SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
3answers
111 views

Is it secure to be using LDAP, or is LDAPS the only secure option?

I am currently using an LDAP setup. I am wondering if it is secure from Man-in-the-middle attacks or other vulnerabilities?
1
vote
0answers
37 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
0
votes
1answer
45 views

Can two parties sign each other's certificate and exchange without CA?

Is possible (and practical) for two users to create their own self-signed SSL certificates, exchange these certificates (perhaps in a face-to-face meeting), and then communicate with each other ...
0
votes
3answers
91 views

Multiple SSL server certificates

I am sort of new to SSL. During a SSL connection establishment, I see that the server is sending multiple certificates. Can someone help me to understand why the server is sending multiple ...
29
votes
3answers
1k views

Why do WordPress installations retrieve the crypto secrets remotely on installation?

It seems that WordPress retrieves all the crypto constants remotely (via HTTPS): // setup-config.php $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' ); Are there ...
4
votes
1answer
569 views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is ...
1
vote
2answers
91 views

VPN over HTTPs for a web service only

I have a web service (PHP & MySQL on Ubuntu 12.04) running in a corporate intranet. I have also connected it to internet through a firewall letting incoming connections on HTTPs only (port 443). ...
1
vote
1answer
51 views

what harm can a malicious ca do?

If ca's act in the interests of an eavesdropper, what is the worst they cold do? I guess they can decrypt traffic not using perfect forward secrecy and impersonate the server. Is this the case?
0
votes
3answers
51 views

Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why?

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement? This is between non browser client ...
49
votes
9answers
10k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
2
votes
3answers
4k views

Block the HTTPS version of a website

I would like to block some websites from their HTTPS version and allow them on HTTP. The main websites involved are Youtube and Google Images/Videos. I am using K9 Web Protection on each computer, and ...
0
votes
1answer
62 views

SSL Mutual authentication Fails

When I try to establish a Mutual authentication between server and client, I am getting the errors below. The timing between the server and client is exactly same and also the certs are proper in ...
2
votes
3answers
2k views

How do I diagnose client-side SSL errors?

Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
2
votes
3answers
1k views

Is OpenSSL secure enough?

We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries. It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
4
votes
1answer
87 views

How did SSLv3 get AES?

IANA maintains a registry of TLS cipher suites at TLS Parameters. TLS provides TLS_RSA_WITH_AES_128_CBC_SHA, its value is {0x00, 0x2f}, and its available in TLS 1.0 and above. The AES cipher suites ...
3
votes
1answer
87 views

What stops an attacker from tampering with data sent during the SSL/TLS handshake?

On this page, it says the first thing sent is the SSL settings, such as version, and cipher settings. If the attacker, say, wanted to change the encryption method used, what makes this not possible?
1
vote
1answer
72 views

How important is a dedicated SSL certificate vs. shared for eCommerce?

At my work, we've been using Network Solution eCommerce for many years now, and they have been working very well for us. However, as the years go on, their services become more and more outdated. As a ...
0
votes
1answer
35 views

Diffie-Hellman certificate verify message

On the RFC 6101, about "Certificate Verify", I read that: "This message is used to provide explicit verification of a client certificate. This message is only sent following any client ...
3
votes
3answers
133 views

When downloading from an https web page - will the download also use ssl?

If I click on a download link on a page that uses ssl, will the download also use ssl? If the answer is not (or: sometimes yes, sometimes not) - is there any way I can force it to be protected? I'm ...
2
votes
3answers
55 views

Are Extended Validation certificates any more secure than regular ones?

Or are they just an attempt to get you to pay more money to a CA because it tells your browser to show the address bar in green with your organization's name? Also, what are the technical details ...
0
votes
1answer
32 views

Is it possible to create a SMIME only PKI that *can't* be used for SSL?

Assume I have a Root CA that I want to share with hostile untrusted 3rd parties. Then constrain this root using specific EKUs at the root. OID=1.3.6.1.5.5.7.3.4 ; Secure Email Next, ...
12
votes
2answers
968 views

Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?

I've noticed that websites start to use 256-bit symmetric encryption, but often still end up using 2048-bit RSA keys. http://www.keylength.com/en/3/ The link above displays the ECRYPT II ...
1
vote
2answers
39 views

SSL Server Certificate optional

In RFC 6101 (Of SSLv3), In page 22 ServerHello Certificate is marked with * which means optional or situation-dependent messages that are not always sent. It means that Certificate is optional in ...
1
vote
1answer
36 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
0
votes
1answer
104 views

Can HSTS be defeated?

As I know HSTS is mainly implemented to mitigate famous sslstrip attack in which browser is forced to use ssl when connecting to particular site. And I think it also prevents user to proceed to site ...
1
vote
2answers
39 views

HTTP Header disabling non-SSL (or TLS) content on this page

Is there an HTTP Response header that disallows any non-SSL content from being displayed on the current page? The idea is some times external content that needs to be on the website (cough, ad ...
4
votes
2answers
4k views

Recommended Cipher Suites for TLS 1.0, 1.1 and 1.2

There are a lot of cipher suites defined in the in the specifications itself of TLS 1.0, 1.1 and 1.2. And furthermore, there exist RFCs which add even more cipher suites to a specific version (e.g. ...
63
votes
4answers
32k views

What clients are proven to be vulnerable to Heartbleed?

On several pages, it is re-iterated that attackers can obtain up to 64K memory from the server or client that use an OpenSSL implementation vulnerable to Heartbleed (CVE-2014-0160). There are dozens ...
0
votes
1answer
94 views

How is the new “Dyer” malware bypassing SSL?

Apparently the new Dyer malware is bypassing SSL to swipe bank credentials. I read that it's using "process hooks" to hook the browsers and see the data BEFORE it is encrypted and sent to the bank ...
30
votes
5answers
4k views

Is there any way for my ISP or LAN admin to learn my gmail address as a result of me logging into gmail's web interface through via their network?

The title says it all, really. I'm Alice, and I want to login to Gmail's web interface through my browser. Ike, the internet service provider, and Adam, the local network administrator, would like to ...
3
votes
2answers
124 views

Phone Applications having SSL/TLS enabled behind the scenes?

Please Note: This question is slightly based on me being a tin foiled hat with the issues that has arisen from the leaks, documents, and questioning trust thanks to Edward Snowden. Thanks to adding ...
1
vote
1answer
38 views

Protecting encryption of outdated software with a server

I have a 1st generation iPad, and I usually use it for web browsing when I'm home. The 1st gen iPad can't run newer versions of iOS (I'm stuck with iOS 5). I went to a website that tells if your SSL ...
0
votes
0answers
71 views

Socket.IO & WebSocket security - query certifcate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
1
vote
2answers
47 views

Security risk of Microsoft AD Certificate Services?

We have an internal CA server for our domain located at http://cert_srvr.local.domain/certsrv/certrqxt.asp. This server runs Microsoft Active Directory Certificate Services. When I went to the ...
0
votes
1answer
133 views

Security risk among shared wifi users [duplicate]

I understand that the shared users on a wifi can see each other's HTTP traffic using proper tools. Is it possible for shared users to read HTTPS traffic or encrypted traffic like TOR ?
0
votes
1answer
110 views

Mixing green (EV) ssl certificate with non EV certificate

We have a green (EV) SSL certificate for our site and images are fetched from the same domain (https). Currently we are planning to change the images domain (for performance issues) and put them in a ...
0
votes
1answer
60 views

Server SSLv2 enabled on non-webservers

Using Nessus I'm scanning our internal network for vulnerabilities and exploits. I've found a large number of instances where SSLv2 is enabled and is as a result, being flagged as a vulnerability. I ...
0
votes
1answer
72 views

Why middleman cannot capture the encryption key of https/tor traffic? [duplicate]

When we use Tor or https traffic , the encryption- decryption key has to be exchanged between the browser and the website server. Why somebody who can capture entire traffic , say ISP or somebody who ...
1
vote
1answer
153 views

Crazy Finished Message in TLS

I've tried to understand the content of the Finished Message of TLS. I'm using wireshark to capture the traffic between my browser and the internet. I noticed a "stangeness" when the chosen ...
0
votes
1answer
86 views

Why has Convergence stalled out? [closed]

Convergence is a well-thought out system to replace certificate authorities built by Marlin Moxiespike back in 2011. Since it's debut, it seems to have largely stalled out, with no additional major ...
32
votes
5answers
4k views

HTTPS still NSA-safe? [closed]

There are exerpts, that say that using https can be broken by the NSA by now. So is https still a solution for secure web-browsing? source: ...
0
votes
2answers
106 views

Is the lack of https reason enough to abort form submission?

Preamble: Am in awe about the quality of both questions and answers on https / SSL on this site. My humble question below pales in comparison. Both on professional and amateur websites I've ...
0
votes
0answers
24 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
4
votes
4answers
1k views

Is online banking more secure on iOS than a desktop computer?

Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
24
votes
4answers
2k views

Manually adding 's' to 'http'

I did a Wireshark capture of my login into a drupal-based website. The website does not use https. And so, quite obviously, I was able to capture my username and password in plain text by simply ...
1
vote
1answer
53 views

Certificate pinning in a browser

I am trying to understand certificate pinning. Google started adding a whitelist of CA certs that they use for their certificates and if a cert for a google service is issued outside of this list ...
2
votes
1answer
3k views

Openssl generate different type of self signed certificate

Does anyone know how to use openssl to generate certificate for the following public key type: 1) DSA - For DHE_DSS key exchange. 2) Diffie-Hellman - For DH_DSS and DH_RSA key exchange. 3) ECDH - For ...
1
vote
1answer
440 views

Transparently authenticating users or devices on mobile devices

I have an interest in using EAP-TLS to authenticate both users and devices separately on mobile devices (phones, iPods, tablets, etc.). My issue is how to delineate between user authentication and ...
3
votes
1answer
547 views

ECDH and Forward Secrecy

I just read about ECDH and while getting a overview over the process, I noticed that this key exchange method does neither provide any forward secrecy, nor does it protect against replay-attacks, ...
0
votes
0answers
102 views

cURL cert validation with curlopt_cainfo not working

I want to validate my SSL certificate each time I run API calls. I've been following this guide: http://artur.ejsmont.org/blog/content/how-to-properly-secure-remote-api-calls-from-php-application ...