SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

0
votes
2answers
208 views

Analyzing SSL encryption

I have to analyze SSL encryption in my test network and want to prove the transported data is encrypted. What methods can I use to prove encryption is in place?
0
votes
1answer
146 views

Proxy Non-HTTPS logins through EC2

I've been thinking a lot about password security these days, and have been becoming more and more hesitant to use services that have login forms that are not on HTTPS. As I was researching security, ...
0
votes
1answer
226 views

GoogleMail encryption

Gmail provides an SSL connection and also encrypts the entire session by default. But if you send a mail, once it leaves gmails servers, it can be read at any point on the internet. But what about ...
0
votes
1answer
664 views

URIs in the subjAltName X.509 extension

The subjAltTag extension for X.509 certificates can take in domain names, email addresses, URIs, etc. I was playing around with an X.509 whose subjAltTag had just a URI in it doesn't seem to work. ...
0
votes
1answer
283 views

id-ce-cRLDistributionPoints ASN.1 / DER encoding question

I have a file - test.pem - with the following contents: -----BEGIN CERTIFICATE----- MBIwEKAOoAwwCqMIMAZhBEFCQ0Q= -----END CERTIFICATE----- openssl asn1parse -inform PEM -in test.pem -i returns the ...
0
votes
1answer
273 views

Are export ciphers allowed in DTLS 1.0?

In RFC 4347 for DTLS, I am unable to find the cipher list to be supported. The RFC mentions it as a set of changes from TLS 1.1 (RFC 4346). TLS 1.1 prohibits use of export ciphers. Are export ...
0
votes
1answer
23 views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
0
votes
1answer
65 views

Native app, token authentication without login/password

I'm working on a always online mobile game (native android/iOS app with Unity) and i would like to be able to authenticate the player without requiring any login/password at the beginning. For those ...
0
votes
1answer
57 views

Apache Server Maintains HTTPS Connection To Mysterious Server (Hijacking?)

I've been on a shared webhosting plan for 10 years and I recently moved all of my sites (various WordPress sites and associated plugins, all in PHP, a MediaWiki site, and a lot of static stuff) to my ...
0
votes
1answer
69 views

Is my understanding about how SSL works correct?

I've been reading about 2-way SSL or mutual auth recently, and here's what I've figured so far: Mutual auth is a way for the client to authenticate itself to the server, just like the server does to ...
0
votes
1answer
27 views

Does openssl store the certificate of the server after verification is done?

As per my understanding , openssl will verify the certificate of the server during ssl handshake , using the trusted CAs present in the CA certificate dir in the context. After the server certificate ...
0
votes
1answer
89 views

Bitdefender Antivirus SSL Cert substitution

I am using Bitdefender AV 2013 ed and I have noticed that when the Scan SSL is enabled in the configuration BD will use a local certificate, as mentioned here. This modifies the cert chain with BD as ...
0
votes
1answer
80 views

How do SSL/TLS certificates work?

I'm trying to understand how SSL/TLS certificates work, but I'm missing something. I have obtained my current understanding from this website: ...
0
votes
2answers
62 views

client SSL authentication .pem file and .crt files

So I have minimal knowledge of security really but I'm a primary developer on an application which handles some sensitive data that we want to be secure. The application communicates with one other ...
0
votes
1answer
55 views

how can i bypass close_notify in ssl in firefox? [closed]

i am trying to login to my yahoo mail, but no avail. i recently discovered after monitoring some traffic that the dumb yahoo server doesn't send a close_notify response but just acts ignorantly and ...
0
votes
1answer
52 views

Apache redirecting to unsecure port

I have setup a test website in order to play around setting up SSL. The website is setup on a Windows host with Apache 2.2.20 with OpenSSL 0.9.8r, MySQL 5.5.37, PHP 5.3.28. The URL to the home page ...
0
votes
1answer
61 views

Create https session between server and client

I'm doing a project about security transactions and i'm wondering if to establish a connection based on https both client and server need to have a ssl implementation installed to preform the ...
0
votes
1answer
45 views

Can two parties sign each other's certificate and exchange without CA?

Is possible (and practical) for two users to create their own self-signed SSL certificates, exchange these certificates (perhaps in a face-to-face meeting), and then communicate with each other ...
0
votes
1answer
87 views

SSL Mutual authentication Fails

When I try to establish a Mutual authentication between server and client, I am getting the errors below. The timing between the server and client is exactly same and also the certs are proper in ...
0
votes
1answer
36 views

Is it possible to create a SMIME only PKI that *can't* be used for SSL?

Assume I have a Root CA that I want to share with hostile untrusted 3rd parties. Then constrain this root using specific EKUs at the root. OID=1.3.6.1.5.5.7.3.4 ; Secure Email Next, ...
0
votes
1answer
98 views

How is the new “Dyer” malware bypassing SSL?

Apparently the new Dyer malware is bypassing SSL to swipe bank credentials. I read that it's using "process hooks" to hook the browsers and see the data BEFORE it is encrypted and sent to the bank ...
0
votes
1answer
135 views

Mixing green (EV) ssl certificate with non EV certificate

We have a green (EV) SSL certificate for our site and images are fetched from the same domain (https). Currently we are planning to change the images domain (for performance issues) and put them in a ...
0
votes
1answer
141 views

Security risk among shared wifi users [duplicate]

I understand that the shared users on a wifi can see each other's HTTP traffic using proper tools. Is it possible for shared users to read HTTPS traffic or encrypted traffic like TOR ?
0
votes
3answers
91 views

Where do my keys come from for requests over SSL? [duplicate]

From what I understand, when you send information to a website over SSL, you encrypt the information you send with their public key. However, if you want to be able to decrypt the information they ...
0
votes
2answers
49 views

SSL reconstruction with missing part

I know that it's possible to decrypt a sniffed SSL session even when some packets were lost during the capture. I run some tests with wireshark and I saw that it's still able to decrypt part of the ...
0
votes
2answers
132 views

Heartbleed: revoke or replace ssl certificate?

I have a free ssl certificate issued just before Heartbleed was found. Now my CA wants me to pay 25$ to revoke it. Should I pay or it's just enough to create a new certificate from another CA an ...
0
votes
1answer
207 views

Php Session ID, http VS https [duplicate]

So I was doing some tests with the php session ID cookie. I know that data is stored on the server however, a cookie with a unique ID is stored so that the server can recognize the client while ...
0
votes
1answer
79 views

Certificate request - why does the requester have to create a private key?

If remember right, then before I send a CSR (Certificate signing request) to the CA, I have to create private and public keys. Then I use the public key to encrypt my personal details before I send ...
0
votes
1answer
82 views

Is there a secure DNS provider? [closed]

Is there a secure DNS provider? Kind of alternative to DNSCrypt.
0
votes
1answer
140 views

Outbound Port 443 Open but Not Allowing SSH [closed]

My college wireless network has a firewall blocking all outbound ports except 443 and 80. The wired network, however, has none of these restrictions. I can connect to HTTPS sites (obviously). On my ...
0
votes
1answer
590 views

Apache 2.2 mod_ssl configuration Forward Secrecy/BREACH/BEAST/CRIME

I am looking for mod_ssl configuration which protects against common attacks like Breach, Beast and Crime. I already disabled gzip to avoid Crime but I'm unsure about the others. RC4 should only be ...
0
votes
1answer
587 views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
0
votes
1answer
166 views

are there serious weaknesses in this free password management system?

I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
0
votes
1answer
135 views

Possible to Derive Private Key from Public Key Given Enough Computing Power? [closed]

Is it possible via brute force to derive a private key from a public key (such as a website's SSL certificate)? If so, how much computing power would you need to make it feasible, compared to say, ...
0
votes
3answers
271 views

SSL Certificate for an email server

I am completely new to SSL/TLS and would appreciate any help you guys could give me. To give you some background info, our company website is hosted externally by our ISP, however our email is ...
0
votes
2answers
124 views

SSL can stop MiTMs … but on the long run, can it really? [duplicate]

SSL uses CAs which sign certificates for the domains after they validate that the person requesting is truly the owner and by a public/private key pair a encrypted connection is achieved which cant be ...
0
votes
3answers
55 views

TLS encrypted passwords on my Android - safe? [closed]

i just get an answer from IM+ (instant messenger client android app) support and they told me that my auto saved ICQ, Googletalk, YM passwords are encrypted using TLS, so i want to ask if i need to ...
0
votes
1answer
151 views

CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible?

Sorry if this is a very amateur question. I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting ...
0
votes
1answer
62 views

Sending passwords securly over the net: javascript? [closed]

I believe SSL is decrypted and encrypted from your computer to the receiver right? Well is it possible to use any type of encryption (Stanford crypto lib?) to get a password safely over the net these ...
0
votes
1answer
77 views

Are there software solutions take encrypted credit card data taken straight off a square credit card reader and insert them into a standard web form? [closed]

Does anyone know how you can take the encrypted output of a square card reader and insert it directly into a standard web form?
0
votes
2answers
150 views

Can a rogue app hijack an ssl session of another app on the same phone?

We've been discussing a possible attack vector where a rogue app with root rights could hijack the legit ssl session of anther local app and transmit its own data over it without the server being able ...
0
votes
1answer
42 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
0
votes
1answer
139 views

why credentials are not shown in mitmproxy?

my question is that why I can not see some credentials in mitmproxy while the application connecting to, uses ssl connection? I actually installed the mitmproxy server on my PC and have set up my ...
0
votes
1answer
420 views

Private Key and Public Key Serial Number and Thumbprints

Are the private key Serial numbers and thumbprints the same as the corresponding public key Serial numbers and thumbprints for certificates (X509Certificates, Base64-encoded X.509), and are these good ...
0
votes
1answer
58 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...
0
votes
2answers
96 views

Corporate IT monitoring and access to user private data (keylogging? https data transmission?) [closed]

I work at a large company that requires employees to sign a digital certification saying that we recognize the right of the said company to monitor all data and communication on our work laptops, and ...
0
votes
1answer
1k views

iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)

As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2. ...
0
votes
1answer
124 views

Why not use client certificates for premaster key generation

The question is about a very specific SSL handshake scenario. I understand that some servers may request client certificates in order to authenticate connecting clients. However, as far as I can ...
0
votes
2answers
45 views

DHE Verification

I'm just struggling to get my head around this. In certificate signing with static Diffie Hellman the public key and certificate information is sent to the CA who verifies the certificate ...
0
votes
1answer
26 views

3rd party SSL security and having an extra layer of SSL

I did a search and didn't quite find an answer to my question. I have website that is integrating with a 3rd party for eCommerce and CRM. On my side I am collecting no data. I don't collect any login ...