Tagged Questions

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

6
votes
3answers
2k views

Best tool for testing an SSL connection in my application [closed]

I have developed an application that send binary data between a .NET client and Java server via TCP. I have recently implemented SSL for this connection and would like a way to demonstrate that it is ...
6
votes
4answers
1k views

How to keep secure while browsing on open wifi when SSL VPN is blocked?

After a recent visit to a hotel I was surprised to discover that they blocked access to my OpenVPN server. I often use this as a way to secure my internet traffic when I am on public wireless. ...
7
votes
5answers
4k views

Best practice to encrypt data in an Android application

I'm writing an application which recovers statistical data about a user. I'm still pondering about what would be the best way to encrypt the data. I haven't got any experience with mobile ...
3
votes
1answer
2k views

Why does Safari seem to be accepting an HTTPS connection every other browser rejects?

This question is inspired by a bug/issue in recent Linksys router firmware. Essentially, something has changed recently that's preventing HTTPS access to the web admin on current generation Linksys ...
2
votes
5answers
2k views

What are practical risks of http (not https) in server-to-server communications

What are some of the practical risks that come with a server-to-server connection over http (not secured with https/SSL)? There are no users involved, just a server-to-server connection from one ...
2
votes
1answer
2k views

Explanation of SSL handshake with certificate

I've read a lot of articles. The client uses the information sent by the server to authenticate the server. If the server cannot be authenticated, the user is warned of the problem that an ...
5
votes
2answers
1k views

If I send an email over SSL, will it always be transmitted over SSL?

This is largely a question of how MTAs and different components communicate. I'm curious that if I send an email using SMTP over SSL to my MTA, can it's next jump to the next MTA or MDA be insecure? ...
4
votes
2answers
5k views

Confusing about Ephemeral Diffie-Hellman

1 Does Ephemeral Diffie-Hellman support authentication? Quote from www.rsa.com/products/bsafe/documentation/mesuite21html/dev_guide/group_EPH_DH.html Ephemeral Diffie-Hellman does NOT provide ...
14
votes
2answers
1k views

SSL fingerprint inconsistency: what does it mean?

I apologize if this is not the best place to ask my question on the stackexchange network, I couldn't figure out where to get enough attention and be relevant. Facebook provides a SSL host, it can be ...
11
votes
3answers
5k views

Why is faking SSL certificate difficult?

In the news that comes from Iran, you hear that Iran has succeeded in making fake ssl certificates, so that they can find people's gmail account credentials. Some analysts are saying this is possible ...
13
votes
4answers
4k views

Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?

DuckDuckGo is a search engine that has a Tor Exit Enclave and hidden service. This site is focused on the safe, secure searching of its users. Since DNS is not used in Tor, it appears that HTTPS is ...
0
votes
1answer
291 views

id-ce-cRLDistributionPoints ASN.1 / DER encoding question

I have a file - test.pem - with the following contents: -----BEGIN CERTIFICATE----- MBIwEKAOoAwwCqMIMAZhBEFCQ0Q= -----END CERTIFICATE----- openssl asn1parse -inform PEM -in test.pem -i returns the ...
0
votes
3answers
2k views

Firefox detected an invalid SSL certificate

February 14, 2012 UTC: Yesterday, I connected to a website of a VPN provider for which Firefox 8.0.1 on Windows 7 Ultimate x86-64 stated that its' SSL certificate is invalid. I saved the received ...
2
votes
1answer
530 views

question about implicitly tags in ASN.1

From the X.509 RFC, in the "Implicitly Tagged Module" section: CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint DistributionPoint ::= SEQUENCE { distributionPoint [0] ...
6
votes
5answers
2k views

Which is the most vulnerable to MITM attacks, SSL or SSH?

Which is the most vulnerable to MITM attacks, SSL or SSH? Here's the scenario, you have 20 minutes to set up a web proxy like this: Laptop -> Chrome Browser -> Web Proxy -> Internet You must secure ...
7
votes
2answers
2k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
2
votes
1answer
2k views

My S/MIME certificate (created with OpenSSL) does not match my email address

I created a certificate with OpenSSL and following commands: openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=hostname' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem ...
1
vote
2answers
4k views

What needs to be done on a Citrix Netscaler to protect from SSL Renegotiation attacks?

I'm under the impression that the TLS/SSL renegotiation hack has been fixed. I'm not sure if the software has to be deployed on the server side, client side, or both. Based on this blog, TLS ...
1
vote
3answers
841 views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
0
votes
1answer
299 views

Are export ciphers allowed in DTLS 1.0?

In RFC 4347 for DTLS, I am unable to find the cipher list to be supported. The RFC mentions it as a set of changes from TLS 1.1 (RFC 4346). TLS 1.1 prohibits use of export ciphers. Are export ...
1
vote
3answers
254 views

Is email between 2 parties secure if both mailboxes are on the same server and both clients use SSL?

Sorry if this is incredibly basic, but I'm not very familiar with how SMTP works. I have a mail server (running Postfix with Dovecot) with an SSL cert from a well-known/accepted CA installed and ...
4
votes
2answers
5k views

Recommended Cipher Suites for TLS 1.0, 1.1 and 1.2

There are a lot of cipher suites defined in the in the specifications itself of TLS 1.0, 1.1 and 1.2. And furthermore, there exist RFCs which add even more cipher suites to a specific version (e.g. ...
2
votes
1answer
466 views

Does client certificate authentication demand more server-side entropy?

We have a secure web service running Apache that requires client certificates for access. This service has a problem with running out of entropy. We have several other sites that use TLS that get ...
14
votes
3answers
12k views

How to test for the BEAST attack if server isn't Internet-connected?

I'd like to test a server specifically for vulnerabilities related to BEAST. What command line switches should I use? What should I see (or not see) in the output? Update The intent is to scan a ...
2
votes
1answer
378 views

What security technology do I need to protect my SSN database?

I'm designing a web application. I need to make sure all my customer's SSN data is secure. Now I know HTTPS with SSL, I'm wondering what are its weaknesses? What else I need to provide a perfectly ...
6
votes
2answers
15k views

Javascript and jQuery not secure over https

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure. I'm using ...
2
votes
3answers
195 views

What is the worse that could happen if a government wanted to interfere with a CA?

In our time of SOPA, PIPA and ACTA, I was wondering what could happen if a government wanted to remove the certificate of a website ? CA are companies, so they would have to obey to instructions from ...
7
votes
2answers
6k views

How to thwart sslstrip attack?

I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
2
votes
2answers
384 views

HTTP + HTTPS + One Time Pad/stream cipher

I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
3
votes
1answer
500 views

Can SSL server choose a session ID '0' in the 'Server Hello' message?

Can s SSL server in response to 'CLIENT_HELLO' request choose a NULL value for the session ID in its response, SERVER_HELLO? Is it OK?
4
votes
1answer
861 views

X.509 algorithm identifier parameters vs. extension values

From the X.509 specs: AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } ...
3
votes
1answer
1k views

Why doesn't asn1parse parse all DER encoding strings?

I have a file - crl.txt - that contains the following: MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw= It's from one of the extensions in a particular X.509 cert. Why ...
4
votes
1answer
424 views

Sniffing IMAPS traffic! Are there any tools for this?

I've got a problem where someone has implemented a custom IMAP Server. I need to write a custom application to get a list of emails, and fetch messages. Problem is, every library I've tried to use ...
7
votes
1answer
2k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
4
votes
1answer
1k views

Why MA-SSL has been introduced?

If my knowledge is correct with respect to simple SSL, Mutually Authenticated-SSL has the advantage that both end parts are authenticated one to another: Not only the Client endpoint knows that ...
3
votes
1answer
542 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: ...
3
votes
1answer
1k views

anti-CSRF tokens in HTTPS environment

Does it really make sense to use anti-CSRF tokens in a web application that is accessed by HTTPS only? If yes, then what are the possible ways to attack such a web application if anti-CSRF tokens are ...
7
votes
3answers
285 views

Would using distinct IP addresses help support browsers with older SSL implementations?

We have a site with two wildcard certificates: *.foo.com and *.bar.foo.com. All of our subdomains resolve to the same IP address. Newer browsers work fine with this, but IE7, for example, does not. ...
35
votes
4answers
27k views

What certificates are needed for multi-level subdomains?

I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy. Here's what I need to secure: ...
3
votes
2answers
4k views

Can Cookies Without the Secure Flag be Stolen, even when only accessed via HTTPS?

Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set. Suppose the site is https://www.example.com. http://www.example.com does not show up, also ...
4
votes
2answers
2k views

Next Microsoft Patch Tuesday include BEAST SSL fix

http://thehackernews.com/2012/01/next-microsoft-patch-tuesday-include.html I thought the vulnerability that BEAST uses is already fixed on "Microsoft" side, no? Can someone please clarify this?: ...
10
votes
1answer
2k views

If an attacker is intercepting all of my traffic, will he be able to listen on my VPN session?

If I am a remote user, connecting to my firm from home, using IPSec VPN tunnel or through SSL, and an attacker is intercepting all of my traffic, will he be able to watch my VPN session on the clear ...
3
votes
1answer
1k views

parsing the id-ce-keyUsage extension in X.509 certs

I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows: ...
6
votes
2answers
696 views

Why would the downloaded certificate show a different end-date as compared to the same certificate when viewed online?

This is sort-of a follow-up to my previous question What fields in a suspicious certificate should I look at? Chrome just presented the warning icon against the certificate presented by ...
-1
votes
1answer
100 views

Why are there soo many HTTP connections when using Convergence?

I installed Convergence on Firefox 9.0.1: http://convergence.io/ but... after I installed/enabled it when I visit a HTTPS only-site there are many-many HTTP traffic to the notary servers. Why? ...
0
votes
2answers
254 views

Convergence HTTPS - what are the Notary servers?

https://www.youtube.com/watch?v=Z7Wl2FW2TcA What are the "Notary" servers regarding convergence? Who is maintaning the "Notary" servers? Can someone please explain?
10
votes
3answers
5k views

Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?

I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
6
votes
2answers
2k views

OCSP and CRLs: Specified in CA or client certificate?

Here's an example PKI setup: * Root CA (offline) * Issuing CA * Client 1 * Client 2 I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
8
votes
3answers
716 views

Public wifi security protocols

I should apologise first- this post could seem a lot to ask for, but I am starting to go around in circles. I am interested in securing my laptop for when I use public wireless hotspots, as I am a ...
1
vote
3answers
355 views

What security protocols provide point-to-point confidentiality?

Am I right in thinking that VPN doesn't protect until you're out onto the external network (assuming you're connecting from within an internal network)? Or does VPN provide confidentiality from the ...