SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

8
votes
6answers
839 views

when is it safe to click through an SSL warning message?

How does a user know if it's safe to click through scary browser warnings about SSL certificates? Ideally, a user should never need to click through these warning messages, but sometimes honest ...
24
votes
2answers
6k views

I just send username and password over https. Is this ok?

When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
8
votes
4answers
998 views

How to tunnel all network communication?

I'm looking for a way to tunnel all network communication from my laptop through another computer. I can control the software on both the laptop and the computer. The connection between them should be ...
5
votes
3answers
841 views

US export control on open source libraries

I want to ask, is the US export control applicable only to US citizens? E.g. I think Bouncy Castle are Australians. Do use of their library fall into export control regulations? I do not understand ...
11
votes
1answer
3k views

enable browser caching with HTTPS

I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
6
votes
3answers
271 views

How safe are copies of Firefox that are on various Mozilla mirror sites?

If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added? I don't see any mechanism for ...
2
votes
3answers
843 views

Reverse Proxy Secure Configuration

I have a Forefront TMG 2010 acting as a reverse proxy: I can force HTTP*S* between internet clients and TMG. I can force HTTP*S* between TMG and my web servers. From a security point of view, it ...
8
votes
5answers
1k views

I see two different sets of certificates for Google websites when I am at work and when I am at home

I see two different sets of certificates for Google websites when I am at work and when I am at home. I mean if I save the certificates (in firefox, click on the "Google.com" block on the left of ...
9
votes
3answers
1k views

Can a wildcard SSL certificate be issued for a second level domain?

Something like *.com or *.net? How about *.edu.au? The RFC 2818 does not say anything about this topic.
4
votes
3answers
559 views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
7
votes
5answers
737 views

Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?

In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
15
votes
3answers
1k views

What are the risks of a Certificate Authority hack for 'the average user'?

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
3
votes
4answers
2k views

I had SSL certificate on my site but still it has been hacked…how to prevent this from happening?

I used SSL certificate on my site but still it has been hacked. How do I prevent this from happening? Do SSL certificate come with a waranty which would compensate me because my site was hacked?
23
votes
3answers
2k views

How does Convergence (CA replacement) prevent its notaries from being MITM'd as well?

I have been looking into Convergence and how it works, but I cant figure out how it is effective against a MITM attack that happens near the target system. My understanding is that Convergence works ...
25
votes
3answers
2k views

What is an SSL certificate intended to prove, and how does it do it?

If I get an SSL certificate from a well-known provider, what does that prove about my site and how? Here's what I know: Assume Alice and Bob both have public and private keys If Alice encrypts ...
6
votes
2answers
278 views

How protective should we be of an SSL client certificate?

We've got an application where the database connection requires an SSL client certificate. How protective do we need to be of this certificate? What are the implications if someone else gets it? I ...
8
votes
3answers
677 views

Does the SSL encryption strength of a website really matter?

When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart. Immediately there seems to be 4 major ...
5
votes
4answers
1k views

MiTM - Non-HTTP TLS

I'm doing some research into the privacy of various iOS applications. My main source of data is via wireshark or Burp (HTTP/S proxy). This has been rather sucessfull for MiTM for decrypting HTTPS ...
16
votes
4answers
2k views

Why does Facebook serve several SSL certificates?

Facebook seems to be alternately serving two SSL certificates, one from DigiCert and one from VeriSign. There are only two reasons for this that I can think of: They're in the middle of a ...
24
votes
4answers
13k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
6
votes
4answers
604 views

Secure Web Password Fields + http to https redirect

I'm a software developer but I'm marking my niche in secure development. It turns out that while using WebScarab, I discovered that a popular user group site doesn't appear to properly take care of ...
2
votes
3answers
2k views

SSL verification of host name of https server

I recently found that a library I am using (specifically Apache HTTPClient) when is configured to verify the hostname of the remote server against the certificate's CN it just seems to be doing a ...
194
votes
13answers
18k views

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
18
votes
3answers
4k views

Convergence - an SSL replacement?

Today, Moxie Marlinspike, a security researcher famous for his research on Android and SSL and related protocols (author of sslstrip/sslsniff), released "Convergence" which says is "an agile ...
4
votes
1answer
526 views

Slow client key exchange in TLS?

I've been benchmarking my TLS performance, and I noticed that during the "write client key exchange" phase, there's significant overhead compared to all other actions. I'm wondering if there's ...
5
votes
3answers
336 views

DHE exchange and client authentication

If a server has a known public key and a Diffie-Helman exchange is performed and signed by that key, is there any benefit to authenticating the client before establishing a secure channel instead of ...
14
votes
4answers
2k views

How to detect “forged” SSL certificates from the webserver end

The company I work for sometimes intercepts employees ssl connections to https websites by making the ssl connection on their behalf from a proxy, and then using the own generated certificate to send ...
4
votes
3answers
340 views

Locking down web-based admin areas with personal SSL certificates

I've been tasked to setup a secure platform, where I've been asked to assign personal SSL certificates to administrators, and have the server only allow persons into the administration areas that have ...
8
votes
7answers
30k views

How can I determine the encryption strength of an SSL connection

If I've connected to a https url, how can I determine the cipher strength of the connection? My understanding is that after the asymmetric public-key handshake the information is encrypted using a ...
3
votes
3answers
1k views

Need to secure (and add SSL?) RPC port 443 on Win2003 server

So I received an email from my system administrator who wants me to secure a server I own that seems to have a vulnerability in port 443 (which is Windows RPC over HTTPS). Disabling it I know causes ...
11
votes
1answer
1k views

SSL TLS renegotiation vulnerability - current situation in clients

Reading about the SSL renegotiation problem CVE-2009-3555 one knows that servers supporting old type of renegotiation are vulnerable to data injection. We also have tools to test them (openssl ...
7
votes
2answers
2k views

SSL Session resumption and IDs

Some sites, as seen in the report for www.mbank.com.pl [ssllabs.com] or report for aliorbank.pl [ssllabs.com] do not support "Session resumption", either because IDs are assigned but not accepted ...
11
votes
2answers
2k views

Which cipher suites with AES cipher provide forward secrecy?

Does standard AES with RSA (reported by Opera as TLS v1.0 256 bit AES (1024 bit RSA/SHA)) provide perfect forward secrecy? Which SSL3.0 and TLS1.0 ciphers do provide forward secrecy? Which ciphers ...
6
votes
2answers
327 views

Design proposals for enhanced security for parts of Internet, e.g. for banking?

There is some recent discussion of some sort of "multilevel" internet, with e.g. a level defined for banking in which access is only granted after special authentication with "true names", special ...
5
votes
4answers
442 views

How secure is SSL?

Is it not true that SSL can be decrypted by simply having listened to the network activity of a PC on a network? (for example, from the first time a random PC connects to a coffee shop, and keep ...
92
votes
3answers
56k views

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
4
votes
2answers
987 views

When should I use Message layer encryption vs transport layer encryption

Basically I will be having to secure a connection between different hops. Therefore even if TLS is widely known to be the best in class, I am wondering that in such a case message based encryption ...
4
votes
3answers
916 views

Paypal IPN, SSL and man-in-the-middle attacks

Okay, suppose I have been implementing paypal IPN, and my server will respond by verifying with "https://www.paypal.com/cgi-bin/webscr" and got the VERIFIED message back. First, if my server connects ...
6
votes
3answers
7k views

Secure jquery ajax calls from a non secure page

I could not find a clear answer, but if I have the following situation: I browse to a page let's say http://www.example.com/index.html Now I use a form on this page to do a postback with jquery's ...
16
votes
4answers
1k views

What to transfer? Password or its hash?

Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...
2
votes
1answer
1k views

Is it possible to secure a web app without HTTPS? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? Think of a typical web application where the users log in, and then the session is kept with a session key. Is ...
10
votes
2answers
2k views

Secure communication between applications using SSL Certificates

I am looking for a way how to secure communication between our applications. There is a "server" application listening on some TCP port and "client" application which is communicating with the ...
18
votes
2answers
917 views

Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?

For example, say the following are HTTPS URLs to two websites by one IP over 5 mins: "A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2". Would monitoring of packets reveal: nothing, reveal only ...
35
votes
6answers
3k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
5
votes
2answers
1k views

What tools exist to help me monitor OCSP certificate validation failures?

The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online ...
4
votes
1answer
723 views

OCSP: What is “hackedirl.files.wordpress.com”?

After I ticked that my browser (Firefox) must require OCSP: http://i.stack.imgur.com/UeDXh.png I got a window popped up (several times! And it still pops up.. ~randomly ~about a few 10 minutes): ...
14
votes
1answer
597 views

Are there any security problems with Google false start for TLS?

Google recently announced false start in Chrome browsers which increased TLS performance by 30% http://news.softpedia.com/news/Google-Chrome-s-SSL-False-Start-201253.shtml I know TLS has been poked ...
9
votes
3answers
8k views

SSL handshake failure modes

In SSL if the handshake is not succesful, does it always end with a handshake alert? Or are there other ways to finish the SSL connection (acceptable by standard). I am asking this, because in an ...
14
votes
7answers
1k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop pc, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using [not with free will, so e.g.: I'm "attacked"] a rouge DNS ...
6
votes
2answers
2k views

Getting self-signed SSL certificates for all https connections made from some premises

Context: I'm currently working as an expat for my company in a country where the Internet is notably untrustworthy. It made the headlines a few months ago for stealing facebook, twitter and gmail ...