SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

2
votes
0answers
209 views

What is going on with my download of the recent Apple security update?

The update in question is the Mavericks combined update which, among other things, claims to fix the recent SSL vulnerability/gaping hole. This issue really annoyed me, so I decided to procure ...
0
votes
2answers
341 views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
0
votes
1answer
41 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
2
votes
1answer
104 views

Why are SSL handshakes secure and why can't a hacker look at that and decrypt the data?

If I understand right, there is a "handshake" where both the server and the browser verify who they are and agree on an encryption key. Why cannot a hacker just watch the network for the keys going ...
0
votes
2answers
117 views

Identify SSL version and cipher suite

We have a Java application running on a Linux server and we are transmitting some files using a third party Java library which uses HTTPS internally to connect to external servers. These are legacy ...
12
votes
2answers
842 views

Is there a tool to verify browser TLS/SSL configuration

I am looking for a tool to verify the configuration of ssl/tls settings in the browser. I have found a few sites that enumerate supported ciphers and the preferences but none of them seem to provide ...
1
vote
0answers
38 views

TLS with non-repudiation; what happened with 'TLS Sign'?

TLS Sign was proposed as an IETF Draft in June 2007. http://tools.ietf.org/html/draft-hajjeh-tls-sign-03 I did not found further information, besides that the draft expired in November 2007. Can ...
4
votes
1answer
302 views

What is a Certification Path in SSL certificate?

I've been trying to learn more about Digital certificates for the past few days and I'm struggling in order to understand how actually this concept is applied in the real world. Anyways, as I visited ...
1
vote
2answers
248 views

Why doesn't Facebook use HSTS

To force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to ...
1
vote
2answers
60 views

Mechanisms to offer inexpensive https to all second level .wiki domains

I'm working with the registry for .wiki, a new generic top level domain set for public availability in June 2014. We're going to be giving away hosted wikis to registrants of .wiki domains and I'd ...
0
votes
1answer
81 views

why credentials are not shown in mitmproxy?

my question is that why I can not see some credentials in mitmproxy while the application connecting to, uses ssl connection? I actually installed the mitmproxy server on my PC and have set up my ...
3
votes
1answer
372 views

OpenSSL Secure Renegotiation

Has anyone tried to do secure renegotiation on OpenSSL and verify it using WireShark? I can't seem to do a secure renegotiation as far as RFC 5746 is concerned. I tried to issue the connection ...
5
votes
3answers
541 views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
0
votes
1answer
122 views

Is it safe to accept the security certificate from AOL chat? [closed]

Is it safe to accept the security certificate from AOL chat? Did they recently change their certificates? These images are from Pidgin.
0
votes
3answers
205 views

Trust a non-root CA in OpenSSL

Is it possible to have OpenSSL trust a non-root CA such that a certificate signed by that non-root CA can be properly verified? I've noticed that the default behavior for OpenSSL is to only verify ...
0
votes
1answer
155 views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
1
vote
1answer
121 views

How to diagnose No Certificate alert

I have written an application (in C#) to communicate with one of our customers via a web service. Our customer requires us to use bi-directional SSL. The customer has sent us their certificate (in ...
37
votes
4answers
21k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
0
votes
1answer
135 views

Private Key and Public Key Serial Number and Thumbprints

Are the private key Serial numbers and thumbprints the same as the corresponding public key Serial numbers and thumbprints for certificates (X509Certificates, Base64-encoded X.509), and are these good ...
0
votes
3answers
2k views

How to sniff traffic on my wireless network?

For educational purposes, I want to see what packages are sent over my home wifi with VPN on and off. What program should I use for this?
1
vote
0answers
29 views

Use TLS certificate as both server and client?

For a federated server-to-server protocol with domain-based identities, I am thinking of using TLS client certificates as authentication mechanism. I figured that re-using each peer's TLS server ...
2
votes
4answers
120 views

What's the best way to secure inter-server communication for cloud servers?

I'm looking for best-practices or suggestions to secure inter-server communications between VPSs. Should I just run all traffic through SSH? What about HTTP Traffic via something like mongo? ...
0
votes
1answer
140 views

Is there a benefit to having SSL connections on localhost?

I have a mail server with a MySQL database back-end. The mail server and MySQL DB are both installed on the same Windows machine. Is there any benefit to using SSL connections between the two ...
1
vote
0answers
77 views

Do the BEAST and CRIME attacks apply to an IMAP service?

While setting up the Dovecot IMAP service, I noticed that the default parameters are not optimal, it allows SSLv3 for example. Using Thomas Pournin's TestSSLServer.java program, I saw the following: ...
0
votes
1answer
37 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...
1
vote
3answers
137 views

Why can't someone break email or https encryption by somehow getting access to the encryption key?

To repeat, "Why can't someone break email or https encryption by somehow getting access to the encryption key?" In other words, why can't someone intercept the key, or the algorithm to create the ...
1
vote
1answer
60 views

Home banking site request, it possible for a small web agency?

I'm working in a web agency, i have a request to made an home banking system for a little bank. I'm searching in internet for some information about security and a good pattern to start, but naturally ...
0
votes
2answers
73 views

Corporate IT monitoring and access to user private data (keylogging? https data transmission?) [closed]

I work at a large company that requires employees to sign a digital certification saying that we recognize the right of the said company to monitor all data and communication on our work laptops, and ...
1
vote
0answers
66 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
1answer
123 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
1
vote
1answer
68 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
3
votes
4answers
285 views

Outbound proxy which whitelists by server certificate?

Short version: Are you aware of any proxy or firewall device which will permit outbound SSL connections to hosts with approved* SSL certificates only? Long version: Consider the following ...
1
vote
1answer
51 views

Does the .net mvc/iis stack support whitelists for bidirectional authentication for SSL/TLS connections?

I'd like to limit access to some of my REST api, such that only bidirectional SSL/TLS connections are accepted, where the "other side" matches a detailed, restricted, whitelist. Is this something ...
176
votes
8answers
15k views

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
1
vote
2answers
243 views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
3
votes
1answer
71 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
-1
votes
4answers
151 views

Secure communication between server and client [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
2
votes
3answers
139 views

Does the principle of the CRIME & BEAST attack affect VPNs?

I was recently reading about the attacks on SSL/TLS that CRIME and BEAST were able to exploit by attacking the compression in the secure session. Upon reading this I remembered that OpenVPN has ...
5
votes
2answers
1k views

1024-bit DHE vs 2048-bit RSA

Currently with apache/mod_ssl, if DHE is enabled then a 1024-bit ephemeral key will be used. I found the following quote in Adam Langley's blog: Ideally the DH group would match or exceed the RSA ...
1
vote
3answers
95 views

Using public/private key without signed certificate

I am working on a java program and I am now working on its network security. I want to use a secure connection since it transfers a lot of sensitive information. On all security guides it is mentioned ...
0
votes
0answers
20 views

Protecting client's data over the wire [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
0
votes
1answer
1k views

SSL Handshake failed

I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
27
votes
6answers
11k views

Trying to make a Django-based site use HTTPS-only, not sure if it's secure?

The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
5
votes
3answers
246 views

Does checking the fingerprint of a self signed certificate improve security?

I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
1
vote
1answer
72 views

Is it dangerous to sync my data with my personal server through unencrypted http?

Since Apple force iPhone users to use iCloud to sync contacts & calendar, I moved to a local ownCloud instance that works well. However, it would be more convenient if I could sync everywhere and ...
1
vote
2answers
75 views

Why do client certificates not protected against improper server certificate validation

I understand the question of client certs and MITM attacks has been asked several times, but I don't believe this specific scenario has been answered. It was my (seemingly incorrect) assumption, that ...
3
votes
2answers
136 views

Is there such a thing as a non-expiring SSL certificate?

Is there such a thing as a non-expiring SSL certificate? Our scenario is that we develop and sell embedded devices (think "internet of things"). These devices have little web servers running on them ...
1
vote
2answers
472 views

Sniffing From Squid SSL

I created a Squid proxy and a self-signed SSL certificate. The SSL certificate on the server is a private certificate linked to the ssl-bump feature. I am using tshark to dump the SSL traffic, but I ...
0
votes
3answers
133 views

What are the MitM implications of a stolen client-side private key?

Many VoIP handsets support client-side SSL authentication for auto-provisioning. Unfortunately, some devices must be programmed with their client-side keys. (Keys generated on low-entropy devices are ...
0
votes
1answer
466 views

iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)

As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2. ...