SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
2answers
628 views

Are there any strange things with google.com over HTTPS?

So I'm always browsing the web through Privoxy using minimum these rules: vi /etc/privoxy/user.action { +redirect{s@http://@https://@} } .chrome.google.com .code.google.com .docs.google.com ...
3
votes
1answer
4k views

SSL certificate fails to adhere to basic constraints and PCI compliance

We have an SSL cert from GoDaddy and tried to run a PCI compliance check using McAfee's scan. The one problem they found was that the basic constraints / path length is not configured. Here's what ...
7
votes
1answer
544 views

Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?

I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages. ...
8
votes
2answers
2k views

How to defend against SSL-Exhaustion attacks?

The problem of SSL-Exhaustion attacks is well known for years, but nobody really cared until THC released their exploit-tool recently. THC talks about counter measurements in their release: No real ...
15
votes
3answers
23k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
5
votes
1answer
230 views

What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft

I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status Where can I find the most current guidance on STS in DNS? If ...
4
votes
3answers
277 views

Are SSL certificates from a CA necessary for secure communication?

Am I right in thinking that SSL certificates from a CA are purely for identification purposes and serve no purpose in the actual encryption of data? In other words if I were to create a self signed ...
19
votes
1answer
13k views

What key exchange mechanism should be used in TLS?

There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
12
votes
3answers
726 views

Can I expect my e-mail to be routed securely?

If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
17
votes
3answers
7k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
6
votes
3answers
1k views

How and when should I use OpenSSL for IT Security? How do I understand the output?

I'm discovering OpenSSL, and already used it to diagnose a faulty SMTP TLS connection, but I'd like to get a better / full understanding of the tool and how to use it. What resources should I use ...
25
votes
3answers
2k views

Why was the BEAST attack previously considered implausible?

Can someone explain why the BEAST attack wasn't considered plausible? I saw an article quoting the creator as saying 'It is worth noting that the vulnerability that BEAST exploits has been presented ...
33
votes
5answers
22k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
17
votes
3answers
9k views

What are the risks of self signing a certificate for SSL

Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
2
votes
2answers
589 views

Using AES with a hex key/iv, what mode of operation is the “most secure”

I realize that is a loaded question, but it is not an unreasonable one. given a hex key/iv, what mode of operation is most secure from offline attacks. I defaulted to aes-128-cbc. Partly because of ...
7
votes
2answers
503 views

Good resources for learning cryptography and OpenSSL?

I'm a programmer and I'm working on a Single Sign-on project using SAML. I want to do all I can to make this as secure as possible. Since making a secure Single Sign-on/SAML solution requires signing ...
14
votes
3answers
6k views

Is the Facebook login form using SSL without https in the URL?

If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
4
votes
2answers
5k views

Is it possible to decrypt a SSL/TLS session without doing a MITM-attack?

I'm not talking about decrypting the connection while the SSL/TLS is happening (MITM) but after the connection is closed and I have a pcap file of the entire negotiation/data transfer process. How ...
6
votes
1answer
3k views

How is tunnelling SSH through Poxytunnel/HTTPS different from doing it through SSL with Stunnel?

In an answer to What is the difference between SSL, TLS, and HTTPS, it's said that HTTPS is HTTP over SSL/TLS. That is, an SSL/TLS connection is established first, and then normal HTTP data is ...
19
votes
3answers
2k views

What are the risks of using a CDN to speed up my website? How do I avoid them?

Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN. What ...
7
votes
1answer
2k views

Email SSL security?

I use IMAP and I only access my email through SSL. However, the settings for encrypted email access seem a bit more complicated that https. Can someone explain the security implications of the ...
18
votes
1answer
3k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
4
votes
2answers
634 views

How practical is a certificate's “basic constraint” property in protecting my HTTPS / SSL session?

Suppose a leaf node creates a certificate for a different domain, acting as a CA. Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be ...
2
votes
2answers
107 views

How can I force certain the webclient to honor or remember certain parameters from the webserver?

HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...
3
votes
1answer
230 views

Can wildcard certificates hide/obscure the hostname in a TLS connection?

I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...
5
votes
1answer
564 views

Should I include a random padding in every HTTPS request and response?

According to the following paper, it is possible to decrypt HTTPS traffic by inspecting AJAX calls and using the size parameter as a cryptographic oracle. Should I be sending a variable length ...
4
votes
5answers
3k views

Should I ignore the BEAST SSL exploit and continue to prefer AES?

Because of the BEAST exploit it seems everyone is saying you should stop using AES and instead use RC4. I am wondering if it wouldn't be better to continue using AES instead for the following ...
4
votes
1answer
415 views

Any non-commercial certificate authority issuer for web applications?

Is there any non-commercial certificate authority capable of issuing valid certificates for web applications? I mean, the certificate must be accepted by browsers, like those of commercial CAs?
15
votes
6answers
7k views

Does SSL/TLS (https) hide the urls being accessed [duplicate]

Suppose I type this in my browser https://www.mysite.com/getsecret?username=alice&password=mysecret and an attacker is watching all traffic from me to my ISP. What information is protected by ...
13
votes
2answers
3k views

What should I know before configuring Perfect Forward Secrecy?

PFS has gained attention in our audit department because of its innate ability to limit our exposure if someone steals our private key. What pitfalls or common mistakes should I be aware of before ...
3
votes
2answers
510 views

Inspecting a TLS Certificate to determine RSA Key Usage restrictions

With regard to this answer, I have a question about Key Usage in an SSL certificate. Most SSL server certificates have a RSA key which is not restricted through a Key Usage extension, so you can ...
4
votes
1answer
281 views

How secure is a https website? [duplicate]

Possible Duplicate: Does an established ssl connection mean a line is really secure When I visit a website -- say, https://ebanking.pick-your-bank.com -- my browser (fully patched version ...
0
votes
3answers
145 views

What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?

This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective. What business/organisation(s) would have: Sufficient technical skill ...
5
votes
2answers
1k views

How eavesdropping will be performed how can I prevent from eavesdropping

I believe that eavesdropping in a man in middle attack and the message is passing from the client to server the man sitting at ISP or network hackers can look at what message I am sending. Heard that ...
4
votes
1answer
199 views

How will users know if their session is DNSSec protected or not?

There is definite security value in having DNSSec-verified connections, however I have yet to see software indicate if the connection is secure. Ultimately I would like my users to recognize that ...
1
vote
3answers
725 views

Benefits to using EV certificates with a privately hosted Certificate Authority

For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate? Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the ...
14
votes
4answers
2k views

TLS 1.0 JavaScript injection vulnerability (BEAST): what to do client-side?

With the alleged SSL/TLS vulnerabilities used by the BEAST exploit, there seems to be a security gap between TLS versions; TLS 1.0 being the problematic one but still the only option for many sites. ...
23
votes
5answers
16k views

What ciphers should I use in my web server after I configure my SSL certificate?

There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list. ...
1
vote
2answers
1k views

SSL Breach - Does the latest BEAST vulnerability mean SSL Issuers now have to worry about integrity? [closed]

Although many SSL certificates have been boasting extravagant guarantees -- typically around $10k minimum to $250k per breach -- to ensure their certificates are valid, to this date, I've heard that ...
4
votes
2answers
691 views

Which is the easiest secure file transport protocol to implement (SFTP, FTPS, HTTPS, FTP over SSH, FTP over IPsec)

I have to select a secure file transfer protocol, to be implemented in a pre-boot system. I have access to libraries with the basic network functionalities (IP, TCP, UDP, etc...). I might also have ...
15
votes
5answers
2k views

What can I do about TLS 1.0 javascript injection vulnerability on my server?

The recent article featured on slashdot http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ says that connections secured with TLS 1.0 are susceptible to man-in-the-middle decryption ...
8
votes
4answers
9k views

How do the processes for digital certificates, signatures and ssl work?

I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication. Server has a digital certificate acquired from a CA. It also has public and ...
1
vote
5answers
7k views

How to properly encrypt a communication channel between a client and a server (without SSL)?

I have a poor knowledge in the world of cryptography, I'm just starting to learn it so I'm a newbie :) As a project for getting into the field of cryptography I want to write a client\server program ...
2
votes
3answers
859 views

Why can't the SSL handshake be done in one step?

I'm sure there's plenty of obvious reasons for this, but why can't an SSL session be started with one round-trip? It seems like this would be enough: Client sends their public key Server responds ...
9
votes
2answers
3k views

Are there any statistics about webservers and browsers TLS support?

From Hackers break SSL encryption used by millions of sites: The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
14
votes
4answers
1k views

Is my Company Tracking Me?

Every time I try to connect to a site through HTTPS from my office computer, there is a Certificate Error thrown 2-3 times before showing the login screen. Till now I use to ignore this and click ...
4
votes
1answer
259 views

Random number for HTTPS Message Authentication Code (MAC)

Recently I found that Netscape used quite simple algorithm to generate random number for Message Authentication Code to establish an HTTPS connection (Netscape used time, process identification ...
8
votes
6answers
932 views

when is it safe to click through an SSL warning message?

How does a user know if it's safe to click through scary browser warnings about SSL certificates? Ideally, a user should never need to click through these warning messages, but sometimes honest ...
27
votes
2answers
6k views

I just send username and password over https. Is this ok?

When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
8
votes
4answers
1k views

How to tunnel all network communication?

I'm looking for a way to tunnel all network communication from my laptop through another computer. I can control the software on both the laptop and the computer. The connection between them should be ...