SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

2
votes
3answers
100 views

Is it secure for a site to serve the login page with HTTP, but have the actual site in HTTPS? [duplicate]

On some websites, the login page (where you enter your login details) is served by a regular HTTP connection with no encryption. However, once I login, the page immediately switches to a secure HTTPS ...
3
votes
3answers
167 views

Why do you need to encrypt symmetric key?

I'm reading this pki article and as you can see near the bottom, the quick animation and description: The sending computer encrypts the document with a symmetric key, then encrypts the symmetric ...
14
votes
5answers
2k views

How safe is SSL? [closed]

If I got an SSL certificate for my website and use an SSL secured connection (HTTPS), is this safe enough to send my login and password data or should I add some encryption or hashing? And how safe ...
0
votes
1answer
48 views

Secure Communication Between .Net Application and Website

Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our ...
3
votes
1answer
126 views

Why warning sign when visiting https-website? [duplicate]

Sometimes when I visit a website using HTTPS, I get a warning sign next to the URL in my browser (see screenshot; look for yellow/orange arrow) and I wonder if this marks a potential threat or an ...
0
votes
1answer
83 views

CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible?

Sorry if this is a very amateur question. I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting ...
1
vote
2answers
350 views

How to get an “A” on Qualys SSL Labs with Apache 2.2?

I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers. On their blog, they suggest a configuration for Apache 2.4 that should get an "A" ...
0
votes
1answer
52 views

Sending passwords securly over the net: javascript? [closed]

I believe SSL is decrypted and encrypted from your computer to the receiver right? Well is it possible to use any type of encryption (Stanford crypto lib?) to get a password safely over the net these ...
1
vote
0answers
59 views

Strange TLSv1.2 Handshake

I noticed a strangeness in the TLS 1.2 Handshake and I don't know if I'm missing something. As you can see in this screenshot, the browser (Chrome) puts the value 0x0301 as version in the Record ...
5
votes
2answers
299 views

VPNs vulnerable to MiTM because ANY certificate goes

I spoke to a sysadmin in a business center today who intended to basically perform a MiTM (as he called it) on every connection in his network because people in his office building are using VPNs and ...
-2
votes
2answers
93 views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
0
votes
3answers
58 views

Is there a way to program to discover sites transmitting user/pass in plaintext (Not using SSL) for penetration testing? [closed]

I have a CSV/Excel file which in which I want to test out the links which do not have SSL but ask for Username / Password. Is there a program which determines if each site on a list encrypts its login ...
1
vote
0answers
108 views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
1
vote
1answer
44 views

Would disabling resumption/renegotiation mitigate the triple handshake issue?

The Triple Handshake Issue was disclosed lately. As far as I understand it, it highly depends on renegotiation and resumption. So the simple question is: Would disabling resumption and/or ...
33
votes
5answers
4k views

Why do some websites enforce lack of SSL?

When trying to visit https://www.ebay.com, I noticed that I get redirected to HTTP immediately. Here's what cURL says about that: $ curl --max-redirs 0 -v -L https://www.ebay.com * Rebuilt URL to: ...
0
votes
3answers
125 views

Is it ok to send user's private key away, even if protected with a SSL channel?

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
4answers
40 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
4
votes
1answer
237 views

google certificates correct CA [closed]

I view certificates of https://www.google.com.ua/ So I thought, when requesting via cURL, if I point by CURLOPT_CAINFO to those certificates (GeoTrust Global CA and Google Internet Authority G2 in ...
1
vote
1answer
55 views

What's the use of certificate on Load Balancer and Keystore on Service?

Consider a scenario where my service is using a keystore made of self signed cerificate and the load balancer which is balancing traffic for service is binded with a CA approved certificate. I would ...
1
vote
1answer
66 views

Behavior of trusting a self signed SSL certficate

I have just deployed a Turnkey appliance which comes configured with a self signed certificate. This is a server that only I will be using, so I don't want to pay for a certificate. If I add this ...
1
vote
1answer
75 views

Is there any way to restrict multiple access to my server at the same time using one client certificate?

My Server is Windows 2008. Mr. X is accessing my web server using Mr. X's certificate. In that time, an outsider is also trying to access my server using Mr. X's certificate (somehow he got it). Is ...
4
votes
4answers
230 views

What Trusted Root Certification Authorities should I trust? [duplicate]

After two recent Slashdot articles (#1 #2) about questionable Root Certificates installed on machines, I decided to take a closer look at what I have installed on my machines. (I use current versions ...
0
votes
2answers
94 views

understanding and getting over the SSL performance issue

There are many great articles explaining how SSL/TLS works on this site, but I would like to bring in the performance issue. The thing is that I am serving my web content over HTTPS and the SSL ...
0
votes
1answer
43 views

Are there software solutions take encrypted credit card data taken straight off a square credit card reader and insert them into a standard web form? [closed]

Does anyone know how you can take the encrypted output of a square card reader and insert it directly into a standard web form?
1
vote
3answers
130 views

What version of TLS does any web browser use when connecting to server where all SSL Protocols are enabled?

All (almost all) web browsers have TLSv1.0 enabled by default, moreover TLSv1.1 and even TLSv1.2 can also be enabled by default. What version of TLS will be used to connect to web server (e.g. ...
5
votes
3answers
292 views

Why do websites use HTTPS when they don't need to? [duplicate]

This has been bothering me for a while, but I have noticed that some websites (the first one that comes to mind is XKCD) use HTTPS for no apparent reason. I mean, XKCD is free and accessible to ...
3
votes
1answer
108 views

How to deal with websites with poor encryption?

I'm trying to access a website over HTTPS. However, it appears that it uses weak encryption: specifically, RC4. Is there a way to improve the security of my connection to the website? I've been ...
4
votes
1answer
555 views

What Ubuntu packages are still affected by gnutls bug CVE-2014-0092?

Right now the internet is abuzz with news about a severe breach in GnuTLS. An update to the relevant GnuTLS packages has already been released. But I am worried whether some packages might have had ...
1
vote
1answer
75 views

Legitimate use case of man-in-the-middle attack for DPI?

I am working on a device that should sit between the end-user and the server, and that will do deep packet inspection. It is basically a parental control node. This device will be sold to the user, so ...
1
vote
0answers
70 views

Designing a security and encryption strategy for MongoHQ

I'm trying to design the best strategy to achieve the following goals: Securing data-on-the-wire between my server and MongoHQ. Encrypting all data-at-rest with MongoHQ (possibly key values as ...
0
votes
0answers
20 views

What SSL/TLS ciphers do each version of Android support? [duplicate]

What ciphers do each Android device support? Update: More specific not SSL or TLS versions but the actual ciphers such as ECDHE-ECDSA-AES128-GCM-SHA256, etc. Android 2.3? Android 3.x? Android ...
2
votes
3answers
70 views

Can HTTPS or VPN connection be sniffed through UTM device?

Someone told me that if my device communicates with a server on Internet via VPN connection or HTTPS, all the contents that I have sent can be sniffed and decrypted by the UTM device (or more ...
2
votes
1answer
74 views

SSL certificate to protect spoofing of API server

I have a program written in Python that checks the validity of its license key with a remote server. Am I right that an SSL certificate would make it possible to prevent spoofing (host redirects for ...
22
votes
1answer
2k views

Why does Firefox not trust this US government SSL certificate?

Shouldn't this be a trusted certificate considering it's a wildcard SSL certificate? That is, shouldn't *.delaware.gov cover www.corp.delaware.gov?
1
vote
2answers
52 views

Specify multiple ips in a certificate

I created an x509 certificate using gnu certtool, in the certificate template i specified cn=myip Problem is that each time I change my network I need to remake the certificate because my ip ...
1
vote
1answer
60 views

Can I reliably identify Apple devices that have not patched against the gotofail vulnerability based on user agent string?

The title pretty much says it. Do the security patches to address the gotofail security issue in multiple Apple products employing SSL change the User Agent string for the respective systems? And, of ...
1
vote
1answer
398 views

Are post requests secure?

If a post request is sent from a client on a website without SSL, is the request secure? For example, I visit a site badsecurity.com, and I login using a password: Will this password be encrypted ...
2
votes
0answers
209 views

What is going on with my download of the recent Apple security update?

The update in question is the Mavericks combined update which, among other things, claims to fix the recent SSL vulnerability/gaping hole. This issue really annoyed me, so I decided to procure ...
0
votes
2answers
120 views

Can a rogue app hijack an ssl session of another app on the same phone?

We've been discussing a possible attack vector where a rogue app with root rights could hijack the legit ssl session of anther local app and transmit its own data over it without the server being able ...
0
votes
1answer
41 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
2
votes
1answer
100 views

Why are SSL handshakes secure and why can't a hacker look at that and decrypt the data?

If I understand right, there is a "handshake" where both the server and the browser verify who they are and agree on an encryption key. Why cannot a hacker just watch the network for the keys going ...
0
votes
2answers
110 views

Identify SSL version and cipher suite

We have a Java application running on a Linux server and we are transmitting some files using a third party Java library which uses HTTPS internally to connect to external servers. These are legacy ...
1
vote
0answers
37 views

TLS with non-repudiation; what happened with 'TLS Sign'?

TLS Sign was proposed as an IETF Draft in June 2007. http://tools.ietf.org/html/draft-hajjeh-tls-sign-03 I did not found further information, besides that the draft expired in November 2007. Can ...
1
vote
2answers
60 views

Mechanisms to offer inexpensive https to all second level .wiki domains

I'm working with the registry for .wiki, a new generic top level domain set for public availability in June 2014. We're going to be giving away hosted wikis to registrants of .wiki domains and I'd ...
0
votes
1answer
120 views

Is it safe to accept the security certificate from AOL chat? [closed]

Is it safe to accept the security certificate from AOL chat? Did they recently change their certificates? These images are from Pidgin.
0
votes
1answer
77 views

why credentials are not shown in mitmproxy?

my question is that why I can not see some credentials in mitmproxy while the application connecting to, uses ssl connection? I actually installed the mitmproxy server on my PC and have set up my ...
1
vote
1answer
114 views

How to diagnose No Certificate alert

I have written an application (in C#) to communicate with one of our customers via a web service. Our customer requires us to use bi-directional SSL. The customer has sent us their certificate (in ...
1
vote
2answers
235 views

Why doesn't Facebook use HSTS

To force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to ...
1
vote
1answer
133 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
1
vote
1answer
92 views

Best way to set up SSL certificates for consuming web service from Azure

I need to purchase and install the correct Verisgin SSL certificate(s) (X.509) on Azure. I have never done this before and would really appreciate some advice on how to go about it and what is ...