SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

6
votes
2answers
2k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
3
votes
3answers
1k views

Is a company website secure against sslstrip if it doesn't use ssl on homepage but ssl everywhere else?

Most ecommerce websites use SSL/TLS when you want to log. But most have homepage using http only. Is it enough to have SSL/TLS on login page and logged page to prevent sslstrip ?
2
votes
4answers
714 views

Should links to images contained in emails be secure?

We are generating emails which contain links to images: our client's branding, images showing other products offered by the client etc... What are the security pitfalls if these links in the emails ...
2
votes
3answers
166 views

Are my credentials unsafe if I am already logged-in before connecting to a public network?

Let's say I am already logged-in to my Gmail or Yahoo account using my 3G then I switched to a public WIFI in an airport or cafe. Is my username and password still vulnerable? What others kinds of ...
2
votes
1answer
204 views

Any problems with UCC (multidomain) SSL certs on iOS and Windows Phones?

Are they any known issues with UCC (multidomain) SSL certs on iOS or Windows Phone? Let's say I want to have Exchange server under outlook.mycompany.com and RemoteApp Portal under ...
-1
votes
2answers
356 views

Is SSL needed for connecting to my DVR System?

I was wondering if SSL is necessary to connect to my DVR System, by default, which can't be changed, I can connect to my DVR System with the help of dyndns.com. But going to the domain doesn't show ...
5
votes
2answers
7k views

How to get public key of a secure webpage?

How can I get the public key of a webpage like verisign , etc. using HTTPS protocol?
4
votes
2answers
216 views

TLS server key: possible to sign another TLS server key?

If I have a valid (verifiable) certificate C_K_s that links the server key K_s to "www.example.com", is it possible to : use K_s to sign K_d, and let S_K_d be this signature use K_d as the TLS ...
2
votes
1answer
810 views

Generate one CSR for two Windows servers

I have two Windows 2008 R2 servers which will be hosting a load balanced website. I will generate a private key and use it to generate a CSR using OpenSSL. How can I make this CSR (or the resulting ...
3
votes
2answers
163 views

In practice, does crypto software accept a *.com or or even a *. certificate?

Assuming this will be done with your own PKI, and not a public trusted CA. Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
2
votes
3answers
784 views

SSL inspection detection

an interesting question was recently asked about SSL inspection, and that got me wondering if it is actually possible, from the end user (or even server side), to detect if the SSL link is being ...
13
votes
5answers
3k views

SSL Inspection and privacy

I know my company is testing something called "SSL Inspection" based on Websense, which is our proxy. I can not provide more detail about this, but does this mean that in principle all my SSL traffic, ...
11
votes
2answers
4k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
4
votes
4answers
795 views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
2
votes
3answers
1k views

Is OpenSSL secure enough?

We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries. It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
1
vote
1answer
322 views

JS frontend for RESTful backend vs authorization

I'm building web-app. And i have concern about security issues. In world a lot of similar questions, but many of them does not have really clear answer(advise,suggestion). This is the reason why i ...
5
votes
3answers
968 views

Is TLS flawless enough to prevent eavesdropping carried out by an ISP?

I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic. Will that prevent ISP and ...
3
votes
6answers
1k views

Does Self-signed certificate differ from CA from a security point of view?

I know that if I use self-signed cert, browsers will warn about it to the user, but I want to know that from security viewpoint is self-signed cert as secure as certificate authority(CA)?
2
votes
3answers
175 views

Whether certificates can be used for regulating access

I am thinking of a mechanism where I need to authenticate the client and control the access. I am thinking of using SSL for this purpose. I want to know whether using SSL solves my purpose. My ...
1
vote
2answers
124 views

Does Convergence solve the problem of hacked CAs?

My question is about the Firefox AddOn Convergence. So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
6
votes
3answers
1k views

Securing a multi-tenant architecture

I'm a computer science student looking to expand an already developed web application into using multi-tenant architecture. Considering I'm far from being a security expert, which precautions can I ...
8
votes
2answers
12k views

How to mitigate SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability?

Disclaimer: I'm not a sysadmin, please try to give your answers in developer friendly language ;) I'm test scanning a fresh VPS image with Nessus and I'm getting plugin 58751. I tried figuring out ...
4
votes
3answers
184 views

Is using encryption the only viable option to thwart password sniffing?

I'm using HTTPS Everywhere on my browser to chose SSL versions of websites when available, but many sites don't offer a secure version. Is SSL the only viable option to thwart password/clear text ...
2
votes
2answers
1k views

'SSL Session Resumption using Cached Session IDs'

Is supporting 'SSL Session Resumption using Cached Session IDs' by SSL Servers secure ? Is Session Hijacking possible in any way if this feature used ?
3
votes
1answer
128 views

Spurious SSL Certificates when accessing sites through enterprise network

I've noticed recently when I log on to sites like Hotmail that IE has been telling me there is something wrong with my SSL certs. When I examine the certs, the Issuer appears as "Blue Coat" from ...
24
votes
3answers
18k views

What is ECDHE-RSA?

What is the difference between ECDHE-RSA and DHE-RSA? I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
5
votes
3answers
3k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
7
votes
1answer
202 views

Does dnssec protect against malicious registrars?

With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked). This is especially ...
5
votes
4answers
904 views

What's the safest way to access my US-based bank's website from within Mexico? VPN vs SSH vs HTTPS?

I will soon be moving to Mexico and living there for an extended period. During that time I will need to occasionally access my US-based bank's website. I'll always be connecting using my own laptop, ...
4
votes
3answers
207 views

How (if at all) can an attacker manipulate an already established SSL/TLS Connection?

First off, this is a purely academic question. My first answer would be that he cannot since he does not have the session key. Could he at least kill the connection, such as by sending spoofed FIN ...
1
vote
2answers
219 views

Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?

From a security point of view, is it okay to read foreign (untrusted) cookies (from 3rd parties on the Internet) on your internal (trusted) network, or should you only read them within the DMZ areas ...
13
votes
2answers
18k views

Advantages of client certificates for client authentication?

I'm no security expert, so please just ask in a comment if I haven't made my question clear enough for an answer. The Scenario We have a server running WCF services, and a number of clients ...
1
vote
4answers
309 views

Is e-mail sent from a Gmail address to another Gmail address encrypted?

Gmail provides an SSL connection and also encrypts the entire session by default. But if you send a mail, once it leaves gmails servers, it can be read at any point on the internet. But what about ...
2
votes
1answer
1k views

openSSL Not Displaying all attributes

Here's a background of what I've done so far: I've been able to add a CRL to a self signed certificate using OpenSSL (see attached). But I'm not sure how to create an X.509 certificate issued by ...
7
votes
3answers
4k views

When is it appropriate to SSL Encrypt Database connections?

Let's say I have a web server I setup, and then a database server. However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right? The only time to use ...
13
votes
1answer
9k views

What is the actual value of a certificate fingerprint?

In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
21
votes
3answers
24k views

How to fix SSL 2.0 and BEAST on IIS

As you can see on this post TeamMentor.net vulnerable to BEAST and SSL 2.0, now what? the app I'm currently development got flagged for SSL 2.0 and BEAST by SSL Labs. I'm using IIS 7.0 with the ...
2
votes
4answers
739 views

HTTPS Everywhere vs. NoScript

What does HTTPEverywhere gives compared to NoScript with Firefox (Options|Advanced|HTTPS|Behavior)? Why use HTTPEverywhere, when NoScript also can strict websites to use only HTTPS?
3
votes
2answers
127 views

Does site need SSL to resend info to a site that does use SSL?

Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
3
votes
4answers
2k views

Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?

I am developing a web app, which makes HTTP calls as long as the user is not logged in. Once the user clicks the login button, he is sent to a "login page" that is HTTPS. The login makes an Ajax call ...
6
votes
4answers
1k views

Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)

I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was: CA with RSA keys capable of signing RSA and EC CSRs CA with ...
1
vote
3answers
415 views

Monitoring and filtering of arbitrary outgoing data

I would like to be able to not just centrally monitor but also filter any organizational data moving out our edge routers, regardless of the sender application and regardless of the protocol/port used ...
5
votes
3answers
756 views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
3
votes
2answers
973 views

Do you require a special type of certificate for using Diffie Hellman as the key exchange protocol in SSL?

In Diffie Hellman key exchange technique both the parties aggree on a common parameter g then they generate their private parameters a and b . Then they exchange g^a and g^b. now they can calculate ...
0
votes
3answers
213 views

Is HTTPS necessary for password change if user has already logged in with HTTPS?

I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION. Is this really necessary?
2
votes
3answers
787 views

Downside of allowing uncertified Certificates

I've seen Firefox poping up the message "Untrusted Connection" where self signed certificates are involved. However, I could not understand what the following means (in bold) : XXXX.XXXX.XXXX:8443 ...
3
votes
1answer
2k views

how do extended validation X.509 certs work?

https://www.forumatic.com/ uses an extended validation cert. wikipedia.org's entry on extended validation certs says that a cert is known to be an extended validation cert if the OID in the ...
2
votes
3answers
9k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
2
votes
1answer
580 views

Is SSL session based only? Is there a (formal) definition of an SSL connection?

In various docs on SSL there is a mention of connection. But from the context I am not sure if this means the underlying TCP connection or the SSL connection. I am thinking that there is no SSL ...
2
votes
1answer
334 views

secret key compromise in SSL vs in Kerberos

Consider the consequences of compromise of a secret key in the Kerberos system vs. in SSL. For example, suppose your individual shared secret key (for your user account) becomes compromised (i.e. it ...