SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

0
votes
2answers
63 views

Are SSL encrypted communications through a company network safe?

If I'm using Skype, Facebook, or another type of communication at my work, can the network administrator see my Skype and Facebook conversations, although its encrypted with SSL? I found this text: ...
0
votes
1answer
59 views

Why do I need a certificate to pin an SSL connection with AF Networking 2?

I am using the AF Networking 2 library and read that I need to include the server's certificate here. The client should be able to tell that the certificate is valid when it connects to the server, ...
1
vote
3answers
140 views

What version of TLS does any web browser use when connecting to server where all SSL Protocols are enabled?

All (almost all) web browsers have TLSv1.0 enabled by default, moreover TLSv1.1 and even TLSv1.2 can also be enabled by default. What version of TLS will be used to connect to web server (e.g. ...
43
votes
5answers
3k views

How does a country block its citizens from accessing a site?

Following Turkey's recent social site blocks, I am wondering how can you efficiently accomplish that as a country. Similar for a big company. Blocking IPs → easy to circumvent, (proxys, tunnels, ...
3
votes
2answers
203 views

How is HTTPS Everywhere leaking my Twitter session from an incognito window?

I manage a couple of twitter accounts for businesses/websites that are separate from my personal account. For simplicity, I prefer to log in from an incognito window so that I don't need to log out of ...
14
votes
3answers
4k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
0
votes
1answer
44 views

How does the Subterfuge toolkit bypass SSL? [closed]

As the title says, does anybody know how Subterfuge bypasses the SSL layer?
2
votes
1answer
148 views

In SSL/TLS, what part of a data packet is Encrypted and Authenticated?

I'm trying to wrap my head around the Application Data record that carries secured traffic. I understand TLS/SSL is a "authenticate-then-encrypt" protocol, which means an HMAC is calculated over the ...
1
vote
2answers
56 views

Proving SSL need

I need to prove the need we have to install SSL certificates in our webservers. For that I've been requested to try obtaining sample credentials (in lab enviroment) during a http authentication ...
4
votes
1answer
180 views

WebRTC P2P SSL - Where are the keys generated?

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, ...
24
votes
3answers
17k views

What's an easy way to perform a man-in-the-middle attack on SSL?

I'd like to perform a man-in-the-middle attack on SSL connections between clients and a server. Assuming the following: I've got a certificate that the client will accept, via poor cert validation ...
0
votes
0answers
19 views

SChannel SSL 3.0 error - OWA - Windows Server 2008 R2 [migrated]

I am receiving errors in the event log with ID numbers 36888 and 36874. The errors state "The following fatal alert was generated: 40. The internal error state is 1205." and "An SSL 3.0 connection ...
2
votes
1answer
55 views

Finding the type of SSL certificate with cURL

This is a part of curl's verbose output when connecting to the HTTPS site of Google. * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * ...
8
votes
2answers
678 views

HTTPS login vs MITM attack

http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html My question is, if the threat is that someone controls your internet connection and can serve up bad login pages, couldn't ...
1
vote
2answers
55 views

How Web-proxy and Virtual-Hosting are complications for HTTPS?

While studying HTTPS and related transport layer security protocols(SSL/TLS), I came to know that HTTPS suffers from two complications - Web-Proxy and Virtual-Hosting. I can understand how ...
6
votes
2answers
2k views

How to detect the NSA MITM attack on SSL?

As Bruce Schneider reported here... https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html ...the NSA reportedly performed a MITM attack on a company in brazil and decrypted their SSL ...
74
votes
2answers
37k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
2
votes
1answer
78 views

REST security using only API key and SSL

I am looking to build a number of simple REST web services where: they only need to be called by server-side clients (i.e. no mobile/javascript/desktop) they are only accessible by HTTPS (no ...
0
votes
1answer
92 views

Accepting an untrusted security certificate?

What is the risk of accepting an untrusted site security certificate in your browser if you're not entering any data, but merely browsing the site?
10
votes
1answer
455 views

How can SSL vendors limit the amount of servers they can be installed on?

I've recently purchased an SSL certificate, and it says that it's limited to three servers. Surely if I have the key and certificate on multiple servers (more than 3), the SSL will still be valid? Can ...
1
vote
3answers
105 views

Protecting form post values when on https

I am dealing with a multi-step form, and I need to pass information from step 1 to step 2, then from step 2 to step 3, and so on. Step 1 contains a membership number and ID number entry, as well as ...
27
votes
11answers
3k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
9
votes
4answers
2k views

SSL Inspection and privacy

I know my company is testing something called "SSL Inspection" based on Websense, which is our proxy. I can not provide more detail about this, but does this mean that in principle all my SSL traffic, ...
1
vote
3answers
109 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
1
vote
0answers
60 views

Threats against website running without TLS but with PGP messages

Are there any threats against a web site that isn't running SSL but uses PGP to encrypt all information to the server (except session identifier) The information flow is as such: 1. Session ID set on ...
1
vote
3answers
142 views

Https forms on tens of domains

What is the optimal way (cost-wise, too) to secure page forms (https) on a large number of domains&subdomains? Are certificates required for all domains? Is putting all the page forms on a single ...
3
votes
3answers
174 views

If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?

Now that Google, Twitter, and some other sites require a TLS connection to access their sites, when you go to http://www.twitter.com it redirects to https://www.twitter.com/. If an attacker had access ...
2
votes
2answers
83 views

Does SNI reveal the virtualhost during the CONNECT query to a HTTPS proxy?

Also, the name of the actual virtualhost is going through unencrypted or not?
-1
votes
0answers
20 views

TLS/SSL's usage of Non-Ephemeral DH vs DHE [migrated]

These questions revolve around DH and ECDH vs DHE and ECDHE. Specifically within the context of TLS/SSL. There are three questions in total (and a fourth bonus question). The goal of using ...
0
votes
3answers
117 views

HTTP/HTTPS on the same site

Suppose a site allows connection to be established with HTTP or HTTPS .If you establish a connection to http://www.example.com or https://www.example.com then all further link's on the page displayed ...
2
votes
3answers
72 views

Can HTTPS or VPN connection be sniffed through UTM device?

Someone told me that if my device communicates with a server on Internet via VPN connection or HTTPS, all the contents that I have sent can be sniffed and decrypted by the UTM device (or more ...
41
votes
13answers
5k views

Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data? [duplicate]

Lots of sites these days, that don't deal with sensitive data, enable encryption. I think it's mostly to make (paranoid?) users feel safer. In cases where there is a user's account being logged in, ...
1
vote
1answer
64 views

What's the point of the pre-master key? [duplicate]

In SSL, the client generates a pre-master key from random data from itself and also the server. It then encrypts this with the server's public key, sends it to the server and then both client and ...
0
votes
3answers
103 views

Is all RSA encryption now considered insecure? (Notably SSH and SSL)

Some of the leaks which emerged during/after Snowden concerned the fact that the NSA was paying the organization behind RSA a lot of money in order for them to systematically weaken the encryption by ...
2
votes
1answer
179 views

HTTP Reverse Proxy: Correct way to do SSL to backend

If I have a HTTP reverse proxy that communicates with it's backends in an untrusted datacenter, or across datacenters, I would want to use HTTPS in the backend, as talked about here: Reverse Proxy ...
62
votes
12answers
20k views

Is Google overreaching by forcing me to use TLS?

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? ...
3
votes
1answer
146 views

Exporting data beyond a cryptographic boundary

Scenario We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
2
votes
1answer
268 views

Is there a Skype plugin that uses TLS and ZRTP

I'm curious, if one can upgrade the security Skype offers to avoid a man in the middle snooping in on the calls by both parties using a client side plugin? Does one exist for this purpose? A bit of ...
1
vote
3answers
70 views

SSL is Extended Validation more secure?

Talking about SSL certificates, there are 3 types. Basic validation Business validation Extended Validation The first one checks only if a domain name is registered for the user which ...
1
vote
2answers
54 views

How can I see if SSL Certificate is Business SSL? [duplicate]

I'm trying to see the visual difference between Business SSL Validation and Standard Validation but I see no difference (or I cannot find a site which contains a Business SSL certificate) Is there a ...
1
vote
0answers
122 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
66
votes
15answers
6k views

Does an established ssl connection mean a line is really secure

From the view of somebody offering a webapplication. When somebody connects with SSL (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
2
votes
2answers
545 views

For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?

I am observing an issue in which the TLS handshake is failing between a Java Client and a web service hosted under IIS 7. Upon wiresharking the attempt it seems that the problem is the list of ...
0
votes
3answers
118 views

Any alternative available for RSA? Is the web still visible to NSA?

After the Snowden revelations, is there any mass change being carried out to HTTPS protocol? As far as I understood, any HTTPS communication is still visible to NSA as they can compromise the RSA ...
0
votes
3answers
107 views

SSL Certificate for an email server

I am completely new to SSL/TLS and would appreciate any help you guys could give me. To give you some background info, our company website is hosted externally by our ISP, however our email is ...
1
vote
1answer
86 views

Using Encrypt-then-MAC in SSL

SSL typically makes use of MAC-then-Encrypt technique instead of Encrypt-then-MAC (which is usually considered ideal for most of the scenarios). I myself don't have a full insight knowledge about the ...
0
votes
4answers
42 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
1answer
49 views

Possible to Derive Private Key from Public Key Given Enough Computing Power? [closed]

Is it possible via brute force to derive a private key from a public key (such as a website's SSL certificate)? If so, how much computing power would you need to make it feasible, compared to say, ...
1
vote
2answers
72 views

SSL/TLS : Authentication mechanism

I have these doubts regarding authentication in SSL/TLS : Will there be an authentication involved for all SSL connections ? For eg. when I browse the internet, using the most up-to-date browser, ...
2
votes
3answers
102 views

Is it secure for a site to serve the login page with HTTP, but have the actual site in HTTPS? [duplicate]

On some websites, the login page (where you enter your login details) is served by a regular HTTP connection with no encryption. However, once I login, the page immediately switches to a secure HTTPS ...