SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
2answers
50 views

SSL encryption work only in content?

Can SSL encrypt the relative path I would like to visit in a site? If I would like to make a login system with GET instead of POST, can SSL encrypt the part "?username=user1&password=pass1".
3
votes
1answer
98 views

SSL/TLS version switch over reason

I'm studying the SSL/TLS protocol, more specifically its handshake. I know that initially, a client sends a Client Hello message to the server which includes the TLS version supported by the client. ...
0
votes
2answers
38 views

PKI certificate validation graphs, trees and cross signing

I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it ...
1
vote
1answer
118 views

What is the advantage of buying an SSL certificate from the CA rather than a reseller?

I am trying to do some research on SSL certificates, and I've come across a number of reseller sites such as GoGetSSL, which offer certificates at much lower prices than what you would pay if you ...
2
votes
1answer
123 views

TLS v 1.1 vulnerabilities

My question concern TLS : What are the main vulnerabilities of TLS v1.1 ? Actually, none RFC describes v1.1 vulnerabilities, neither what pushed them to change to the new protocol 1.2 except ...
4
votes
2answers
531 views

Adding a SSL builds trust with technical clients? [closed]

Please note: A majority of this question is based on the facts that a lot of my members and I are one step from being tin-foil hats. If you continue to read and answer this question, please remember ...
0
votes
2answers
50 views

Self signed certificate secure when just client sends sensitive information?

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for ...
4
votes
1answer
149 views

Is it a security risk for users not to logout of a website?

Is it a security risk to myself that I am not logging out of Twitter, Facebook, StackExchange, and a majority of the sites which I am using? Is there a chance for someone to hijack my session or cause ...
0
votes
0answers
39 views

Strange Finished Message in TLS

I've tried to understand the content of the Finished Message of TLS. I'm using wireshark to capture the traffic between my browser and the internet. I noticed a "stangeness" when the chosen ...
1
vote
1answer
151 views

Crazy Finished Message in TLS

I've tried to understand the content of the Finished Message of TLS. I'm using wireshark to capture the traffic between my browser and the internet. I noticed a "stangeness" when the chosen ...
3
votes
1answer
91 views

SSL protocol paper “Investigations about SSL”

In several papers, I see the quote of the following security paper, which concerns SSL: EADS Defence and Security Systems SA. Investigations about ssl. ...
2
votes
2answers
105 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
0
votes
1answer
138 views

Why do I need to install the startcom intermediate certificate?

I issued my server a Startcom class 1 cert. With no changes on the client, I can access this server via FF without issue. However, when try to validate the certificate via openssl s_client it chokes ...
2
votes
2answers
52 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
2answers
112 views

What's the meaning of the term “ad-hoc MAC” (Message Authentication Code)?

In SSL literature, I've noticed the use of the term "ad-hoc MAC". I understand the meaning of MAC (Message Authentication Code) and how it works, but what does the term Ad-hoc MAC mean? Note: With ...
4
votes
3answers
101 views

Preventive security action in Android App

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list. Bank is a very special client. ...
1
vote
2answers
66 views

A doubt in certificate chain validation and revocation checking

So when i do a tls handshake with the server, it responds with a cert chain which the browser verifies and which ends at a trusted root CA. In this the browser checks if the cert presented by the ...
1
vote
0answers
161 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
-1
votes
1answer
222 views

RC4-MD5 vs DES-CBC3-SHA [closed]

We moved to RC4-MD5 as a mitigation to BEAST attack. But our other teams are saying to use DES-CBC3-SHA I want to know if DES-CBC3-SHA is also equivalent secure and mitigates BEAST as well ? Also ...
0
votes
1answer
156 views

Php Session ID, http VS https [duplicate]

So I was doing some tests with the php session ID cookie. I know that data is stored on the server however, a cookie with a unique ID is stored so that the server can recognize the client while ...
0
votes
1answer
69 views

Certificate request - why does the requester have to create a private key?

If remember right, then before I send a CSR (Certificate signing request) to the CA, I have to create private and public keys. Then I use the public key to encrypt my personal details before I send ...
2
votes
2answers
88 views

Encrypt and Authenticate localhost-traffic?

I have some app-components on the same machine but in different languages which need to communicate. I am using socket communication over localhost to do so. The data transferred is confidential. ...
0
votes
0answers
46 views

Central Authentication Server

I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication ...
2
votes
1answer
125 views

Should my company have an SSL on our email

We have a new IT guy that insists we do not need an SSL on our email. Quite a few people access their email from outside our office(network) via mobiles and home computers, often from WIFI ...
4
votes
3answers
598 views

Bad things about no SSL encryption? [duplicate]

So I was reading some comments on a popular forum about SSL encryption and how some websites pass their login form data as plaintext and don't use SSL or TLS. I understand that using an encryption ...
-1
votes
1answer
439 views

Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited?

I am making a presentation to the class about "SSL 2.0 deprecated protocol" and I really have no idea how this exploit is used or how the attacker can use this vul. I understand the impact of this ...
2
votes
2answers
188 views

Is my bank's website secure, if it uses partial HTTPS?

My (not so small) bank has a website for doing transactions over the internet, and it has an HTTPS website for it. But my Firefox 29 wrote that the website is just partially encrypted. I did a little ...
1
vote
1answer
39 views

DTLS Session Keys life time

I have a UDP client application that is long-lived: Ideally, it keeps streaming to a server forever. I'm using Datagram Transport Layer Security (DTLS) to secure the UDP communication. How often ...
1
vote
1answer
120 views

Using OpenSSL v1.0.1g, am I creating SSL certificate or TLS certificate?

So confuse right now between SSLv3 and TLSv1.2, I tried to find some answer on the Web but didn't seems figure it out so I am asking you guys. Is using the latest release of OpenSSL make me creating ...
4
votes
1answer
78 views

Decline any custom ssl certificate in a mobile application

Consider the following scenario. Eve creates an access point in a public place. Alice connects to the AP via mobile phone and starts browsing the Web. Eve redirects Alice to a registration page and ...
0
votes
1answer
80 views

Is there a secure DNS provider? [closed]

Is there a secure DNS provider? Kind of alternative to DNSCrypt.
2
votes
1answer
190 views

What happens when intermediate certificates are installed in the wrong order?

I have noticed that the intermediate certificates on a web service are installed in the wrong order. What effects could I expect from this? I used the Symantec certificate checker which stated: ...
3
votes
2answers
103 views

SSL Wildcard certificate to issue anther certificates

Let's say, that I buy an *.example.com SSL certificate. I want now to generate subcertificates and include the *.example.com certificate in a trust path: host1.example.com, with an alternate name ...
9
votes
2answers
1k views

Can I determine a private key given the encrypted data and corresponding cleartext?

If I know that Data A is an encrypted form of Data B is that sufficient information to determine the private key?
2
votes
1answer
102 views

MITM SSL connection

I read this article today about an SSL MITM. I am trying to understand this attack. This may be a naive question. My understanding is that the WebView sends a request to domain name, the server ...
11
votes
2answers
1k views

Is Apple's push notification service implementation vulnerable to a MitM attack

Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2 Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf ...
1
vote
0answers
36 views

Is the root CA certificate required in the .crt file? [duplicate]

I am setting up SSL on Nginx with a free StartSSL certificate. Based on the instructions given on this StartSSL page I created a unified certificate containing the CA's root certificate, Intermediate ...
1
vote
1answer
109 views

SSL Handshake random number?

I realized all of the phase of the handshake but I do not understand how it does that from the two randomly generated numbers are unable to generate a session key that the client and the server uses ...
1
vote
1answer
137 views

Secure connection between two clients inside a wifi without internet connection

I'm currently trying to understand secure connections inside a WiFi network without an Internet connection. I would like to use some sort of SSL tunneling inside a WiFi network between two clients. ...
2
votes
2answers
83 views

Avoiding SSL handshake for each call

My application interacts with many other HTTPS based services. As we use them at considerable frequency, I am worried about the performance impact of using HTTPS. Is there any mechanism ( time bound ...
2
votes
2answers
232 views

Load balancer and two machines - how many SSL certificates do I need?

We have a load balancer facing the Internet. It's balancing load towards two systems behind it in the back-end running apache. How many SSL certificates do I need to buy? - One for the load-balancer ...
0
votes
0answers
23 views

DTLS CertificateVerify doubt

In DTLS 1.2 RFC 6347, section 4.2.6: CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: ...
1
vote
1answer
180 views

Understanding Hearthbleed attacks [duplicate]

In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct? Or can this be done ...
1
vote
1answer
170 views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
0
votes
1answer
91 views

Do I need an SSL Certificate for a HTTP only site?

The cert for our public facing site is about to expire soon. Our site is entirely http. The site runs on SharePoint, and with SharePoint working with NTLM, the credentials that are passed over the ...
2
votes
1answer
102 views

How do I securely deal with SSL certificate validation failure when the client date is incorrect?

I have an application that runs in mobile devices and connects to my server via HTTPS. At times the connection fail because the device has a date set in the past (before the 'valid from' date on my ...
2
votes
2answers
86 views

Identifying SSL traffic?

How does DPI basically identify SSL data traffic? Just by the number “443” in port section or the SSL traffic has some other particular properties other than “443”? Thanks in advance,
0
votes
0answers
219 views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...
0
votes
1answer
119 views

Python SSH vs SSL? [duplicate]

I read the What is the difference between SSL vs SSH? Which is more secure? , and it mentions there is the possibility they can be affected by similar attacks. Now that the heartbleed thing is out, ...
0
votes
1answer
121 views

Outbound Port 443 Open but Not Allowing SSH [closed]

My college wireless network has a firewall blocking all outbound ports except 443 and 80. The wired network, however, has none of these restrictions. I can connect to HTTPS sites (obviously). On my ...