SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
18
votes
3answers
8k views
What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?
I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services?
I don't understand email protocols in details, but as far as I know email traffic is ...
15
votes
1answer
539 views
TLS: RC4 or not RC4?
I was reading another interesting article by Matthew Green today, saying that
if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop
As far as I'm aware ...
2
votes
2answers
83 views
Should I use SSL on my database server?
Say I have a website and a database, both hosted on rackspace.
Since all communication with the database is from the web server and not the internet, is it safe to assume that I do not need SSL ...
1
vote
1answer
130 views
Web Applications (http): Don't get how token based authentication is secure
See something like this:
http://stackoverflow.com/questions/10826293/restful-authentication-via-spring/10864088#comment21706215_10864088
Or more specific:
Token-based authentication - Securing the ...
3
votes
4answers
124 views
Secure single page in a site if site is hacked?
I've been tasked with trying to find a way to secure a single page in our site if somehow, a hacker gets access to our files. This "single page" will be run on a different server.
Requirements:
...
5
votes
2answers
4k views
Configure SSL to prefer RC4 ciphers over block-based ciphers - BEAST
Our PCI scanners just informed us that we have BEAST (Browser Exploit Against SSL/TLS) Vulnerability
Apparently, the remediation is as follows:
Affected users should disable all block-based ...
10
votes
2answers
1k views
What vulnerabilities could be caused by a wildcard SSL cert?
In a comment on this answer, AviD says:
"There are numerous security issues with wildcard SSL certs."
So, what are the problems? I understand that the same private key is being used in multiple ...
6
votes
3answers
307 views
How secure is HTTPS with weak ciphersuites?
Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
3
votes
1answer
265 views
Use client SSL certificates as web application authentication
I'm working on a web application with simple API needing authentication. For my application nature, users have two RSA keys, for signing and encrypting messages. My protocol works based on it. The ...
3
votes
1answer
249 views
Choosing an SSL certificate provider
Does it make any difference which provider I get my SSL/TLS certificate from? In particular, what are the pros and cons getting an SSL certificate from Verisign vs getting one from Thawte? Which one ...
0
votes
0answers
76 views
Extended validation SSL certificates [closed]
Where can i buy the cheapest EV SSL certificate?
By now the cheapest one i've found is Godaddy.
But i want know if there are a cheaper one.
5
votes
5answers
356 views
How risky is it not to install ssl?
I would like to have more insight about when a server should install ssl, in particular when it is worth the money to pay for a valid certificate. As my clients often have little understanding of why ...
1
vote
1answer
111 views
2
votes
1answer
130 views
What is the cost of SSL encryption?
So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an ...
3
votes
2answers
90 views
Why are SSL certificates valid only from a certain date?
Each SSL certificate is valid starting from a specific date and up to the expiration date.
What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
2
votes
1answer
184 views
Windows Update - Interception
I'm trying to monitor the HTTP requests/responses made when performing a Windows Update.
I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp:
netsh ...
3
votes
2answers
142 views
Entering sensitive information into non-SSL site that uses secure iFrame
There is a website that tenants can use to pay their rent. That website uses an http address but apparently uses a third-party product, which embeds an iframe into the page. The source of that iframe ...
4
votes
4answers
320 views
Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was:
CA with RSA keys capable of signing RSA and EC CSRs
CA with ...
1
vote
1answer
145 views
What elliptic curves are supported by browsers?
Wireshark'ed Firefox 3 request. Their names are nowhere documented.
Elliptic curve: secp256r1 (0x0017)
Elliptic curve: secp384r1 (0x0018)
Elliptic curve: secp521r1 (0x0019)
What are the supported ...
3
votes
1answer
107 views
What are those nul bytes doing in Certificate Subject CN?
While doing some research with SSL certificates, I found some weird certificates containing nul bytes in their Subject field. One example is www.refah - bank.ir (did the Iranian government fake this ...
4
votes
1answer
138 views
How powerful are top Verisign executives?
I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a ...
0
votes
1answer
100 views
What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?
Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange?
Can the server be configured to use weak key sizes for ...
-1
votes
2answers
131 views
What is ASN.1 usage in SSL protocl and What's the risk of using it?
I heard that ASN.1, which is part of browser SSL libraries, introduces the potential risk of compromise our system even if we use no-script. but what is ASN.1 exactly doing? Why do we need to use ...
2
votes
3answers
661 views
HTTPS Apache2 Information Leakage
Hello IT Security!
I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com.
I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com.
...
3
votes
4answers
2k views
How are Chrome and Firefox validating SSL Certificates?
How are Chrome and Firefox validating SSL Certificates?
Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?
2
votes
1answer
127 views
How to set “Not Before” value to past when creating certificate request
We have lots of embedded TLS clients on the field. TLS Servers must be authenticated.
Because long power cuts may reset clock of those devices, we have requirement to use certificates with validity ...
1
vote
1answer
72 views
How effective is Activesync Certificate revocation using CRL or OCSP
We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords.
One way to remedy an account lockout issue is to issue and deploy certificates ...
5
votes
4answers
153 views
Threat model for huge warnings on untrusted SSL certificates and no warnings for plain HTTP connections?
Why do untrusted/expired SSL certificates get such a huge warning in modern browsers even with "DO NOT VISIT THIS SITE!" messages, whereas a regular HTTP connection, which is more prone to ...
41
votes
10answers
2k views
Why do we not trust an SSL certificate that expired recently?
Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
6
votes
2answers
1k views
What is the “openssh-blacklist” package? Is it related to the Debian OpenSSL bug?
What is the "openssh-blacklist" package? Is it related to the Debians OpenSSL bug?
0
votes
3answers
134 views
SMTP and SSL/TLS
If I understand correctly, communication between SMTP servers may be encrypted but is not required. Because it is optional, does it really have benefits? When server A connects to server B, both of ...
0
votes
2answers
57 views
How can I set up signed downloads?
Scenario
I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
-1
votes
3answers
57 views
Secure transmission for desktop applications
Suppose I have a desktop application that does password hashing for login authentication.
Is the password normally hashed before it travels to the wires or does it travel to the wires first in plain ...
3
votes
1answer
92 views
Certification authority only for certain domains
Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
8
votes
4answers
380 views
Can URLs be sniffed when using SSL? [duplicate]
I know that http requests can be sniffed, so sniffer can see the requested URL from the victim. So 2 days ago I my bank made me a web-account to see, send money etc...
The thing I saw is my session ...
2
votes
2answers
72 views
Actual issue? Phone switches from 3G to router makes session switch from https to http
I heard that a security issue exists in some cases when a mobile phone has:
Connected to a website via https via 3G
Connects to a router
I'm told that that in this particular scenario the router ...
6
votes
2answers
242 views
Is IP restriction enough or should I SSL my web authentication?
I want to connect to my home install of phpmyadmin. I restricted the connection for this to my 2 IPs.
But I don't really understand this whole OSI layering. I do know that the IP is saved in the ...
2
votes
2answers
309 views
HTTPS verification failed - get certificate information iPad/iPhone
I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
11
votes
4answers
6k views
What ciphers should I use in my web server after I configure my SSL certificate?
There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list.
...
0
votes
1answer
127 views
How configure tomcat 7 SSL to use AES-NI?
My server has AES-NI and I would like tomcat 7 to make use of this but I am not really sure how to make that happen or where to even start looking. I am quite familiar with tomcat administration, and ...
2
votes
3answers
88 views
Is password authentication worse that signed messaging if done over SSL?
Let there is a public API:
HTTP-based
via SSL
there are no browsers, just connections between custom written programs
The first authentication scheme that came to my mind was... client signs their ...
2
votes
2answers
286 views
Why is this SSL handshake failing with iPad? [closed]
I do have a tomcat server that listen on an SSL socket with TLS protocol. When connecting with all desktop browser everything work right. When connecting with Safari on iPad, the SSL handshake fails.
...
3
votes
3answers
129 views
Is it safe to mix authentication methods?
Is it a good idea to "combine" authentication methods?
Example we can use username/password method to authenticate a user from a server.
What if we used this as a first authentication step to get ...
1
vote
2answers
110 views
What security issues are there when reading cookie with .htaccess?
I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
4
votes
2answers
4k views
Advantages of client certificates for client authentication?
I'm no security expert, so please just ask in a comment if I haven't made my question clear enough for an answer.
The Scenario
We have a server running WCF services, and a number of clients ...
8
votes
3answers
269 views
How practical/important is the Lucky Thirteen TLS attack?
I was reading this article which talks about a new attack against TLS being called Lucky Thirteen. It claims to allow repeatable MitM attacks against HTTPS connections.
It's described as being fairly ...
1
vote
1answer
93 views
Pure SRP authentication without TLS
IF using a SRP for client/server application authentication without TLS. Will it be vulnerable to man-in-middle attack, since if using SRP, the public info doesn't really useful to calculate the ...
0
votes
2answers
114 views
OpenID without SSL certificate
Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed?
Just to make things clear, ...
2
votes
6answers
202 views
Protecting an admin area from the public
We are about a month away from launching a pretty important site, which comes with an admin console to help us manage the site.
Now I'm not very interested at just leaving the admin out in the open ...
0
votes
1answer
51 views
Can IE be made to imitate the behavior of Chrome's KeyGen element?
Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element?
Assistance getting Safari to work with this optional HTML5 spec would be ...
