SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
2answers
220 views

Securing JSON data

I am planning to use JSON as the data transport mechanism between my iOS app and my server (the server is a WCF service). While learning about JSON, I realized that all the data is passed around ...
0
votes
3answers
91 views

Where do my keys come from for requests over SSL? [duplicate]

From what I understand, when you send information to a website over SSL, you encrypt the information you send with their public key. However, if you want to be able to decrypt the information they ...
1
vote
2answers
97 views

Using HTTPS, can the target domain be seen?

If I go to https://google.com/q=test_query with from my browser, what traffic can be seen on the router? Can the domain name (google.com) be seen? If so, can I block all of the traffic to a web page ...
3
votes
2answers
498 views

Test STARTTLS configuration of SMTP server

Is there an easy way to test an SMTP server to check for configuration issues associated with STARTTLS encryption, and report on whether it has been configured properly so that email will be encrypted ...
0
votes
3answers
226 views

How Safe Are Encrypted Websites Really?

I was at a coffee shop and had to (I mean had to) check something on my bank account and another account. I figured since the two websites I was viewing were encrypted, and because my computer (I'm on ...
0
votes
0answers
43 views

ARR Server and SSL Offloading

we want to implement ARR server in our WAN. the SSL offloading feature is enabled on ARR server. Since SSL offloading terminates encryption , we want to secure connection between ARR server and data ...
0
votes
1answer
44 views

Advantages of TLS-SRP when the secret must be exchanged online?

I've got some practical questions about SRP when the shared secret must be established online. Is there a way to establish the shared secret online without the use of HTTPS? If you've already used ...
2
votes
2answers
92 views

OpenSSL SSL enabled client application, server verification?

I am writing an OpenSSL SSL enabled client application which connects to a Google server. I have the SSL working and I can monitor the traffic and see that it is definitely encrypted. I am using ...
1
vote
1answer
62 views

What's the advantage of TLS-SRP over self-signed certificates?

According to http://security.stackexchange.com/a/2531/5002 TLS-SRP allows one to authenticate a client or server without third-party certificates because it uses a shared secret. If you're going to ...
0
votes
1answer
887 views

RESTful web service and SSL certificate

We have a server that provides RESTful services to our application server. It runs on Amazon Elastic Beanstalk and mapped with a domain name and SSL certificate registered at GoDaddy. It ran ...
0
votes
1answer
71 views

Is session-passing safe?

I have a php and nodejs server. User logs in on the php backend, and, when entering nodejs, the php SID cookie is being passed through a websocket. I further take the session ID, find the session file ...
1
vote
0answers
57 views

Are any major websites offering ECDSA authentication?

At the time the Cloudflare blog post “ECDSA: The digital signature algorithm of a better internet” was authored, Cloudflare was apparently one of "fewer than fifty" users of ECDSA certificates on the ...
0
votes
2answers
49 views

SSL reconstruction with missing part

I know that it's possible to decrypt a sniffed SSL session even when some packets were lost during the capture. I run some tests with wireshark and I saw that it's still able to decrypt part of the ...
1
vote
2answers
61 views

SSL security display

Why does Firefox not display the SSL logo when viewing secure sites, i.e. sites with Https? It used to display at the bottom of teh browser window previously but i just notices that that bottom ...
7
votes
3answers
199 views

According to RFC 5246, are nonces in TLS useless (in terms of security) and if yes, why aren't they only random data?

I know the common usage of nonces in security (which is well described in this topic). However, when checking the SSL/TLS protocol, we can notice, according to the RFC, that nonces as ...
1
vote
1answer
132 views

Is this a security breach?

I read in an article that if the request is authenticated or secure (i.e., HTTPS), it won’t be cached. But in https, burp has reported an issue stating http response is as follows: Cache-Control: ...
0
votes
3answers
136 views

Encryption and Layers understanding

If I'm right the SSL encryption take place in the application layer, but we can also have encryption in the Internet Layer. Why are we using both, and why sites that doesn't have SSL are considered ...
0
votes
1answer
128 views

HTTPS encryption and internet proxy [closed]

I'm not sure if this is the right place to ask this question. Please tell me, and I'll delete it. I want to modify a Word document hosted on my OneDrive account. I see that it is using a SSL ...
6
votes
3answers
1k views

Why can't we do MiTM attacks when using secure connection

I have this silly question that is bothering me. When not using secure connection (HTTP for example) cookies can be intercepted and used to connect to the site as if we have the id and password. We ...
3
votes
2answers
112 views

security via chsh

I am developing a program that I want people to be able to connect to and use via ssh. I've decided a simple way of doing this would be to create an account for them on my linux server, and change ...
0
votes
2answers
136 views

Heartbleed: revoke or replace ssl certificate?

I have a free ssl certificate issued just before Heartbleed was found. Now my CA wants me to pay 25$ to revoke it. Should I pay or it's just enough to create a new certificate from another CA an ...
3
votes
2answers
382 views

Why do we need WTLS?

Please excuse my probably gross misunderstanding of how all this works. I just started reading SSL & TLS Essentials by Stephen Thomas, and in chapter 1 he talks about how TLS is a separate ...
2
votes
2answers
197 views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
1
vote
2answers
50 views

SSL encryption work only in content?

Can SSL encrypt the relative path I would like to visit in a site? If I would like to make a login system with GET instead of POST, can SSL encrypt the part "?username=user1&password=pass1".
3
votes
1answer
146 views

SSL/TLS version switch over reason

I'm studying the SSL/TLS protocol, more specifically its handshake. I know that initially, a client sends a Client Hello message to the server which includes the TLS version supported by the client. ...
0
votes
2answers
51 views

PKI certificate validation graphs, trees and cross signing

I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it ...
1
vote
1answer
131 views

What is the advantage of buying an SSL certificate from the CA rather than a reseller?

I am trying to do some research on SSL certificates, and I've come across a number of reseller sites such as GoGetSSL, which offer certificates at much lower prices than what you would pay if you ...
2
votes
1answer
160 views

TLS v 1.1 vulnerabilities

My question concern TLS : What are the main vulnerabilities of TLS v1.1 ? Actually, none RFC describes v1.1 vulnerabilities, neither what pushed them to change to the new protocol 1.2 except ...
4
votes
2answers
531 views

Adding a SSL builds trust with technical clients? [closed]

Please note: A majority of this question is based on the facts that a lot of my members and I are one step from being tin-foil hats. If you continue to read and answer this question, please remember ...
0
votes
2answers
51 views

Self signed certificate secure when just client sends sensitive information?

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for ...
4
votes
1answer
152 views

Is it a security risk for users not to logout of a website?

Is it a security risk to myself that I am not logging out of Twitter, Facebook, StackExchange, and a majority of the sites which I am using? Is there a chance for someone to hijack my session or cause ...
0
votes
0answers
41 views

Strange Finished Message in TLS

I've tried to understand the content of the Finished Message of TLS. I'm using wireshark to capture the traffic between my browser and the internet. I noticed a "stangeness" when the chosen ...
1
vote
1answer
161 views

Crazy Finished Message in TLS

I've tried to understand the content of the Finished Message of TLS. I'm using wireshark to capture the traffic between my browser and the internet. I noticed a "stangeness" when the chosen ...
3
votes
1answer
91 views

SSL protocol paper “Investigations about SSL”

In several papers, I see the quote of the following security paper, which concerns SSL: EADS Defence and Security Systems SA. Investigations about ssl. ...
2
votes
2answers
111 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
0
votes
1answer
221 views

Why do I need to install the startcom intermediate certificate?

I issued my server a Startcom class 1 cert. With no changes on the client, I can access this server via FF without issue. However, when try to validate the certificate via openssl s_client it chokes ...
2
votes
2answers
60 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
2answers
119 views

What's the meaning of the term “ad-hoc MAC” (Message Authentication Code)?

In SSL literature, I've noticed the use of the term "ad-hoc MAC". I understand the meaning of MAC (Message Authentication Code) and how it works, but what does the term Ad-hoc MAC mean? Note: With ...
4
votes
3answers
107 views

Preventive security action in Android App

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list. Bank is a very special client. ...
1
vote
2answers
77 views

A doubt in certificate chain validation and revocation checking

So when i do a tls handshake with the server, it responds with a cert chain which the browser verifies and which ends at a trusted root CA. In this the browser checks if the cert presented by the ...
1
vote
0answers
179 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
-1
votes
1answer
339 views

RC4-MD5 vs DES-CBC3-SHA [closed]

We moved to RC4-MD5 as a mitigation to BEAST attack. But our other teams are saying to use DES-CBC3-SHA I want to know if DES-CBC3-SHA is also equivalent secure and mitigates BEAST as well ? Also ...
0
votes
1answer
220 views

Php Session ID, http VS https [duplicate]

So I was doing some tests with the php session ID cookie. I know that data is stored on the server however, a cookie with a unique ID is stored so that the server can recognize the client while ...
0
votes
1answer
81 views

Certificate request - why does the requester have to create a private key?

If remember right, then before I send a CSR (Certificate signing request) to the CA, I have to create private and public keys. Then I use the public key to encrypt my personal details before I send ...
2
votes
2answers
99 views

Encrypt and Authenticate localhost-traffic?

I have some app-components on the same machine but in different languages which need to communicate. I am using socket communication over localhost to do so. The data transferred is confidential. ...
0
votes
0answers
49 views

Central Authentication Server

I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication ...
2
votes
1answer
132 views

Should my company have an SSL on our email

We have a new IT guy that insists we do not need an SSL on our email. Quite a few people access their email from outside our office(network) via mobiles and home computers, often from WIFI ...
4
votes
3answers
607 views

Bad things about no SSL encryption? [duplicate]

So I was reading some comments on a popular forum about SSL encryption and how some websites pass their login form data as plaintext and don't use SSL or TLS. I understand that using an encryption ...
-1
votes
1answer
686 views

Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited?

I am making a presentation to the class about "SSL 2.0 deprecated protocol" and I really have no idea how this exploit is used or how the attacker can use this vul. I understand the impact of this ...
2
votes
2answers
208 views

Is my bank's website secure, if it uses partial HTTPS?

My (not so small) bank has a website for doing transactions over the internet, and it has an HTTPS website for it. But my Firefox 29 wrote that the website is just partially encrypted. I did a little ...