Tagged Questions

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

26
votes
3answers
2k views

Is there a security issue in using the same certificate for all a company's services?

We are a small startup. One of our products is a B2B web service, accessible through its https://service.example.com canonical URL. For testing purposes, that service also runs on different ...
0
votes
1answer
58 views

SSL question TLS response in TCP

After some careful looking at one .pcap of my network i would like to undestand why a request appears on the communication like IP [TLS Application Data] Application Data Protocol: http Version ...
0
votes
1answer
71 views

Is it possible to inject information into a clients TLS session cache?

Hypothetically speaking, could an attacker run a targeted attack on a network that would inject information into a victim's cache of recent TLS connections? Specifically, the master-key and sessionID ...
23
votes
3answers
3k views

For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?

Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially: The problem: Attacker sets up a WiFi spot. User enters our site ...
1
vote
2answers
62 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
0
votes
2answers
146 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
2
votes
2answers
83 views

How can one secure Exchange 2010 cookies?

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
5
votes
1answer
214 views

How safe can connecting to VPN really be?

I would like to make this story as short as possible since my question is not that long, I have worked with journalists previously in war zone where we investigated the involvement of EU IT companies ...
1
vote
1answer
53 views

Early ChangeCipherSpec Attack

For the early ChangeCipherSpec attack, the attack would affect client with all version of OpenSSL and server with OpenSSL version 1.0.1 and above. My question: If two mail servers are communicating ...
4
votes
2answers
250 views

Why do the banks all use weaker TLS suites? [closed]

I've been checking out various TLS certificates lately and noticed that most of the banks seem to have the following two issues: 1) They do not offer perfect forward secrecy 2) They are still using ...
23
votes
9answers
4k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
1
vote
1answer
69 views

How to convert SSL Certificate for mobile app?

I am in the current process of renewing my SSL cert for my website. I also have a mobile app for my site. I want to use the same cert from my website in my mobile app. How can I do this? Thanks - I ...
10
votes
4answers
1k views

Can ISP block HTTPS selectively? [duplicate]

Can ISP block HTTPS selectively i.e. certain websites cannot be accessed using HTTPS while others can be ?
0
votes
1answer
41 views

Forward Secrecy not supported with referenced browsers?

I am running a scan against one of our servers from the Qualys SSL tester site and it says that my server "does not support forward secrecy with the referenced browsers". What exactly does that mean? ...
-5
votes
2answers
43 views

how do vpns secure the encyption key? [closed]

VPNs are accessed by the user with credentials so that the information is encrypted. There are credentials that you download to allow this. Since you don't physically, in person get the credentials ...
10
votes
4answers
665 views

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? ...
1
vote
2answers
72 views

Relying on openssl's certificate authority list or provide my own

My apologies if this is too subjective, but I am looking for advice on best practices. We maintain a small program written in Python that runs on our customers' servers and communicates back with our ...
0
votes
2answers
106 views

https login iframe 2014

Per current security recommendations & browser support, is it okay to have an https iframe in an otherwise http-only set of pages? Is this not a dupe? It is, but I want current trends because ...
0
votes
1answer
61 views

Why do certificate authorities often require/use multiple intermediates?

I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway. Why do most modern certificate authorities (e.g. ...
0
votes
0answers
40 views

securing my API: concept of accesstokens

first of all I want to excuse for the bad spelling and grammar. English is not my mothertongue. I have built a JSON communication between frontend(website) and my NodeJS webserver. I want to keep in ...
2
votes
2answers
131 views

How can I secure my api to avoid copying?

Im building an app which should receive data from my server. The Api should be a PHP based script which provides the data as JSON. However I want to keep the data private and it should only be ...
22
votes
3answers
7k views

Why is “www.” considered unsafe in this HTTPS URL?

I was doing some cross-origin requests to Soundcloud's oEmbed and I noticed some strange behaviour. When doing a request from my localhost, which is on a regular HTTP connection, everything worked ...
12
votes
4answers
1k views

Downsides to using HTTPS [duplicate]

Recently Google has indicated that a HTTPS certificate will be used as a positive signal in it's search rankings. This has caused some discussion within our company as to if we should apply a HTTPS ...
0
votes
2answers
92 views

Printer SSL certificates [closed]

Is a printer SSL cert really necessary if you just print? I don't use https for any administration; just http. I got a vulnerability saying that my cert was out of date.
1
vote
2answers
109 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
2
votes
2answers
290 views

It is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place?

I have the following question regarding the decryption of SSL traffic. The topology that I have in mind is like this: User-------MitM Proxy--------WebServer In the environment described earlier there ...
-5
votes
1answer
679 views

How to decrypt the encrypted data, in SHA256, of mysql database? [closed]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
1
vote
2answers
90 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
2
votes
3answers
335 views

Free second-level domain SSL certificate [closed]

With CAcert.org losing trust in browsers and OSs and StartSSL providing only top-level domain certificates, are there any free SSL certificates providers for second-level domains?
0
votes
1answer
120 views

What would cause a server to only send over 1 SSL certificate to a client? [closed]

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
2
votes
1answer
53 views

API request modification

I am building an API that returns data about companies Multiple applications will access the API, some of these applications will have access to one company, some to multiple companies. When a request ...
1
vote
2answers
61 views

Can I change the CSR of my SSL certificate?

I have 2 SSL certificates that are generated and being used for our staging and development server. However, we wish to change the roles of these two servers. currently the staging server is using ...
3
votes
2answers
537 views

What is the difference between EV-SSL certificates and Normal SSL certificates? [duplicate]

Recently while looking at several banking URLs I can see the domain name with security certificate at address bar and normal locker security certificate at address bar. Have a look at the screenshots: ...
1
vote
2answers
338 views

Client-server encryption technique explanation (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 128 bit keys)

I opened a web page using https. When I looked at the page info provided by my browser (Firefox) I saw following: Connection encrypted: High-grade Encryption ...
0
votes
1answer
1k views

This certificate has an invalid digital signature

I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. ...
2
votes
1answer
97 views

Drawbacks to only using TLS 1.2 ciphers in OpenSSL

I understand you would not want to do this as it would limit compatibility for older devices and platforms. However if someone were in an all TLS1.2 environment, say a very well managed internal ...
1
vote
2answers
80 views

Can you use https only for cookies and not the html?

I have a few questions, all relating to the title. 1) Is it possible to configure a server to receive the cookies using https but then serve all the content with http? 2) Does SE do this / do many ...
0
votes
0answers
68 views

I Need Wireshark Confirmation on Full Implementation of SSL for YouTube

I've just noticed today that YouTube have implemented SSL over the entire service (including video transfer). I've analyzed the partial SSL YouTube had before and it encrypted the video request but ...
0
votes
1answer
442 views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
0
votes
0answers
97 views

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or ...
0
votes
1answer
174 views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
3
votes
2answers
57 views

Standard practice for distributing server certificate for users

I have a Winforms app that users have to download and install on their machines. It connects to a WCF service(using SSL), hence requires the server certificate to be installed on users' Trusted ...
3
votes
2answers
90 views

What is the point of secure email gateways?

We run Exchange 2010. Our edge servers run "passive opportunistic TLS" for 99% of the domains we communicate with. For a handful of domains, we have forced TLS on both our end and the other domain's ...
2
votes
1answer
226 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
1
vote
2answers
99 views

Does where I put my PKI certificates matter?

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were ...
1
vote
0answers
28 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
2
votes
4answers
826 views

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
1
vote
0answers
55 views

Is there a way to restrict hls key file served by cloudfront (over https) to only authorized users

I have a video file which is distributed after hls packaging and encrypted using aes 128. Since HLS key url is part of the m3u8 file I have to restrict the delivery of key file only to authorized ...
1
vote
1answer
74 views

Would it be possible to use cookie to store SSL Client Certificate?

Lately, I was reading that article about SSL client certificate. Why is nobody using SSL Client Certificate? The answer was to that question was : In the current state, this excellent idea is ...
3
votes
2answers
587 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...