SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
3
votes
4answers
130 views
Secure single page in a site if site is hacked?
I've been tasked with trying to find a way to secure a single page in our site if somehow, a hacker gets access to our files. This "single page" will be run on a different server.
Requirements:
...
0
votes
0answers
84 views
Extended validation SSL certificates [closed]
Where can i buy the cheapest EV SSL certificate?
By now the cheapest one i've found is Godaddy.
But i want know if there are a cheaper one.
5
votes
5answers
366 views
How risky is it not to install ssl?
I would like to have more insight about when a server should install ssl, in particular when it is worth the money to pay for a valid certificate. As my clients often have little understanding of why ...
2
votes
1answer
248 views
ECDHE_RSA and gmail
I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange.
Based on my understanding of TLS and Gmail, my client ...
2
votes
1answer
131 views
What is the cost of SSL encryption?
So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an ...
3
votes
2answers
109 views
Why are SSL certificates valid only from a certain date?
Each SSL certificate is valid starting from a specific date and up to the expiration date.
What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
3
votes
1answer
390 views
Use client SSL certificates as web application authentication
I'm working on a web application with simple API needing authentication. For my application nature, users have two RSA keys, for signing and encrypting messages. My protocol works based on it. The ...
1
vote
1answer
113 views
3
votes
1answer
270 views
Choosing an SSL certificate provider
Does it make any difference which provider I get my SSL/TLS certificate from? In particular, what are the pros and cons getting an SSL certificate from Verisign vs getting one from Thawte? Which one ...
2
votes
1answer
225 views
Windows Update - Interception
I'm trying to monitor the HTTP requests/responses made when performing a Windows Update.
I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp:
netsh ...
3
votes
2answers
178 views
Entering sensitive information into non-SSL site that uses secure iFrame
There is a website that tenants can use to pay their rent. That website uses an http address but apparently uses a third-party product, which embeds an iframe into the page. The source of that iframe ...
1
vote
1answer
182 views
What elliptic curves are supported by browsers?
Wireshark'ed Firefox 3 request. Their names are nowhere documented.
Elliptic curve: secp256r1 (0x0017)
Elliptic curve: secp384r1 (0x0018)
Elliptic curve: secp521r1 (0x0019)
What are the supported ...
3
votes
1answer
114 views
What are those nul bytes doing in Certificate Subject CN?
While doing some research with SSL certificates, I found some weird certificates containing nul bytes in their Subject field. One example is www.refah - bank.ir (did the Iranian government fake this ...
4
votes
1answer
139 views
How powerful are top Verisign executives?
I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a ...
0
votes
1answer
127 views
What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?
Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange?
Can the server be configured to use weak key sizes for ...
2
votes
1answer
185 views
How to set “Not Before” value to past when creating certificate request
We have lots of embedded TLS clients on the field. TLS Servers must be authenticated.
Because long power cuts may reset clock of those devices, we have requirement to use certificates with validity ...
1
vote
1answer
91 views
How effective is Activesync Certificate revocation using CRL or OCSP
We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords.
One way to remedy an account lockout issue is to issue and deploy certificates ...
5
votes
4answers
165 views
Threat model for huge warnings on untrusted SSL certificates and no warnings for plain HTTP connections?
Why do untrusted/expired SSL certificates get such a huge warning in modern browsers even with "DO NOT VISIT THIS SITE!" messages, whereas a regular HTTP connection, which is more prone to ...
41
votes
10answers
3k views
Why do we not trust an SSL certificate that expired recently?
Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
0
votes
3answers
160 views
SMTP and SSL/TLS
If I understand correctly, communication between SMTP servers may be encrypted but is not required. Because it is optional, does it really have benefits? When server A connects to server B, both of ...
0
votes
2answers
57 views
How can I set up signed downloads?
Scenario
I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
3
votes
1answer
104 views
Certification authority only for certain domains
Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
2
votes
2answers
446 views
HTTPS verification failed - get certificate information iPad/iPhone
I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
6
votes
2answers
248 views
Is IP restriction enough or should I SSL my web authentication?
I want to connect to my home install of phpmyadmin. I restricted the connection for this to my 2 IPs.
But I don't really understand this whole OSI layering. I do know that the IP is saved in the ...
2
votes
2answers
74 views
Actual issue? Phone switches from 3G to router makes session switch from https to http
I heard that a security issue exists in some cases when a mobile phone has:
Connected to a website via https via 3G
Connects to a router
I'm told that that in this particular scenario the router ...
0
votes
1answer
163 views
How configure tomcat 7 SSL to use AES-NI?
My server has AES-NI and I would like tomcat 7 to make use of this but I am not really sure how to make that happen or where to even start looking. I am quite familiar with tomcat administration, and ...
2
votes
3answers
93 views
Is password authentication worse that signed messaging if done over SSL?
Let there is a public API:
HTTP-based
via SSL
there are no browsers, just connections between custom written programs
The first authentication scheme that came to my mind was... client signs their ...
1
vote
1answer
115 views
Exporting data beyond a cryptographic boundary
Scenario
We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
-1
votes
2answers
139 views
What is ASN.1 usage in SSL protocl and What's the risk of using it?
I heard that ASN.1, which is part of browser SSL libraries, introduces the potential risk of compromise our system even if we use no-script. but what is ASN.1 exactly doing? Why do we need to use ...
8
votes
4answers
439 views
Can URLs be sniffed when using SSL? [duplicate]
I know that http requests can be sniffed, so sniffer can see the requested URL from the victim. So 2 days ago I my bank made me a web-account to see, send money etc...
The thing I saw is my session ...
1
vote
1answer
142 views
How to troubleshoot why Thunderbird rejects a PKCS#12 certificate with “Could not verify this certificate for unknown reasons”?
After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a ...
3
votes
3answers
131 views
Is it safe to mix authentication methods?
Is it a good idea to "combine" authentication methods?
Example we can use username/password method to authenticate a user from a server.
What if we used this as a first authentication step to get ...
2
votes
2answers
323 views
Why is this SSL handshake failing with iPad? [closed]
I do have a tomcat server that listen on an SSL socket with TLS protocol. When connecting with all desktop browser everything work right. When connecting with Safari on iPad, the SSL handshake fails.
...
1
vote
2answers
147 views
What security issues are there when reading cookie with .htaccess?
I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
1
vote
1answer
111 views
Pure SRP authentication without TLS
IF using a SRP for client/server application authentication without TLS. Will it be vulnerable to man-in-middle attack, since if using SRP, the public info doesn't really useful to calculate the ...
8
votes
3answers
290 views
How practical/important is the Lucky Thirteen TLS attack?
I was reading this article which talks about a new attack against TLS being called Lucky Thirteen. It claims to allow repeatable MitM attacks against HTTPS connections.
It's described as being fairly ...
2
votes
6answers
208 views
Protecting an admin area from the public
We are about a month away from launching a pretty important site, which comes with an admin console to help us manage the site.
Now I'm not very interested at just leaving the admin out in the open ...
2
votes
2answers
546 views
Protecting against SSL Strip [duplicate]
I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe?
Does it depend on the cert strength?
Do you ...
4
votes
1answer
117 views
For a desktop application, why use an SSL certificate from a trusted authority?
When a web browser connects to a server and downloads an SSL certificate, a third-party trusted authority ensures that the client is talking to the host that it's looking for. If the host uses a ...
6
votes
6answers
612 views
Does not having https moot this entire site?
On a bank website the other day, I noticed that they were giving out a phone number on a page that wasn't over https. This seemed really wrong to me, since it would allow somebody to change the phone ...
0
votes
2answers
133 views
OpenID without SSL certificate
Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed?
Just to make things clear, ...
1
vote
1answer
107 views
How to filter https traffic in mod-security WAF?
I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
-1
votes
3answers
60 views
Secure transmission for desktop applications
Suppose I have a desktop application that does password hashing for login authentication.
Is the password normally hashed before it travels to the wires or does it travel to the wires first in plain ...
1
vote
2answers
141 views
Which is better for SSL: TLS_EDH or TLS_SRP?
DH is vulnerable to a man-in-middle attack due to no server authentication; and RSA does not have forward secrecy.
People suggest used Ephemeral DH but what are the differences between Ephemeral DH ...
-3
votes
2answers
105 views
Cannot use HTTPS or download stuff from sourceforge with a mac, what kind of soft does that? [closed]
I'm at a public library (france). I have a http library login to access that wifi.
I just want to download some SFML zip to make some app, but many things are blocked, mainly https. I can't even ...
2
votes
2answers
186 views
Ssl certificate rekey or revoke
I want to be sure to understand well the situation where SSL certificate is compromised.
If I ask for a rekey, I suppose the old certificate will remain valid.
The future communications with the new ...
6
votes
3answers
562 views
Should SSL be terminated at a load balancer?
When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
2
votes
1answer
96 views
Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?
From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
1
vote
1answer
76 views
Wildcard SSL Cert and Client Authentication
I have a wildcard SSL certificate (from GoDaddy.com) deployed to several Windows 2003 servers. I used IIS management console to import the certificate. The problem is that only one of these servers ...
3
votes
1answer
156 views
Cellphones IMEI public exposed?
Currently I'm in the middle of a developement process, and I have some security questions for you. I have a webservice, asp.net which is configured to run over https. The first authentication step for ...
