SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

2
votes
2answers
126 views

How does the SSL connection protocol work with self-signed certificate?

I'm using the self-signed certificate, but I don't know how this protocol works. I connect two apps with a socket SSL and it works fine. The server is a Python app and the client is an Android app. I ...
0
votes
0answers
112 views

Socket.IO & WebSocket security - query certifcate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
1
vote
2answers
53 views

Security risk of Microsoft AD Certificate Services?

We have an internal CA server for our domain located at http://cert_srvr.local.domain/certsrv/certrqxt.asp. This server runs Microsoft Active Directory Certificate Services. When I went to the ...
1
vote
3answers
115 views

Is it secure to be using LDAP, or is LDAPS the only secure option?

I am currently using an LDAP setup. I am wondering if it is secure from Man-in-the-middle attacks or other vulnerabilities?
0
votes
1answer
135 views

Mixing green (EV) ssl certificate with non EV certificate

We have a green (EV) SSL certificate for our site and images are fetched from the same domain (https). Currently we are planning to change the images domain (for performance issues) and put them in a ...
0
votes
1answer
62 views

Server SSLv2 enabled on non-webservers

Using Nessus I'm scanning our internal network for vulnerabilities and exploits. I've found a large number of instances where SSLv2 is enabled and is as a result, being flagged as a vulnerability. I ...
0
votes
1answer
81 views

Why middleman cannot capture the encryption key of https/tor traffic? [duplicate]

When we use Tor or https traffic , the encryption- decryption key has to be exchanged between the browser and the website server. Why somebody who can capture entire traffic , say ISP or somebody who ...
0
votes
0answers
24 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
0
votes
1answer
140 views

Security risk among shared wifi users [duplicate]

I understand that the shared users on a wifi can see each other's HTTP traffic using proper tools. Is it possible for shared users to read HTTPS traffic or encrypted traffic like TOR ?
0
votes
2answers
108 views

Is the lack of https reason enough to abort form submission?

Preamble: Am in awe about the quality of both questions and answers on https / SSL on this site. My humble question below pales in comparison. Both on professional and amateur websites I've ...
32
votes
5answers
4k views

HTTPS still NSA-safe? [closed]

There are exerpts, that say that using https can be broken by the NSA by now. So is https still a solution for secure web-browsing? source: ...
1
vote
1answer
59 views

Certificate pinning in a browser

I am trying to understand certificate pinning. Google started adding a whitelist of CA certs that they use for their certificates and if a cert for a google service is issued outside of this list ...
0
votes
1answer
87 views

Why has Convergence stalled out? [closed]

Convergence is a well-thought out system to replace certificate authorities built by Marlin Moxiespike back in 2011. Since it's debut, it seems to have largely stalled out, with no additional major ...
0
votes
0answers
160 views

cURL cert validation with curlopt_cainfo not working

I want to validate my SSL certificate each time I run API calls. I've been following this guide: http://artur.ejsmont.org/blog/content/how-to-properly-secure-remote-api-calls-from-php-application ...
2
votes
1answer
248 views

SSL certificate chain verification

After reading many articles and watching many tutorials I decided to be specific because there are some things about SSL certificate chain verification and SSL cetificate verification in general that ...
0
votes
1answer
69 views

ChangeCipherSpec Authentication

According to RFC 5246, 7.1. Change Cipher Spec Protocol: The ChangeCipherSpec message is sent during the handshake after the security parameters have been agreed upon, but before the verifying ...
2
votes
1answer
126 views

What is “Multi-Protocol Unified Hello” and what are the impacts of disabling/enabling it?

This article describes how to disable old versions of TLS, but in addition to doing so, "Multi-Protocol Unified Hello" is also disabled. # Disable Multi-Protocol Unified Hello md ...
4
votes
2answers
164 views

How widely deployed is TLS with cipher ECDHE?

Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers. Cipher suite Exchange Encryption Hash TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
0
votes
1answer
106 views

SSL decryption without installing a certificate on each client

Given a proxy performing MITM SSL decryption and inspection, is it possible to install a wildcard certificate (*.domain.com) on the proxy signed by a root CA (such as VeriSign or GoDaddy) such that ...
2
votes
2answers
1k views

Does CVE-2014-0195 affect HTTPS?

Does CVE-2014-0195 (openSSL) affect HTTPS or only VPN tunnels? Reference: https://security-tracker.debian.org/tracker/DSA-2950-1, https://isc.sans.edu/
2
votes
1answer
105 views

Why does facebook php sdk (and multiple others clients) include CA bundle with a lot of CAs?

This is what facebook ships with their API php client: https://github.com/facebook/facebook-php-sdk-v4/blob/master/src/Facebook/fb_ca_chain_bundle.crt It contains dozens (hundreds?) Root CAs. But ...
2
votes
2answers
95 views

Certificate authority structure - best practices

I'm working for a company that sells software products to customers some of which do not have the resources and/or know-how to build and maintain their own CA (used for the SSL communication of our ...
1
vote
1answer
140 views

When SSL detect a replay attack?

Suppose an attacker records all messages of a SSL handshake (RSA one-way), and starts a replay attack. When (after which message) can the server possibly detect the attack? Now suppose the attacker ...
1
vote
0answers
455 views

GnuTLS ServerHello exploit (CVE-2014-3466) - how to verify?

So pretty much all of the GNUTLS world is worrying about CVE-2014-3466. I checked my Kali and it responds with this - # apt-cache rdepends libgnutls26 | grep -v lib Reverse Depends: ...
5
votes
3answers
324 views

What exactly determines what version of SSL/TLS is used when accessing a site?

If I click on the little lock icon in Chrome it says that the site in question is using TLS v1. I also checked using openssl and was able to hit the site using TLS1, SSL2 and SSL3. From what I ...
5
votes
2answers
558 views

GET over HTTPS vs POST over HTTPS [duplicate]

How safe is a hybrid mobile application developed using a GET Web service over HTTPS? What are the pros and cons of using it and how safe is POST over HTTPS?
1
vote
1answer
91 views

nonce in SSL/TLS handshake

In SSH/TLS handshake, a nonce is always sent by the client to server and vice versa. Nonce basically consists a random number and unix timestamp. What is the need of unix timestamp ? As the nonce is ...
0
votes
2answers
103 views

SSL Finished message contents

Hi everyone I'm little bit confused about contents of Finished Message used during Handshake Protocol.In particular this message (client/side) contains the connection-id originally sent from the ...
1
vote
1answer
161 views

Why do you need a 4096-bit DSA Key when AES is only 256-bits?

This is something which I have been wondering and trying to find an answer for, but yet to come even remotely to one. Why do you need a 4096-bit DSA/El-Gamal key when AES uses only 256-bit keys?
0
votes
2answers
887 views

Which browsers are using openssl

It is asked in stackoverflow, but I suppose maybe it is more suitable to ask here. It is said that openssl are widely used, however, as far as I know, the most popular browsers seem not use openssl, ...
4
votes
1answer
115 views

Tor and (SSL) response

I have two questions regarding Tor (onion routing). How do I receive responds from a server when I use onion routing, I've read that, the last node(exit node) will use the same path I used but in the ...
3
votes
4answers
243 views

What's the need of multiple implementations of SSL/TLS? [closed]

I've been reading about SSL/TLS and I was surprised when I saw the amount SSL/TLS implementations that exist. wikipedia. So, is there really a need for all these different implementations? Wouldn't ...
3
votes
2answers
254 views

Implementing Own TLS mechanism

I wish to implement SSL/TLS for my site. How can I do this on my own without using a certificate authority. The site will be accessed only via certain machines so I can easily install the public ...
1
vote
1answer
92 views

What can entreprise admins do with our secured sessions?

The enterprise where I work has a proxy server that traces and filters our web activities. Employees claim that they can know the links that we visited and see the content of HTTP web sites, but they ...
5
votes
1answer
625 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
1
vote
3answers
340 views

How can I get my SSL certificate signed by an CA for web application that runs on localhost

I have a web application that runs on localhost. I have a self-signed certificate for tomcat configured but when loading the website on firefox, I get a security exception. Can I get a CA to sign my ...
3
votes
2answers
190 views

Web security - use of cookie in https

I am taking a web security class and was told by the instructor that most of the websites today use https for authentication and then use a cookie (authentication token) in plain text to keep track of ...
1
vote
3answers
61 views

OpenSSL encrypting small packets bandwidth overhead

I have an c/c++ program used for encrypting data for communicating between two ends. Encryption is done using OpenSSL (0.9.8d-fips, Sep 2006). Think it'll be worthy to mention that I'm not much ...
2
votes
1answer
92 views

Reverse Proxy SSL

I am having trouble finding out if a potential server configuration is secure. I have a server running a nginx reverse proxy that is accessible from a public ip address on the ports 80 and 443. I then ...
1
vote
2answers
194 views

Securing JSON data

I am planning to use JSON as the data transport mechanism between my iOS app and my server (the server is a WCF service). While learning about JSON, I realized that all the data is passed around ...
0
votes
3answers
91 views

Where do my keys come from for requests over SSL? [duplicate]

From what I understand, when you send information to a website over SSL, you encrypt the information you send with their public key. However, if you want to be able to decrypt the information they ...
1
vote
2answers
96 views

Using HTTPS, can the target domain be seen?

If I go to https://google.com/q=test_query with from my browser, what traffic can be seen on the router? Can the domain name (google.com) be seen? If so, can I block all of the traffic to a web page ...
3
votes
2answers
435 views

Test STARTTLS configuration of SMTP server

Is there an easy way to test an SMTP server to check for configuration issues associated with STARTTLS encryption, and report on whether it has been configured properly so that email will be encrypted ...
0
votes
3answers
226 views

How Safe Are Encrypted Websites Really?

I was at a coffee shop and had to (I mean had to) check something on my bank account and another account. I figured since the two websites I was viewing were encrypted, and because my computer (I'm on ...
0
votes
0answers
41 views

ARR Server and SSL Offloading

we want to implement ARR server in our WAN. the SSL offloading feature is enabled on ARR server. Since SSL offloading terminates encryption , we want to secure connection between ARR server and data ...
0
votes
1answer
43 views

Advantages of TLS-SRP when the secret must be exchanged online?

I've got some practical questions about SRP when the shared secret must be established online. Is there a way to establish the shared secret online without the use of HTTPS? If you've already used ...
2
votes
2answers
86 views

OpenSSL SSL enabled client application, server verification?

I am writing an OpenSSL SSL enabled client application which connects to a Google server. I have the SSL working and I can monitor the traffic and see that it is definitely encrypted. I am using ...
1
vote
1answer
60 views

What's the advantage of TLS-SRP over self-signed certificates?

According to http://security.stackexchange.com/a/2531/5002 TLS-SRP allows one to authenticate a client or server without third-party certificates because it uses a shared secret. If you're going to ...
0
votes
1answer
768 views

RESTful web service and SSL certificate

We have a server that provides RESTful services to our application server. It runs on Amazon Elastic Beanstalk and mapped with a domain name and SSL certificate registered at GoDaddy. It ran ...
0
votes
1answer
69 views

Is session-passing safe?

I have a php and nodejs server. User logs in on the php backend, and, when entering nodejs, the php SID cookie is being passed through a websocket. I further take the session ID, find the session file ...