SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

2
votes
1answer
368 views

What security technology do I need to protect my SSN database?

I'm designing a web application. I need to make sure all my customer's SSN data is secure. Now I know HTTPS with SSL, I'm wondering what are its weaknesses? What else I need to provide a perfectly ...
6
votes
2answers
15k views

Javascript and jQuery not secure over https

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure. I'm using ...
2
votes
3answers
194 views

What is the worse that could happen if a government wanted to interfere with a CA?

In our time of SOPA, PIPA and ACTA, I was wondering what could happen if a government wanted to remove the certificate of a website ? CA are companies, so they would have to obey to instructions from ...
7
votes
2answers
6k views

How to thwart sslstrip attack?

I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
2
votes
2answers
378 views

HTTP + HTTPS + One Time Pad/stream cipher

I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
3
votes
1answer
482 views

Can SSL server choose a session ID '0' in the 'Server Hello' message?

Can s SSL server in response to 'CLIENT_HELLO' request choose a NULL value for the session ID in its response, SERVER_HELLO? Is it OK?
4
votes
1answer
844 views

X.509 algorithm identifier parameters vs. extension values

From the X.509 specs: AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } ...
3
votes
1answer
1k views

Why doesn't asn1parse parse all DER encoding strings?

I have a file - crl.txt - that contains the following: MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw= It's from one of the extensions in a particular X.509 cert. Why ...
4
votes
1answer
407 views

Sniffing IMAPS traffic! Are there any tools for this?

I've got a problem where someone has implemented a custom IMAP Server. I need to write a custom application to get a list of emails, and fetch messages. Problem is, every library I've tried to use ...
6
votes
1answer
2k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
4
votes
1answer
1k views

Why MA-SSL has been introduced?

If my knowledge is correct with respect to simple SSL, Mutually Authenticated-SSL has the advantage that both end parts are authenticated one to another: Not only the Client endpoint knows that ...
3
votes
1answer
536 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: ...
3
votes
1answer
1k views

anti-CSRF tokens in HTTPS environment

Does it really make sense to use anti-CSRF tokens in a web application that is accessed by HTTPS only? If yes, then what are the possible ways to attack such a web application if anti-CSRF tokens are ...
7
votes
3answers
285 views

Would using distinct IP addresses help support browsers with older SSL implementations?

We have a site with two wildcard certificates: *.foo.com and *.bar.foo.com. All of our subdomains resolve to the same IP address. Newer browsers work fine with this, but IE7, for example, does not. ...
33
votes
4answers
25k views

What certificates are needed for multi-level subdomains?

I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy. Here's what I need to secure: ...
3
votes
2answers
4k views

Can Cookies Without the Secure Flag be Stolen, even when only accessed via HTTPS?

Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set. Suppose the site is https://www.example.com. http://www.example.com does not show up, also ...
4
votes
2answers
2k views

Next Microsoft Patch Tuesday include BEAST SSL fix

http://thehackernews.com/2012/01/next-microsoft-patch-tuesday-include.html I thought the vulnerability that BEAST uses is already fixed on "Microsoft" side, no? Can someone please clarify this?: ...
10
votes
1answer
2k views

If an attacker is intercepting all of my traffic, will he be able to listen on my VPN session?

If I am a remote user, connecting to my firm from home, using IPSec VPN tunnel or through SSL, and an attacker is intercepting all of my traffic, will he be able to watch my VPN session on the clear ...
3
votes
1answer
1k views

parsing the id-ce-keyUsage extension in X.509 certs

I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows: ...
6
votes
2answers
683 views

Why would the downloaded certificate show a different end-date as compared to the same certificate when viewed online?

This is sort-of a follow-up to my previous question What fields in a suspicious certificate should I look at? Chrome just presented the warning icon against the certificate presented by ...
-1
votes
1answer
100 views

Why are there soo many HTTP connections when using Convergence?

I installed Convergence on Firefox 9.0.1: http://convergence.io/ but... after I installed/enabled it when I visit a HTTPS only-site there are many-many HTTP traffic to the notary servers. Why? ...
0
votes
2answers
254 views

Convergence HTTPS - what are the Notary servers?

https://www.youtube.com/watch?v=Z7Wl2FW2TcA What are the "Notary" servers regarding convergence? Who is maintaning the "Notary" servers? Can someone please explain?
10
votes
3answers
4k views

Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?

I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
6
votes
2answers
2k views

OCSP and CRLs: Specified in CA or client certificate?

Here's an example PKI setup: * Root CA (offline) * Issuing CA * Client 1 * Client 2 I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
8
votes
3answers
707 views

Public wifi security protocols

I should apologise first- this post could seem a lot to ask for, but I am starting to go around in circles. I am interested in securing my laptop for when I use public wireless hotspots, as I am a ...
1
vote
3answers
345 views

What security protocols provide point-to-point confidentiality?

Am I right in thinking that VPN doesn't protect until you're out onto the external network (assuming you're connecting from within an internal network)? Or does VPN provide confidentiality from the ...
0
votes
2answers
976 views

Protecting yourself against DNS spoofing?

Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot ...
2
votes
3answers
261 views

Help with SSL teaching material

I am taking a course on security next month. As the concepts of SSL/TSL are bit hard. I am looking for a nice way of presenting it to my students. They are Compsci undergrads. It would be nice to ...
4
votes
1answer
3k views

When will the webbrowsers have TLS 1.2 support? [closed]

https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.2_.28SSL_3.3.29 and http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ when will the webbrowsers have TLS 1.2 support?? ...
11
votes
5answers
4k views

Does HTTPS Everywhere defend me against sslsniff-like attacks?

http://www.thoughtcrime.org/software/sslsniff/ If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
9
votes
4answers
2k views

Is accessing bank account on the internet really secure?

Before I ask my question, I would like to make sure that I understand the settings correctly. So, the given: A client, using some web browser (firefox, for instance) - the Client The bank server - ...
4
votes
3answers
208 views

Proper way to obtain CA certs for verification

I want to securely connect to an API, but I'm not sure how I should obtain the CA cert for the verification step. I've seen some people get the certs using e.g.: openssl s_client -connect ...
7
votes
1answer
3k views

Should I regenerate new SSL private key yearly? [duplicate]

Im' renewing my certificate every year. Since I have to make a CSR, should I also renew my key pair at the same time, or is it ok to get a new cert with the same key ? Please supply any security ...
3
votes
2answers
724 views

Secure Mobile Payments using HTTPS Web App

I'm hoping an expert with PCI compliance knowledge can help answer this question. We're looking at integrating mobile payments with our application which is HTML5-based for cross-platform reasons. ...
4
votes
6answers
206 views

Archive encrypted traffic, for later decryption attempts?

I am concerned about sending long-term sensitive information over SSL. Someone who does not have the private key could record SSL traffic (with WireShark, Fiddler or some such) and store it for ...
6
votes
1answer
709 views

How has TLS renegotiation been fixed?

I've read RFC 5746 on the TLS secure renegotiation extension. However, I don't understand how it fixes the problem. Client and server are required to include the verify_data from the previous ...
4
votes
2answers
702 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
3
votes
3answers
193 views

Best approach for making an app that connects to sensitive information

I'm gonna be writing an app that connects to a server with sensitive information and one of the main requirements is that only my app will be able to make the connection. There is no user supplied ...
8
votes
1answer
253 views

Why are website certificates secure?

I understand how HTTPS connections work, and I also understand they they require a certificate to know that the secure connection you have is with the right server (and not someone pretending to be ...
3
votes
1answer
338 views

Security for a low latency online multiplayer game

I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
5
votes
3answers
1k views

How to roll my own security mechanism - avoid SSL

i'm looking at implementing my own security mechanism rather than using ssl due to ssl being 'hopelessly broken' http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysis/ and also because it is ...
5
votes
2answers
341 views

System for Mutual authenticaion and confidentiality

I am looking for a protocol where there needs to be mutual authentication between client and server. For example server should connect to a particular client only. That is client should authenticate ...
2
votes
3answers
1k views

HTTPS Apache2 Information Leakage

Hello IT Security! I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com. I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com. ...
2
votes
2answers
2k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
31
votes
6answers
16k views

Trying to make a Django-based site use HTTPS-only, not sure if it's secure?

The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
4
votes
1answer
4k views

openssl verify signature

For S/MIME, I now know I can verify PKCS#7 detached signatures with: openssl smime -verify -in detachedsign.pem -content content.txt But what about non-MIME messages? So if I sign the message ...
1
vote
1answer
381 views

How to perform eavesdropping [closed]

How eavesdropping is performed? Can I perform eavesdropping by sitting on client side? Can eavesdropping be done in both wired and wireless transmission too?
5
votes
9answers
4k views

What is the best way of securing a website logon without SSL or preshared keys?

Today I sniffed some unencrypted wlan traffic during class and I found quite a few passwords by a simple search for "pass" and "user" in wireshark. Turns out about half the sites we use for school ...
10
votes
5answers
8k views

Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP

The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well. In addition there are a ...
1
vote
3answers
4k views

Facebook login on HTTP? [duplicate]

Possible Duplicate: Is the Facebook login form using SSL without https in the URL? If you access http://www.facebook.com/, in the top right side there is the login section. You can enter ...