to the issuing CA (or other network resource) required for the SSL connection to be established?

I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL". Background: I am deploying ...
20
votes
2answers
2k views

Is HTTP compression safe?

The CRIME attack taught us that using compression can endanger confidentiality. In particular, it is dangerous to concatenate attacker-supplied data with sensitive secret data and then compress and ...
4
votes
1answer
4k views

How to verify the SSL fingerprint by command line? (wget, curl, …)

Using a command line website downloader, such as wget, curl or any other one... In a script... I have the SHA-1 and the SHA-256 certficate fingerprint of a website. Due to security concerns (1) (2), ...
-1
votes
4answers
170 views

How secure is this login page? [closed]

Unfortunately I cant link to the page (it internal). But I can describe it! This is a lightspeed systems policy enforcement login page (content filter). The page is http and there is no iframe with ...
5
votes
4answers
818 views

HTTPS vs. HTTP - Is there a security reason for HTTPS for a site that only does Facebook login? [duplicate]

Possible Duplicate: What are the pros and cons of site wide SSL (https)? I am working on a site where all authentication is via facebook oauth2. I'd consider the nature of our content to be ...
11
votes
1answer
10k views

Tools to test for BEAST/CRIME that AREN'T Internet-based?

We have increasing pressure to identify and remediate any HTTPS server configurations that are vulnerable to BEAST (CBC) and CRIME (compression). We need to fix servers that are accessible to the ...
3
votes
1answer
159 views

CMC (RFC 5272) compatible CA server

I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
17
votes
2answers
11k views

Should I disable SSL compression because of CRIME?

I've read CRIME - How to beat the BEAST successor? and a few articles on the subject (linked below) and found no recommendations for system administrators. As a web host, should I disable SSL ...
2
votes
3answers
322 views

Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?

OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure. But basically, ...
4
votes
3answers
409 views

Does the following data stream look secure to you?

I understand the basic concept of SSL but maybe I am missing the point. Please could someone take a look at the following part of a test log to a server and tell me if it looks secure. My concerns are ...
14
votes
1answer
6k views

Are SSL encrypted requests vulnerable to Replay Attacks?

Are SSL encrypted requests vulnerable to Replay Attacks? If so, what are good options to prevent this?
5
votes
5answers
2k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
4
votes
2answers
817 views

Picking cipher suites for HTTPS

I'm trying to work out the best approach to choosing which cipher suites to provide, and what the issues might be. It's my understanding that during the SSL handshake, the client will (normally) ...
5
votes
2answers
640 views

HTTPS Sensitive Information and Caching

I have a website where I need to share a sensitive key with the user. Of course, I'm using HTTPS on the page. The key is put into the HTML server-side in ASP.NET. My concern is, if the user's computer ...
2
votes
3answers
185 views

How should SSL traffic be treated once it has been terminated?

Ideally, how should SSL traffic be treated once it has been terminated at an SSL appliance especially if the traffic contains sensitive information like personal financial information before it's ...
28
votes
4answers
24k views

How do I secure my REST API?

In Detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After googling for a while, I feel ...
4
votes
2answers
591 views

Should your client SSL Trusted Authority contain only root and intermediate certificates?

I'm getting conflicting information and it seems people are using certificates a little differently depending on how much effort they want to expend in managing them, and maybe the application being ...
197
votes
3answers
46k views

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
3
votes
1answer
283 views

Is OpenVPN secure if both the certificate and private key, are publicly known?

My ISP is rubbish and the state of the internet in the UK seems to be heading to 1984. I've started looking at VPNs and stumbled on IPredator as a cheapy test. It gives you the option of OpenVPN and ...
3
votes
2answers
1k views

How realistic and possible is this sort of attack

I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me. Nessus rated this finding's risk as Medium. The finding was, that a service ...
8
votes
4answers
864 views

Are Java applets more secure than regular forms for login?

In Norway we have something called BankID which is a login solution for banks and other stuff. It consists (from a users point of view) of a Java applet where you enter your SSN (person number), a one ...
5
votes
2answers
1k views

Adding custom data in X.509 certificate

I am using SSL with client authentication. I need to send some extra data while sending the client certificate? Can I send it in the certificate? Can I use the extension fields in certificate for that ...
3
votes
2answers
218 views

Unecrypted connection to server - safe?

I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL. Now I always need an heroku addon to add my SSL certificates which costs $20/month. Cloudflare ...
3
votes
1answer
92 views

SSL Based Denial of Services due to Message Digest

On a very high level, its known that SSL/TLS uses message digests to verify the integrity of the messages sent. However, the question I have in mind is : How does SSL ensure a DoS does not happen ...
7
votes
6answers
902 views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
12
votes
6answers
11k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?