SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

1
vote
1answer
55 views

Protecting encryption of outdated software with a server

I have a 1st generation iPad, and I usually use it for web browsing when I'm home. The 1st gen iPad can't run newer versions of iOS (I'm stuck with iOS 5). I went to a website that tells if your SSL ...
1
vote
0answers
544 views

GnuTLS ServerHello exploit (CVE-2014-3466) - how to verify?

So pretty much all of the GNUTLS world is worrying about CVE-2014-3466. I checked my Kali and it responds with this - # apt-cache rdepends libgnutls26 | grep -v lib Reverse Depends: ...
1
vote
0answers
97 views

Are any major websites offering ECDSA authentication?

At the time the Cloudflare blog post “ECDSA: The digital signature algorithm of a better internet” was authored, Cloudflare was apparently one of "fewer than fifty" users of ECDSA certificates on the ...
1
vote
1answer
196 views

What is the advantage of buying an SSL certificate from the CA rather than a reseller?

I am trying to do some research on SSL certificates, and I've come across a number of reseller sites such as GoGetSSL, which offer certificates at much lower prices than what you would pay if you ...
1
vote
0answers
225 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
0answers
37 views

Is the root CA certificate required in the .crt file? [duplicate]

I am setting up SSL on Nginx with a free StartSSL certificate. Based on the instructions given on this StartSSL page I created a unified certificate containing the CA's root certificate, Intermediate ...
1
vote
0answers
470 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
0answers
60 views

Ability to decrypt intercepted encrypted SSL traffic when having private key [duplicate]

I was reading some blog posts about the Heartbleed vulnerability (who's not nowadays) and was thinking about the following. Situation A If I would use a regular SSL/TLS connection the handshake will ...
1
vote
0answers
33 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
1
vote
2answers
1k views

Why do I need a certificate to pin an SSL connection with AF Networking 2?

I am using the AF Networking 2 library and read that I need to include the server's certificate here. The client should be able to tell that the certificate is valid when it connects to the server, ...
1
vote
2answers
63 views

How can I see if SSL Certificate is Business SSL? [duplicate]

I'm trying to see the visual difference between Business SSL Validation and Standard Validation but I see no difference (or I cannot find a site which contains a Business SSL certificate) Is there a ...
1
vote
0answers
123 views

Strange TLSv1.2 Handshake

I noticed a strangeness in the TLS 1.2 Handshake and I don't know if I'm missing something. As you can see in this screenshot, the browser (Chrome) puts the value 0x0301 as version in the Record ...
1
vote
0answers
260 views

Designing a security and encryption strategy for MongoHQ

I'm trying to design the best strategy to achieve the following goals: Securing data-on-the-wire between my server and MongoHQ. Encrypting all data-at-rest with MongoHQ (possibly key values as ...
1
vote
0answers
142 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
1answer
321 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
1
vote
1answer
112 views

Any good tutorials / libaries for implementing TLS-SRP? [closed]

In this thread, Tom Ptacek explains what Password-Authenticated Key Exchanges are, and it got me really interested in them. If I'd like to start learning about how to build them into real world ...
1
vote
0answers
160 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

I've started thinking about how to approach analyzing my network traffic for information relating to SSL and browser usage for my web server farm. I also suspect there are some shadow (legacy, ...
1
vote
0answers
198 views

Should I tunnel multiple TCP connections through a TLS/SSL tunnel or use TLS/SSL for each connection?

I am developing an application that runs on Windows PCs. The application is able to connect to some kind of devices within a LAN. It can create multiple TCP-connections to the device it is connected ...
1
vote
0answers
472 views

Safe communication via rest api between two known servers

i would like to have some advice on the following scenario: I'm using kinvey as backend but because it doesn't provide the ability to run custom code i have set up another server. So basically when x ...
1
vote
2answers
958 views

Do i need SSL certificate signed by a CA for hybrid mobile apps?

I have just stepped into ssl domain and started exploring how to implement ssl. My question is i understand ssl certificates signed by CA actually allow the client or browser to validate that the ...
1
vote
0answers
361 views

Does ZRTP provide useful protection, given that the SAS is not verified?

Firstly, some important backstory. I'm producing a corporate version of an IM/VOIP/Screensharing client using the Open Source Jitsi. We are going to be using a central server and have already ...
1
vote
0answers
37 views

Using SSL on my sites for everything or just some things? [duplicate]

I have a server which provides a few services through the web, some of those services must be logged into to be able to use them. For these services I have implemented SSL using level 3 CACert ...
1
vote
2answers
664 views

What security issues are there when reading cookie with .htaccess?

I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
1
vote
1answer
303 views

spkac: what is the purpose of the challenge string?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
1
vote
0answers
124 views

Why not buy cheap SSL certificates? [duplicate]

Possible Duplicate: Is there any technical security reason not to buy the cheapest SSL certificate you can find? The comparison in Godaddy's website, makes it clear: they're just cheaper ...
0
votes
3answers
191 views

Is all RSA encryption now considered insecure? (Notably SSH and SSL)

Some of the leaks which emerged during/after Snowden concerned the fact that the NSA was paying the organization behind RSA a lot of money in order for them to systematically weaken the encryption by ...
0
votes
2answers
1k views

Which browsers are using openssl

It is asked in stackoverflow, but I suppose maybe it is more suitable to ask here. It is said that openssl are widely used, however, as far as I know, the most popular browsers seem not use openssl, ...
0
votes
3answers
136 views

Safety of Password Hashing Using bcrypt Done on Client Side

I am currently using a technique where I send the username/password in cleartext (using https) to the server, which then does bcrypt and compares to the db. Standard practice. It is considered safe. ...
0
votes
1answer
295 views

How does a Web Security Gateway analyse SSL Encrypted Traffic?

Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
0
votes
2answers
637 views

“Premium SSL” vs “Stanard SSL” certificates - Any reason why I would want a “Premium SSL”? [duplicate]

Possible Duplicate: What are the advantages of EV Certificate? besides the green URL bar and free security scan and whatnot. Our website does NOT accept any personal info other than email ...
0
votes
3answers
256 views

How Safe Are Encrypted Websites Really?

I was at a coffee shop and had to (I mean had to) check something on my bank account and another account. I figured since the two websites I was viewing were encrypted, and because my computer (I'm on ...
0
votes
1answer
145 views

Is this a secure method for authenticating clients?

I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy. Client sends a ...
0
votes
2answers
224 views

Avast https scanning

How does Avast's https scanning feature work? Is it basically a MITM attack? This feature was enabled in the 2015 version released a few days back
0
votes
3answers
147 views

Encryption and Layers understanding

If I'm right the SSL encryption take place in the application layer, but we can also have encryption in the Internet Layer. Why are we using both, and why sites that doesn't have SSL are considered ...
0
votes
2answers
652 views

SSL/TLS Protocol Description

It may seem crazy to you, but I wasn't able to find any detailed description of these security protocols on the web (except wikipedia). Can you point me out some documentation of the protocols ...
0
votes
2answers
189 views

What does 2^77.1 calls presented in a SHA1 attack mean?

Regarding the SHA 1 deprecation, I found this information here: http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx I know ...
0
votes
2answers
127 views

understanding the point of VPNs

I can't really understand the concept of VPNs, since we already have various secure transmission protocols. Isn't the point of VPNs that people using its 'channels' can send encrypted data to each ...
0
votes
3answers
5k views

How to sniff traffic on my wireless network?

For educational purposes, I want to see what packages are sent over my home wifi with VPN on and off. What program should I use for this?
0
votes
3answers
2k views

Hardened SSL ciphers for Nginx as AWS/Cloudfront Custom Origin

Based on recommendations, we recently attempted to harden our Nginx SSL configuration against BEAST/CRIME/BREACH attacks with the following stanza: ssl_prefer_server_ciphers on; ssl_ciphers ...
0
votes
1answer
384 views

How to get an exhaustive list of ciphers for TLS 1.0, TLS 1.1 and TLS 1.2

After TLS 1.0, there have been a number of RFCs e.g RFC 5932, RFC 6430 etc. Is there any place where one can get an exhaustive list of ciphers for each of the versions. Or at least an exhaustive list ...
0
votes
3answers
2k views

Firefox detected an invalid SSL certificate

February 14, 2012 UTC: Yesterday, I connected to a website of a VPN provider for which Firefox 8.0.1 on Windows 7 Ultimate x86-64 stated that its' SSL certificate is invalid. I saved the received ...
0
votes
5answers
146 views

Are most MiTM attacks done to impersonate web sites, or simply decrypt traffic?

The more I read about impersonating web sites the more I get confused. Does an attacker need the private key of the server in order to impersonate a website or does having the private key simply give ...
0
votes
3answers
8k views

How to prevent man-in-the-middle attacks beside of SSL?

I would like to discuss this scenario: There is a HTTPS service which responds with signed keys to an authenticated client. These signed keys can be used for another service to return very sensible ...
0
votes
1answer
226 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...
0
votes
2answers
483 views

How to safely collect bank account from website?

I want to collect bank account information from my customers on my website. I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or ...
0
votes
2answers
255 views

Convergence HTTPS - what are the Notary servers?

https://www.youtube.com/watch?v=Z7Wl2FW2TcA What are the "Notary" servers regarding convergence? Who is maintaning the "Notary" servers? Can someone please explain?
0
votes
2answers
72 views

Effective Free and Anonymous Web Form Encryption

I've got a website and I would like the users to be able to login securely but I don't want to spend any money on SSL / certificates and I would like to stay anonymous i.e. not give the certificates ...
0
votes
2answers
93 views

Printer SSL certificates [closed]

Is a printer SSL cert really necessary if you just print? I don't use https for any administration; just http. I got a vulnerability saying that my cert was out of date.
0
votes
2answers
55 views

Self signed certificate secure when just client sends sensitive information?

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for ...
0
votes
4answers
87 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...