SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
2
votes
1answer
179 views
Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?
Question
Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start")
...
3
votes
1answer
297 views
Why is change cipher spec an independent protocol content type and not part of Handshake Messages?
RFC 2246 says:
To help avoid pipeline stalls, ChangeCipherSpec is an independent TLS
Protocol content type, and is not actually a TLS handshake message.
What pipeline stalss is being spoken ...
1
vote
2answers
165 views
Reg HTTPS man in the middle [duplicate]
Possible Duplicate:
How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it?
A browser sends a request to gmail.com, gmail sends the ...
2
votes
3answers
469 views
How can one decrypt a SSL/TLS session? Besides the private key what else is needed?
Suppose I have a non-DHE-based TLS session stored in a Wireshark or Netmon trace. What is required to decrypt this data?
Is the private key of the certificate all that would be needed?
What ...
4
votes
3answers
215 views
System time and certificates
Recently I accidentally changed the system time to a different month, and then I surfed to a secure site. I got a warning from Google Chrome that mentioned my system time and said the certificate ...
2
votes
4answers
258 views
Client Certificate in SSL HandShake insecure?
Imagine we have an application which is trying to establish a secure connection to a server by using SSL. Now we want the user to authenticate himself with a client certificate which he stores in an ...
7
votes
2answers
2k views
ssltest: Chain issues - Contains anchor
I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)")
What does it mean? Should it be fixed? Can it be exploited?
3
votes
2answers
312 views
Not clear on ssl renegotiation vulnerabilty
When we read about TLS Renegotiation vulnerability, does it mean that a server is not supposed to ever accept renegotiation during a secure connection?
I thought that by renegotiation security is ...
5
votes
1answer
169 views
Is it possible to regenerate private key (SSL)
I've managed to lose my private.key file for my SSL certificate. Is it at all possible to create a new one if I know the passkey and CSR info?
If so, how do I do it?
Thanks.
-1
votes
1answer
65 views
XER encoded X.509 certs [closed]
Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it?
Thanks!
12
votes
3answers
462 views
How secure is aSSL (javascript)? Does it effectively mimic SSL?
Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
6
votes
2answers
678 views
How is certificate forgery with cheap CA's prevented?
In order to perform a successful man in the middle attack on HTTPS, one needs to either strip SSL layer and convert it to HTTP completely or needs to have a valid certificate from a CA for the same ...
4
votes
3answers
117 views
Issuing SSL certificates for device automation software package without domain names
We are developing the automation software for Windows which communicates with the certain devices via our own private connection protocol. That software package consists of several server (including ...
4
votes
5answers
253 views
Is snail mail or HTTPS webmail safer for sensitive information?
I've been curious about the safety of e-mail lately. As far as I know, the most vulnerable point of communication is the local network you send your mail from. That is unless you're trying to keep ...
1
vote
1answer
83 views
How are root CAs for SSL distributed?
For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser.
But what about for firefox and chrome?
...
4
votes
2answers
220 views
How do you verify a certificate belongs to a domain?
I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to.
Currently I can verify the certificate is valid using the following code
$resource = fsockopen( ...
5
votes
1answer
182 views
Most efficient key algorithm for a TLS server key?
Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator.
Which key algorithm should I choose for the server key in ...
4
votes
1answer
253 views
Which key usages are required by each key exchange method?
I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
11
votes
2answers
675 views
Can https be used instead of sftp for secure file transfers?
My company works with financials, and we are required to transfer files containing non-public consumer information securely between our company and our clients.
The usual solution is to go with sftp ...
0
votes
1answer
510 views
How to create trusted chain of certificates if I have the last certificate?
Good day.
During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using)
My server is:
telnet xmpp.odnoklassniki.ru ...
1
vote
1answer
300 views
POP3S vs POP3 with STARTTLS
can you tell me if there are any differences between POP3S and POP3 with STARTTLS?
What's the safest?
Are there any known attacks?
If you could choose about them, which would you pick?
Thanks a lot
3
votes
3answers
444 views
How to distribute client certificates without exposing private key?
I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication.
I'm ...
6
votes
4answers
580 views
why a client authentication is not commonly performed in the TLS protocol?
Is there any reason for this other than key/certificate management on the client-side?
4
votes
1answer
157 views
where to download revoked certificates from
I don't want the certificate revocation lists - I want actual full on revoked certificates for test purposes.
For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and ...
3
votes
1answer
206 views
Is HTST (Strict-Transport-Security header) for HTTP or HTTPS?
Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...
0
votes
0answers
54 views
SSLCipherSuite and cookie creation [closed]
Our corporate server is like this :
Main VIP : abcxyz.xyz.com directing requests to following VIP's:
abcxyz-1.xyz.com
abcxyz-2.xyz.com
The webservers behind abcxyz-1 and abcxyz-2 are on same ...
2
votes
1answer
221 views
Apache2 SSLCipherSuite - why use anything other than high?
I am currently participating a lecture in my university that is called "system architecture and security". One part of this semester is to setup our own slice and hack each others. We also have to ...
2
votes
2answers
219 views
“Don't serve content over HTTP” - what does this mean, exactly?
In doing some research regarding SSL, I came across this topic. One of the common suggestions was not to serve content over HTTP. What does that mean from a website development POV? Referencing ...
83
votes
8answers
4k views
Attacking an office printer?
I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and ...
11
votes
4answers
334 views
How can a web application protect IE users when this browser doesn't support HSTS?
HTTP Strict Transport Security (HSTS) is a very useful feature at preventing OWASP a9 violations and attacks like SSLStrip which try and prevent the client from making a secure connection.
My ...
11
votes
4answers
401 views
What alternatives are there to the existing Certificate Authority system for SSL?
Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
10
votes
7answers
646 views
Should we force user to HTTPS on website?
Should we force website from HTTP to HTTPS , one of the method is using .htaccess:
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]
But what I notice is that some ...
1
vote
1answer
156 views
Replaying SSL traffic in an active connection [duplicate]
Possible Duplicate:
Are SSL encrypted requests vulnerable to Replay Attacks?
I have an SSL connection with my bank open from A to B
A -> B
Through that connection I transfer $100 to ...
10
votes
3answers
1k views
Authenticating a Proxy server over HTTPS
When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc. ...
2
votes
2answers
339 views
Use HTTP POST for Google Search queries
When searching on Google from a browser, the actual search query is visible in the address bar of the browser, even when using Google's secure search (https). Is there a way to submit the search query ...
2
votes
2answers
126 views
Is there a need for SSL on a local site?
Do I need SSL for a site that can only be accessed on the local network?
All users log in with windows credentials using Windows Auth with PHP on IIS.
And if I don't: What security is needed to make ...
3
votes
1answer
308 views
Preventing spoofing of remote server with PHP & cURL
I'm writing a PHP script that is requesting confidential data from a remote server. I'm using cURL to get the remote server's certificate information (for its output, please see below).
Which array ...
3
votes
2answers
165 views
Is it possible to find out the oauth 2.0 client id and secret when an app is communicating with a web service?
I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to ...
1
vote
0answers
81 views
Why not buy cheap SSL certificates? [duplicate]
Possible Duplicate:
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
The comparison in Godaddy's website, makes it clear: they're just cheaper ...
6
votes
3answers
166 views
Why not use a private CA?
I had a question when reading this article:
Phony certificates fool faulty crypto in apps from AIM, Chase, and more
(Basically, some Android apps, like Chase's banking app for example, may be ...
5
votes
1answer
179 views
Which attributes of a X509v3 certificate are never really used?
Are there any extensions/extended key usage attributes of a X.509Certificate that are rarely or never used in practice?
Either due to never being part of an issued certificate or because they are ...
8
votes
2answers
601 views
Are there really functioning quantum computers?
I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
3
votes
1answer
151 views
What are the Netscape Cert Type attributes? Why/when are they needed?
What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions?
Example:
There is the Client/Server Extended Key Usage (X.509) but there is ...
2
votes
1answer
119 views
Can Diffie-Hellman Anonymous be used as a cipher for SSL for one-way certifiate-based authentication
I want to use Diffie-Hellman anonymous cipher for SSL. I also want to use a one-way certificate for server authentication. Is this possible?
15
votes
4answers
568 views
What is the potential impact of these SSL certificate validation vulnerabilities?
I just finished reading through this paper by Georgiev et al, which demonstrates a wide range of serious security flaws in SSL certificate validation in various non-browser software, libraries and ...
0
votes
1answer
301 views
Why is Message Labs sending mail in plaintext?
I have several SMTP servers on various networks around the world, and all of them are getting mail through ESTMPS - extended SMTP using TLS.
So the email coming from GMail, MSN, Yahoo, as well MOST ...
4
votes
2answers
135 views
What is the state of the Windows Update certificate after Flame?
May 28, The Flame malware is discovered in Iran and by Kaspersky Labs.
June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
4
votes
3answers
292 views
Is a forced rewrite from http to https secure? What does SSLRequireSSL add?
I've read contradicting advice about forcing https connections in the following way:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
To me it seems ...
10
votes
2answers
266 views
How insecure is PowerShell Web Access?
Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones.
This sounds cool and scary at the ...
2
votes
3answers
507 views
Can someone detect the URL an android app uses?
I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret?
I know that the IP address and the port number of that connection can be detected, but what ...
