SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

9
votes
1answer
3k views

SSL replay attack when client/server random is missing

Hey studying the SSL protocol, I'm wondering how can someone be able to do a replay attack if the server nonce is missing? All the material I find says that nonces prevent it, but theres no examples ...
19
votes
2answers
4k views

symmetric encryption session keys in SSL/TLS

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if ...
7
votes
2answers
594 views

security of PKI, Certificates, certificate authorities, forward secrecy

I want to understand how certificates add to the security of information exchange. Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
5
votes
3answers
679 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
5
votes
1answer
976 views

TLS at layer 4 BUT 802.1X EAP-TLS at layer 2?

In the CISSP books, SSL/TLS has been through the arguments and fell rest onto the transport layer 2 instead of the session. OK - Fine. Port security 802.1X and EAP is a data link layer 2 ...
4
votes
3answers
429 views

It is safe to buy a domain if I get this message in Firefox?

Greetings, I want to buy a domain name from a big registar(well known on the internet) but when I go to checkout I see that my link is going from full encrypted to “Connection Partially Encrypted” ...
11
votes
1answer
14k views

How is OpenSSL related to OpenSSH?

Is OpenSSH using OpenSSL to encrypt traffic? Or something else?
7
votes
2answers
3k views

What is the “openssh-blacklist” package? Is it related to the Debian OpenSSL bug?

What is the "openssh-blacklist" package? Is it related to the Debians OpenSSL bug?
13
votes
3answers
2k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
4
votes
2answers
148 views

Question about the SessionLock paper

Some time ago there was a big fuzz over Firesheep: by listening to wifi traffic your login session can be stolen which is very bad because now somebody can e.g. send emails on your behalf. Some people ...
5
votes
2answers
622 views

What is more secure: Many subdirectories, or many subdomains?

I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef: www.mydomain.net/enroll www.mydomain.net/admin www.mydomain.net/ ... or I can configure them as a ...
5
votes
2answers
173 views

Complexity of web certificate attacks

I heard a while ago about someone exploiting md5 weaknesses to create a web certificate with the same md5 that a different certificate has. They were able to create a certificate through bad issuing ...
27
votes
9answers
14k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (websense). I know if I visit a https ssl-encrypted site (such as https://secure.logmein.com) they can't see what I'm doing on the site since all ...
5
votes
1answer
775 views

Thunderbird - what happens if Gmail SSL cert gets spoofed?

I use a good MUA: Thunderbird [to read/reply to my emails on Gmail]. So: what happens, if i go to a place, where is public wifi, and someone tryes to sniff my password/username/emails? Questions: ...
3
votes
3answers
1k views

sslstrip vs. privoxy redirect rule on clients

I watched this video: http://www.securitytube.net/video/193 Now I'm thinking about an example. Suppose I have a privoxy proxy on my PC: user.action file (just part of it): { ...
2
votes
1answer
2k views

How to find out if a connection encrypted?

I'm sniffing a connection that uses ICEP (ZeroC ICE Protocol), and its packet bodies compressed using BZ2 (GNU BZip 2) algorithm. I want to find out whether packets encrypted, or not. ICEP can use ...
5
votes
6answers
1k views

Should the bit-strength selection of a child certificate be influenced by the CA or the chain?

All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
8
votes
3answers
5k views

What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?

I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider. Question 1 Why ...
7
votes
5answers
2k views

Insecure Cookies Because of Load Balancer

I have a load balancer that terminates https requests to http and therefore my backend servers see them as http. As a result, all of my cookies are set without a secure flag when you view cookies on ...
9
votes
1answer
2k views

TLS replay attack - requirements of the serverHello nonce

As you all know, the SSL/TLS protocol requires both client and server to exchange (in clear text) a random number or nonce. This is presumably used to prevent replay attacks. It is not clear to me ...
34
votes
12answers
4k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
15
votes
4answers
4k views

Options when defending against SSLstrip?

I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?
5
votes
0answers
818 views

SSL vs IPsec what's the difference [duplicate]

Possible Duplicate: What is the difference in security between a VPN- and a SSL-connection? Which is more secure? And offer better access control?
6
votes
2answers
532 views

What a programmer should know before their web service's client audit

Situation: I have created a WS client (.net wcf) for the customer that access a third party web service (Websphere). This WS uses HTTPS and I get a certificate from WS vendor. All works fine, I have ...
9
votes
2answers
4k views

SSL Certificate revocation check

In the SSL protocol I don't see where the certificate is checked for revocation status. https://developer.mozilla.org/en/Introduction_to_SSL Is the Certificate Revocation and Status Checking not ...
7
votes
1answer
2k views

Is SSL key generation client-side, server-side, or both?

Who generates the session keys for a SSL symmetric encryption? Is it the client for both client and server where client generates part of it while the server generates the other part?
10
votes
3answers
2k views

How does an SSL server prove its identity?

This document says that a challenge response authentication proves the servers identity. But is a man in the middle attack still possible if the client does not verify domain name ? Please help me ...
1
vote
2answers
784 views

Possible to use CAPICOM to extract current SSL certificate?

I'd like to extract the current SSL certificate from the current browsing session, and read the properties. I'd like to do this at the Browser, for content that is delivered from the server. I'm ...
41
votes
4answers
10k views

Is posting from HTTP to HTTPS a bad practice?

Working on the assumption that SSL serves both to encrypt data and to provide assurance as to the identity and legitimacy of the website, should the practice of providing a logon form on a page ...
25
votes
10answers
879 views

Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
48
votes
5answers
45k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
4
votes
1answer
2k views

How to convert IBM Domino SSL keys (private key) to the OpenSSL format?

I have a customer with an IBM Domino server. They offer a way to export SSL keys but in a weird proprietary format. Any idea on how to convert those to OpenSSL? Basically I need to upload this key to ...
37
votes
9answers
12k views

Is visiting HTTPS websites on a public hotspot secure?

It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
13
votes
2answers
15k views

How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?

Firesheep has brought the issue of insecure cookie exchanges to the forefront. How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
20
votes
7answers
28k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
40
votes
4answers
28k views

What is the difference between an x.509 “client certificate” and a normal SSL certificate?

I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
24
votes
8answers
5k views

Is anybody using client browser certificates?

Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
11
votes
4answers
636 views

What is the risk of a packet being sniffed when travelling over the internet without SSL/TLS?

We all know to use SSL/TLS to stop people eavesdropping on our connection, but how likely is it that an attacker will actually sniff your unencrypted password or cookie if you don't? If we exclude ...
5
votes
3answers
4k views

Any good free SSL proxy on windows?

I'm looking for SSL proxy capable of dumping requests. I want to test custom browser against SSL-MITM attacks. I'm able to re-route all traffic ongoing from browser to machine with proxy. ...
22
votes
5answers
8k views

Where to get an SSL certificate for personal website?

I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
4
votes
2answers
1k views

On iOS, what's the benefit of OpenSSL over using CFStream, CFNetwork etc. for secure sockets?

I asked this already on Stack Overflow, here. I was told I might find answers here.
10
votes
5answers
2k views

Can Javascript/Flash verify the SSL connection to prevent “SSL Inspection”?

I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy. So some people may ask What is the point of re-validating SSL using javascript? ...
69
votes
7answers
25k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
26
votes
5answers
13k views

Are there security issues with embedding an HTTPS iframe on an HTTP page?

I've seen websites placing HTTPS iframes on HTTP pages. Are there any security concerns with this? Is it secure to transmit private information like credit card details in such a scheme (where the ...
11
votes
1answer
4k views

SFTP, FTPS and SecureFTP differences and security implications

What are the basic differences and security implications of using SFTP, FTPS and SecureFTP.
9
votes
2answers
734 views

Why is Firesheep Unable to Session Hijack over SSL?

Why is Firesheep unable to session hijack when a user is using SSL?
10
votes
6answers
382 views

Should we configure all devices to never request SSL 2.0, and reject it if offered?

In an effort to reduce man in the middle attacks, when will it be (or was it) an industry accepted practice to reject SSL 2.0 connections on the client and server side? Is configuring this on a proxy ...
10
votes
2answers
5k views

What are the differences between the versions of TLS?

Please correct me if I'm wrong, but my understanding is that SSLv3 and TLSv1 is just a rename of the earlier protocol... but TLSv1 adds the ability to have secured and unsecured traffic on the same ...
49
votes
13answers
9k views

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
11
votes
4answers
1k views

What kinds of SSL certificates are usable for encryption?

I know that Verizon SSL certificates cost close to $600. There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...