SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

0
votes
3answers
7k views

How to prevent man-in-the-middle attacks beside of SSL?

I would like to discuss this scenario: There is a HTTPS service which responds with signed keys to an authenticated client. These signed keys can be used for another service to return very sensible ...
0
votes
1answer
193 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...
0
votes
2answers
447 views

How to safely collect bank account from website?

I want to collect bank account information from my customers on my website. I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or ...
0
votes
2answers
250 views

Convergence HTTPS - what are the Notary servers?

https://www.youtube.com/watch?v=Z7Wl2FW2TcA What are the "Notary" servers regarding convergence? Who is maintaning the "Notary" servers? Can someone please explain?
0
votes
2answers
85 views

What does 2^77.1 calls presented in a SHA1 attack mean?

Regarding the SHA 1 deprecation, I found this information here: http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx I know ...
0
votes
2answers
73 views

Printer SSL certificates [closed]

Is a printer SSL cert really necessary if you just print? I don't use https for any administration; just http. I got a vulnerability saying that my cert was out of date.
0
votes
2answers
51 views

Self signed certificate secure when just client sends sensitive information?

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for ...
0
votes
4answers
69 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
2answers
276 views

Is HTTPS based on a private key on the user side? [duplicate]

Is HTTPS it based on private key on user side? Where does the user get the private key in the first place? Suppose the user gets the private key by downloading a browser (Chrome, Firefox), then ...
0
votes
2answers
937 views

Is it possible to intercept https traffic and see the links?

If a site uses https and transfers the customers credit card and ID in the url. Will an attacker be able to intercept those through a MITM attack? And through Sniffing.? Can the packets be sniffed ...
0
votes
2answers
1k views

How valid is this statement “SSL sit between application layer and network layer”

taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
0
votes
3answers
211 views

Is HTTPS necessary for password change if user has already logged in with HTTPS?

I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION. Is this really necessary?
0
votes
3answers
73 views

Using client certificate to authenticate an app

I'm building a backend for the mobile app with a public-facing HTTP API endpoint. Despite being publicly visible, this endpoint is only meant to be used by my app, i.e. I don't want people to send ...
0
votes
1answer
67 views

Any example where client certification is required? [closed]

There are some optional cases in SSL/TLS where server can demand the certificate of the client. Can anyone give me any example regarding this? Thank you.
0
votes
1answer
91 views

Why has Convergence stalled out? [closed]

Convergence is a well-thought out system to replace certificate authorities built by Marlin Moxiespike back in 2011. Since it's debut, it seems to have largely stalled out, with no additional major ...
0
votes
1answer
134 views

HTTPS encryption and internet proxy [closed]

I'm not sure if this is the right place to ask this question. Please tell me, and I'll delete it. I want to modify a Word document hosted on my OneDrive account. I see that it is using a SSL ...
0
votes
1answer
138 views

Why can't we create a new SSL implementation?

SSL implementations have been discussed a lot lately, due to Chrome's potential of switching off NSS ...
0
votes
2answers
98 views

Modifying SSL Certificate once created, Multi domain

We're developing an application that has the ability to run across multiple top level domains, each with its own sub domain. (www.foo.com, www.bar.com, would each point to the same application on the ...
0
votes
2answers
206 views

Does a simple mobile REST API need HTTPS?

Let's say I have a really simple mobile app with a server API. For example some kind of Q&A app, where users answer questions to win some points ('Who wants to be a Millionaire' kind of game). ...
0
votes
3answers
120 views

Does semi-sensitive information demand encryption / security? [closed]

Since it's been requested that this question be rewritten: Is SSL (or some other encryption equivalent) required in the below case? From a small local business website, is there any damage that an ...
0
votes
2answers
620 views

mutual authentication between two clients

I understand how mutual authentication works between a client and a server, however I am unsure how I would be able to get mutual authentication between two clients A and B? What would be the best ...
0
votes
1answer
147 views

Average user reaction to SSL certificate error pages [closed]

With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to ...
0
votes
3answers
780 views

SSL vs TLS, which is less vulnerable to DOS attacks?

When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks. However, all I seem to find ...
0
votes
3answers
842 views

Reply to SSL Handshake Request with a 302 Response

Is it possible to respond to an SSL Handshake request by sending back a http 302 redirect without making the browser mad? I would like to immediately redirect to a different site upon receiving the ...
0
votes
3answers
145 views

What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?

This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective. What business/organisation(s) would have: Sufficient technical skill ...
0
votes
1answer
28 views

SSL cipher suite: what does “export” mean?

I saw a cipher suite EXP-EDH-RSA-DES-CBC-SHA, EXP stands for export, How do I explain the "export"? What is the different between "EXP-EDH-RSA-DES-CBC-SHA" and "EDH-RSA-DES-CBC-SHA"?
0
votes
1answer
32 views

Does the SSL/TLS client certificate “hash over all previous messages” step hash the entire TCP packets or just data?

We have which uses TLS client certificates as it's authentication mechanism between client and server. There is an IT department which wants to run this app through a firewall/proxy device of some ...
0
votes
1answer
163 views

Why is stackoverflow not using HTTPS for all it's page?

Most webpage from stackoverflow use http even if you are logged in. Isn't it a security issue? Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent ...
0
votes
2answers
72 views

https login iframe 2014

Per current security recommendations & browser support, is it okay to have an https iframe in an otherwise http-only set of pages? Is this not a dupe? It is, but I want current trends because ...
0
votes
1answer
260 views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
1answer
51 views

Can an individual get an extended validation certificate?

I am not saying I am actually going to buy one but I am wondering if an individual can get an Extended Validation SSL certificate? I know this is intended for companies / organisations but would this ...
0
votes
2answers
173 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
0
votes
1answer
46 views

Advantages of TLS-SRP when the secret must be exchanged online?

I've got some practical questions about SRP when the shared secret must be established online. Is there a way to establish the shared secret online without the use of HTTPS? If you've already used ...
0
votes
2answers
181 views

Firefox can import the .p12 format, but that contains a private key? Isnt this a security risk?

Everywhere I go, people tell me the private keys need to be kept away, possibly even locked into a safe then how come Firefox and other keystores expect you to give them a private key? Firefox is a ...
0
votes
3answers
152 views

Is it ok to send user's private key away, even if protected with a SSL channel?

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
2answers
135 views

understanding and getting over the SSL performance issue

There are many great articles explaining how SSL/TLS works on this site, but I would like to bring in the performance issue. The thing is that I am serving my web content over HTTPS and the SSL ...
0
votes
2answers
8k views

SSL Handshake failed

I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
0
votes
1answer
152 views

HTTPS Proxy Everwhere?

I am configuring a HTTPS proxy, which I want to use for my laptop wherever I go. The idea is that since its encrypted, I should be safe from eavesdroppers, even on open wireless networks. Think of it ...
0
votes
2answers
355 views

Google's usage of RC4

I was reading about Google's usage of RC4 and an answer on stackexchange website stated the following: I know Google uses RC4 for most of its services, and this is the reason one shouldn't keep ...
0
votes
1answer
207 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
0
votes
2answers
122 views

How is the key obtained when I login via VPN?

So, I configure my VPN (let say which uses PPTP protocol), enter the server name, username and password. Then, I visit a website. Before that, my request is encrypted using AES with some key. That ...
0
votes
2answers
763 views

Two-way SSL Performance

We are planning to use 2 way ssl instead of username/password token for authentication. Does anyone know what is the performance penalty for using 2 way SSL?
0
votes
1answer
110 views

Implementing secure login for an API

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
0
votes
2answers
489 views

OpenID without SSL certificate

Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed? Just to make things clear, ...
0
votes
1answer
859 views

In SSL/TLS, how is the authenticity of a server's certificate verified?

Quote from an article on computerworld.com: "The private key is used to sign the server's TLS public key, which is currently used by browsers to validate SSL certificates." My understanding ...
0
votes
1answer
179 views

Anonymous access over SSL

I am using a paid VPN service and I just realized IP privacy does not exist at all when the connection is made over SSL. If I Google "what is my ip" using the HTTP version of Google, it will give me ...
0
votes
2answers
61 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
0
votes
1answer
353 views

This certificate has an invalid digital signature

I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. ...
0
votes
1answer
96 views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
0
votes
1answer
60 views

Browser and SSL support

According to http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers most browsers support SSL 3.0. And with my understanding (please correct me if I am wrong), when a browser just ...