SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
2answers
3k views

What needs to be done on a Citrix Netscaler to protect from SSL Renegotiation attacks?

I'm under the impression that the TLS/SSL renegotiation hack has been fixed. I'm not sure if the software has to be deployed on the server side, client side, or both. Based on this blog, TLS ...
1
vote
3answers
815 views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
0
votes
1answer
278 views

Are export ciphers allowed in DTLS 1.0?

In RFC 4347 for DTLS, I am unable to find the cipher list to be supported. The RFC mentions it as a set of changes from TLS 1.1 (RFC 4346). TLS 1.1 prohibits use of export ciphers. Are export ...
1
vote
3answers
247 views

Is email between 2 parties secure if both mailboxes are on the same server and both clients use SSL?

Sorry if this is incredibly basic, but I'm not very familiar with how SMTP works. I have a mail server (running Postfix with Dovecot) with an SSL cert from a well-known/accepted CA installed and ...
4
votes
2answers
4k views

Recommended Cipher Suites for TLS 1.0, 1.1 and 1.2

There are a lot of cipher suites defined in the in the specifications itself of TLS 1.0, 1.1 and 1.2. And furthermore, there exist RFCs which add even more cipher suites to a specific version (e.g. ...
2
votes
1answer
440 views

Does client certificate authentication demand more server-side entropy?

We have a secure web service running Apache that requires client certificates for access. This service has a problem with running out of entropy. We have several other sites that use TLS that get ...
14
votes
3answers
12k views

How to test for the BEAST attack if server isn't Internet-connected?

I'd like to test a server specifically for vulnerabilities related to BEAST. What command line switches should I use? What should I see (or not see) in the output? Update The intent is to scan a ...
2
votes
1answer
356 views

What security technology do I need to protect my SSN database?

I'm designing a web application. I need to make sure all my customer's SSN data is secure. Now I know HTTPS with SSL, I'm wondering what are its weaknesses? What else I need to provide a perfectly ...
6
votes
2answers
14k views

Javascript and jQuery not secure over https

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure. I'm using ...
2
votes
3answers
194 views

What is the worse that could happen if a government wanted to interfere with a CA?

In our time of SOPA, PIPA and ACTA, I was wondering what could happen if a government wanted to remove the certificate of a website ? CA are companies, so they would have to obey to instructions from ...
7
votes
2answers
6k views

How to thwart sslstrip attack?

I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
2
votes
2answers
361 views

HTTP + HTTPS + One Time Pad/stream cipher

I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
3
votes
1answer
462 views

Can SSL server choose a session ID '0' in the 'Server Hello' message?

Can s SSL server in response to 'CLIENT_HELLO' request choose a NULL value for the session ID in its response, SERVER_HELLO? Is it OK?
4
votes
1answer
817 views

X.509 algorithm identifier parameters vs. extension values

From the X.509 specs: AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } ...
3
votes
1answer
1k views

Why doesn't asn1parse parse all DER encoding strings?

I have a file - crl.txt - that contains the following: MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw= It's from one of the extensions in a particular X.509 cert. Why ...
4
votes
1answer
394 views

Sniffing IMAPS traffic! Are there any tools for this?

I've got a problem where someone has implemented a custom IMAP Server. I need to write a custom application to get a list of emails, and fetch messages. Problem is, every library I've tried to use ...
4
votes
1answer
2k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
4
votes
1answer
1k views

Why MA-SSL has been introduced?

If my knowledge is correct with respect to simple SSL, Mutually Authenticated-SSL has the advantage that both end parts are authenticated one to another: Not only the Client endpoint knows that ...
3
votes
1answer
530 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: ...
3
votes
1answer
1k views

anti-CSRF tokens in HTTPS environment

Does it really make sense to use anti-CSRF tokens in a web application that is accessed by HTTPS only? If yes, then what are the possible ways to attack such a web application if anti-CSRF tokens are ...
7
votes
3answers
282 views

Would using distinct IP addresses help support browsers with older SSL implementations?

We have a site with two wildcard certificates: *.foo.com and *.bar.foo.com. All of our subdomains resolve to the same IP address. Newer browsers work fine with this, but IE7, for example, does not. ...
30
votes
4answers
23k views

What certificates are needed for multi-level subdomains?

I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy. Here's what I need to secure: ...
3
votes
2answers
4k views

Can Cookies Without the Secure Flag be Stolen, even when only accessed via HTTPS?

Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set. Suppose the site is https://www.example.com. http://www.example.com does not show up, also ...
4
votes
2answers
2k views

Next Microsoft Patch Tuesday include BEAST SSL fix

http://thehackernews.com/2012/01/next-microsoft-patch-tuesday-include.html I thought the vulnerability that BEAST uses is already fixed on "Microsoft" side, no? Can someone please clarify this?: ...
10
votes
1answer
2k views

If an attacker is intercepting all of my traffic, will he be able to listen on my VPN session?

If I am a remote user, connecting to my firm from home, using IPSec VPN tunnel or through SSL, and an attacker is intercepting all of my traffic, will he be able to watch my VPN session on the clear ...
3
votes
1answer
1k views

parsing the id-ce-keyUsage extension in X.509 certs

I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows: ...
6
votes
2answers
667 views

Why would the downloaded certificate show a different end-date as compared to the same certificate when viewed online?

This is sort-of a follow-up to my previous question What fields in a suspicious certificate should I look at? Chrome just presented the warning icon against the certificate presented by ...
-1
votes
1answer
98 views

Why are there soo many HTTP connections when using Convergence?

I installed Convergence on Firefox 9.0.1: http://convergence.io/ but... after I installed/enabled it when I visit a HTTPS only-site there are many-many HTTP traffic to the notary servers. Why? ...
0
votes
2answers
249 views

Convergence HTTPS - what are the Notary servers?

https://www.youtube.com/watch?v=Z7Wl2FW2TcA What are the "Notary" servers regarding convergence? Who is maintaning the "Notary" servers? Can someone please explain?
10
votes
3answers
4k views

Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?

I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
6
votes
2answers
1k views

OCSP and CRLs: Specified in CA or client certificate?

Here's an example PKI setup: * Root CA (offline) * Issuing CA * Client 1 * Client 2 I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
8
votes
3answers
694 views

Public wifi security protocols

I should apologise first- this post could seem a lot to ask for, but I am starting to go around in circles. I am interested in securing my laptop for when I use public wireless hotspots, as I am a ...
1
vote
3answers
332 views

What security protocols provide point-to-point confidentiality?

Am I right in thinking that VPN doesn't protect until you're out onto the external network (assuming you're connecting from within an internal network)? Or does VPN provide confidentiality from the ...
0
votes
2answers
932 views

Protecting yourself against DNS spoofing?

Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot ...
2
votes
3answers
258 views

Help with SSL teaching material

I am taking a course on security next month. As the concepts of SSL/TSL are bit hard. I am looking for a nice way of presenting it to my students. They are Compsci undergrads. It would be nice to ...
4
votes
1answer
3k views

When will the webbrowsers have TLS 1.2 support? [closed]

https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.2_.28SSL_3.3.29 and http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ when will the webbrowsers have TLS 1.2 support?? ...
11
votes
5answers
4k views

Does HTTPS Everywhere defend me against sslsniff-like attacks?

http://www.thoughtcrime.org/software/sslsniff/ If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
9
votes
4answers
2k views

Is accessing bank account on the internet really secure?

Before I ask my question, I would like to make sure that I understand the settings correctly. So, the given: A client, using some web browser (firefox, for instance) - the Client The bank server - ...
4
votes
3answers
207 views

Proper way to obtain CA certs for verification

I want to securely connect to an API, but I'm not sure how I should obtain the CA cert for the verification step. I've seen some people get the certs using e.g.: openssl s_client -connect ...
7
votes
1answer
2k views

Should I regenerate new SSL private key yearly? [duplicate]

Im' renewing my certificate every year. Since I have to make a CSR, should I also renew my key pair at the same time, or is it ok to get a new cert with the same key ? Please supply any security ...
3
votes
2answers
688 views

Secure Mobile Payments using HTTPS Web App

I'm hoping an expert with PCI compliance knowledge can help answer this question. We're looking at integrating mobile payments with our application which is HTML5-based for cross-platform reasons. ...
4
votes
6answers
206 views

Archive encrypted traffic, for later decryption attempts?

I am concerned about sending long-term sensitive information over SSL. Someone who does not have the private key could record SSL traffic (with WireShark, Fiddler or some such) and store it for ...
6
votes
1answer
699 views

How has TLS renegotiation been fixed?

I've read RFC 5746 on the TLS secure renegotiation extension. However, I don't understand how it fixes the problem. Client and server are required to include the verify_data from the previous ...
4
votes
2answers
688 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
3
votes
3answers
189 views

Best approach for making an app that connects to sensitive information

I'm gonna be writing an app that connects to a server with sensitive information and one of the main requirements is that only my app will be able to make the connection. There is no user supplied ...
8
votes
1answer
252 views

Why are website certificates secure?

I understand how HTTPS connections work, and I also understand they they require a certificate to know that the secure connection you have is with the right server (and not someone pretending to be ...
3
votes
1answer
335 views

Security for a low latency online multiplayer game

I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
5
votes
3answers
1k views

How to roll my own security mechanism - avoid SSL

i'm looking at implementing my own security mechanism rather than using ssl due to ssl being 'hopelessly broken' http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysis/ and also because it is ...
5
votes
2answers
331 views

System for Mutual authenticaion and confidentiality

I am looking for a protocol where there needs to be mutual authentication between client and server. For example server should connect to a particular client only. That is client should authenticate ...
2
votes
3answers
1k views

HTTPS Apache2 Information Leakage

Hello IT Security! I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com. I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com. ...