SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

48
votes
4answers
13k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
3
votes
3answers
1k views

How safe is RSA generated public-private key pair?

If one has been using the same set of public-private key pair for quite sometime now, given his public key(which is public), can't an attacker find the corresponding private key for that public key by ...
2
votes
4answers
7k views

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. ...
4
votes
2answers
941 views

Is DIGEST-MD5 secure if done over HTTPS?

If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?: Digest access authentication is intended as a security ...
11
votes
3answers
2k views

Difference between Certificate Authorities

I've been wondering for a long time about is. There are many certificate authorities having different types of certificates. But even certificates of the same security level cost a lot more with one ...
19
votes
5answers
1k views

Is it alright to tell everyone your encryption information?

I have an account in an online banking system and they have the FAQ with something like this: How secure is the <Online Banking System Name>? Each page you view and any information ...
0
votes
3answers
893 views

Reply to SSL Handshake Request with a 302 Response

Is it possible to respond to an SSL Handshake request by sending back a http 302 redirect without making the browser mad? I would like to immediately redirect to a different site upon receiving the ...
4
votes
1answer
585 views

SSL protocol issues on OS X and iOS

I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message: ...
2
votes
2answers
809 views

What if a browser does not understand the secure flag of cookie

I have two questions related to the same: 1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
4
votes
1answer
319 views

Facebook user data encryption

In my country, Austria, a telecommunications data retention law will be executed starting at April 1. Internet carriers are required to store connection data (from which computer to which server), but ...
6
votes
2answers
3k views

Google Analytics on a secured site

Just read this article on Google Analytics and the risk of forged certificates, where it said: Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
1
vote
1answer
108 views

valid intermediate certs not in browser

Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
2
votes
3answers
4k views

How does bidirectional authentication using SSL work?

Let's say Alice wants to use a webservice on Bob. Bob is on bob.in.wonderland.com Alice opens a connections to bob.in.wonderland.com:443. Taken by DNS magic rabbit, Alice arrives on port 443 at ...
3
votes
3answers
321 views

Dedicated Server in Cloud Environment - SSL Remote Login vs Dedicated VPN

Thanks for taking your time to look into this question. Background I have my website hosted in a dedicated server in the cloud. The server is a Windows 2008 R2 machine. To publish I FTP files to ...
9
votes
2answers
2k views

Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?

I have read the TCP Connection Establishment on Wikipedia In brief the packets to start are SYN, with a (hopefully) random sequence number A from the client. SYN-ACK, responding, with A+1 and ...
2
votes
2answers
111 views

Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?

I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols? Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh) ...
5
votes
1answer
216 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
1
vote
2answers
173 views

SSL/TLS Certificate Authority supply policy

I would like to ask for recommendations regarding the following issue: As a company with a number of customers worldwide we supply our product to many different sites. We need to shape our policy ...
3
votes
2answers
204 views

self-signed certs that aren't the final certificates in the path

The X.509 spec makes frequent statements like this: (b) If certificate i is self-issued and it is not the final certificate in the path, skip this step for certificate i. How can you have ...
8
votes
2answers
609 views

X.509 certificate policies question

I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies. To quote from the X.509 RFC: In an end entity certificate, these ...
2
votes
1answer
522 views

X.509 certificate policy mapping question

So I'm a little confused how X.509 certificate policy mappings work. So let's say the following depicts my cert chain: root CA ---> intermediary CA ---> client cert Would the root CA have a ...
8
votes
3answers
829 views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
23
votes
6answers
14k views

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET: ...
3
votes
2answers
986 views

Is it less secure to use OpenDNS for banking accounts, SSH, Adsense account?

I have one WiFi connection in my house which I use for my iPad, phone and computers. I want to block adult sites, time consuming sites for every device that use the WiFi connection. So I came across ...
3
votes
2answers
426 views

Can a sniffer installed by user on his machine eaves drop on my application and reverse engineer it? (Fiddler 2 HTTPS Sniffing)

I have a web service and an application that connects to it. I do not expose the web service via any discovery protocol to the outside world. I have two security mechanisms: My software uses SSL and ...
3
votes
2answers
1k views

Secure communication between C# client and Java server, using certificates

I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on: server send RSA public key to ...
4
votes
1answer
224 views

Recommendations for hosting highly sensitive data

I am doing some investigation on hosting sensitive data. Mostly finance and fund data but at a personal level. This will be a secure website where users will be able to login and view their fund ...
6
votes
3answers
2k views

Best tool for testing an SSL connection in my application [closed]

I have developed an application that send binary data between a .NET client and Java server via TCP. I have recently implemented SSL for this connection and would like a way to demonstrate that it is ...
6
votes
4answers
1k views

How to keep secure while browsing on open wifi when SSL VPN is blocked?

After a recent visit to a hotel I was surprised to discover that they blocked access to my OpenVPN server. I often use this as a way to secure my internet traffic when I am on public wireless. ...
7
votes
5answers
4k views

Best practice to encrypt data in an Android application

I'm writing an application which recovers statistical data about a user. I'm still pondering about what would be the best way to encrypt the data. I haven't got any experience with mobile ...
3
votes
1answer
2k views

Why does Safari seem to be accepting an HTTPS connection every other browser rejects?

This question is inspired by a bug/issue in recent Linksys router firmware. Essentially, something has changed recently that's preventing HTTPS access to the web admin on current generation Linksys ...
2
votes
5answers
2k views

What are practical risks of http (not https) in server-to-server communications

What are some of the practical risks that come with a server-to-server connection over http (not secured with https/SSL)? There are no users involved, just a server-to-server connection from one ...
2
votes
1answer
2k views

Explanation of SSL handshake with certificate

I've read a lot of articles. The client uses the information sent by the server to authenticate the server. If the server cannot be authenticated, the user is warned of the problem that an ...
5
votes
2answers
1k views

If I send an email over SSL, will it always be transmitted over SSL?

This is largely a question of how MTAs and different components communicate. I'm curious that if I send an email using SMTP over SSL to my MTA, can it's next jump to the next MTA or MDA be insecure? ...
4
votes
2answers
5k views

Confusing about Ephemeral Diffie-Hellman

1 Does Ephemeral Diffie-Hellman support authentication? Quote from www.rsa.com/products/bsafe/documentation/mesuite21html/dev_guide/group_EPH_DH.html Ephemeral Diffie-Hellman does NOT provide ...
14
votes
2answers
1k views

SSL fingerprint inconsistency: what does it mean?

I apologize if this is not the best place to ask my question on the stackexchange network, I couldn't figure out where to get enough attention and be relevant. Facebook provides a SSL host, it can be ...
11
votes
4answers
4k views

Why is faking SSL certificate difficult?

In the news that comes from Iran, you hear that Iran has succeeded in making fake ssl certificates, so that they can find people's gmail account credentials. Some analysts are saying this is possible ...
13
votes
4answers
4k views

Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?

DuckDuckGo is a search engine that has a Tor Exit Enclave and hidden service. This site is focused on the safe, secure searching of its users. Since DNS is not used in Tor, it appears that HTTPS is ...
0
votes
1answer
286 views

id-ce-cRLDistributionPoints ASN.1 / DER encoding question

I have a file - test.pem - with the following contents: -----BEGIN CERTIFICATE----- MBIwEKAOoAwwCqMIMAZhBEFCQ0Q= -----END CERTIFICATE----- openssl asn1parse -inform PEM -in test.pem -i returns the ...
0
votes
3answers
2k views

Firefox detected an invalid SSL certificate

February 14, 2012 UTC: Yesterday, I connected to a website of a VPN provider for which Firefox 8.0.1 on Windows 7 Ultimate x86-64 stated that its' SSL certificate is invalid. I saved the received ...
2
votes
1answer
519 views

question about implicitly tags in ASN.1

From the X.509 RFC, in the "Implicitly Tagged Module" section: CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint DistributionPoint ::= SEQUENCE { distributionPoint [0] ...
6
votes
5answers
2k views

Which is the most vulnerable to MITM attacks, SSL or SSH?

Which is the most vulnerable to MITM attacks, SSL or SSH? Here's the scenario, you have 20 minutes to set up a web proxy like this: Laptop -> Chrome Browser -> Web Proxy -> Internet You must secure ...
7
votes
2answers
2k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
2
votes
1answer
2k views

My S/MIME certificate (created with OpenSSL) does not match my email address

I created a certificate with OpenSSL and following commands: openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=hostname' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem ...
1
vote
2answers
4k views

What needs to be done on a Citrix Netscaler to protect from SSL Renegotiation attacks?

I'm under the impression that the TLS/SSL renegotiation hack has been fixed. I'm not sure if the software has to be deployed on the server side, client side, or both. Based on this blog, TLS ...
1
vote
3answers
827 views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
0
votes
1answer
293 views

Are export ciphers allowed in DTLS 1.0?

In RFC 4347 for DTLS, I am unable to find the cipher list to be supported. The RFC mentions it as a set of changes from TLS 1.1 (RFC 4346). TLS 1.1 prohibits use of export ciphers. Are export ...
1
vote
3answers
250 views

Is email between 2 parties secure if both mailboxes are on the same server and both clients use SSL?

Sorry if this is incredibly basic, but I'm not very familiar with how SMTP works. I have a mail server (running Postfix with Dovecot) with an SSL cert from a well-known/accepted CA installed and ...
4
votes
2answers
4k views

Recommended Cipher Suites for TLS 1.0, 1.1 and 1.2

There are a lot of cipher suites defined in the in the specifications itself of TLS 1.0, 1.1 and 1.2. And furthermore, there exist RFCs which add even more cipher suites to a specific version (e.g. ...
2
votes
1answer
451 views

Does client certificate authentication demand more server-side entropy?

We have a secure web service running Apache that requires client certificates for access. This service has a problem with running out of entropy. We have several other sites that use TLS that get ...