Tagged Questions

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
0answers
28 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
2
votes
4answers
585 views

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
1
vote
0answers
48 views

Is there a way to restrict hls key file served by cloudfront (over https) to only authorized users

I have a video file which is distributed after hls packaging and encrypted using aes 128. Since HLS key url is part of the m3u8 file I have to restrict the delivery of key file only to authorized ...
1
vote
1answer
72 views

Would it be possible to use cookie to store SSL Client Certificate?

Lately, I was reading that article about SSL client certificate. Why is nobody using SSL Client Certificate? The answer was to that question was : In the current state, this excellent idea is ...
3
votes
2answers
485 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
0
votes
1answer
939 views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
1answer
218 views

Browser and SSL support

According to http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers most browsers support SSL 3.0. And with my understanding (please correct me if I am wrong), when a browser just ...
2
votes
1answer
56 views

TLS 1.2 Older Browser Compatibility

We are in the process of upgrading our webservers to support TLS 1.2 but I have heard rumor of very old browsers, such as those used as kiosks will fall over when trying to connect to a server that ...
1
vote
2answers
60 views

Is it Possible to use one commercial SSL Certificate to issue end user certs?

My organization is preparing to purchase some 50 "units" from Symantec, with which we can purchase Verisign SSL certificates of varying authentication levels. Our organization does not have--but ...
0
votes
0answers
45 views

What are the risks of submiting from iframe to a SSL site?

I have a SSL site where a user can select items to purchase, register and pay. For payment, the user is redirected to a payment gateway. Once the payment is completed, the user is redirected to our ...
1
vote
1answer
154 views

Is the limited elliptic curve support in rhel/centos/redhat openssl robust enough?

Redhat finally gave in after insisting for years that elliptic curves had patents and disabling them, recently enabling a whopping three algorithms: CentOS 6.5 openssl ecparam -list_curves ...
1
vote
1answer
55 views

Entering payment information in Android Apps

I'm concerned how android apps that integrate payment processing deal with secure financial information.When purchasing through these apps the apps show the Webpage of the bank asking for credentials. ...
8
votes
1answer
781 views

How to convert http site to full https? [closed]

I have a site running only with http. I have decided I want to go full https, but I have no idea how to do this. Do I have to buy that certificate somewhere? Where, how much does it cost? Does it ...
4
votes
4answers
357 views

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
1
vote
1answer
88 views

Self-signing client certificates and distributing them, is the following a sound procedure?

I have a case at hand as follows: There is a number of clients in Internet (i.e. untrusted channel), initially in hundreds but growing in numbers. There is a server doing processing related to these ...
-1
votes
2answers
96 views

Installing self-made cert as trusted CA on windows?

I'm looking into using mitm-proxy, but part of the process of filtering/snooping SSL is that you must generate and install a root cert as a trusted CA, so that mitm-proxy can generate and throw out ...
2
votes
0answers
232 views

Why does Google allow non-HTTPS searches? [closed]

I found today that Google allows you to reach its search engine and submit searches over non-https connection. Visiting http://google.com, results in a redirect to the URL ...
0
votes
3answers
118 views

Safety of Password Hashing Using bcrypt Done on Client Side

I am currently using a technique where I send the username/password in cleartext (using https) to the server, which then does bcrypt and compares to the db. Standard practice. It is considered safe. ...
6
votes
2answers
127 views

HSTS behaviour within incognito mode?

By definition, incognito mode shouldn't leave a trail of visited websites. However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, ...
46
votes
11answers
5k views

Is there ever a good reason _not_ to use TLS/SSL?

While writing an answer to this question on Server Fault, a thought that has been bouncing around my head for quite some time resurfaced again as a question: Is there ever a good reason to not use ...
1
vote
3answers
844 views

How to get private key used to decrypt HTTPS traffic sent and received from my own browser with wireshark

I am working with a website that sends API requests. I would like to write a client to make the requests myself, but in order to do so I would need to first see the request payloads. However, the ...
0
votes
1answer
167 views

Native app, token authentication without login/password

I'm working on a always online mobile game (native android/iOS app with Unity) and i would like to be able to authenticate the player without requiring any login/password at the beginning. For those ...
0
votes
1answer
90 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
0
votes
2answers
149 views

Apache Server Maintains HTTPS Connection To Mysterious Server (Hijacking?)

I've been on a shared webhosting plan for 10 years and I recently moved all of my sites (various WordPress sites and associated plugins, all in PHP, a MediaWiki site, and a lot of static stuff) to my ...
0
votes
1answer
115 views

Reverse proxy sharing one certificate for multiple servers using Subject Alternative Name

The following is a scenario for an attack where one website can impersonate another. I am told (including by this answer) that it's impossible, but I would like to understand exactly what prevents it. ...
1
vote
0answers
85 views

Secure login procedure

I have implemented a login, and session, procedure for a web app and I am wondering whether what I have implemented is secure enough. The authentication is based on login password on https. If the ...
0
votes
1answer
56 views

Can an individual get an extended validation certificate?

I am not saying I am actually going to buy one but I am wondering if an individual can get an Extended Validation SSL certificate? I know this is intended for companies / organisations but would this ...
0
votes
1answer
87 views

Is my understanding about how SSL works correct?

I've been reading about 2-way SSL or mutual auth recently, and here's what I've figured so far: Mutual auth is a way for the client to authenticate itself to the server, just like the server does to ...
0
votes
1answer
34 views

Does openssl store the certificate of the server after verification is done?

As per my understanding , openssl will verify the certificate of the server during ssl handshake , using the trusted CAs present in the CA certificate dir in the context. After the server certificate ...
49
votes
6answers
7k views

Is it safe to send clear usernames/passwords on a https connection to authenticate users?

I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps). I'd like to allow access only to certain users and I'm considering using a ...
0
votes
1answer
176 views

Bitdefender Antivirus SSL Cert substitution

I am using Bitdefender AV 2013 ed and I have noticed that when the Scan SSL is enabled in the configuration BD will use a local certificate, as mentioned here. This modifies the cert chain with BD as ...
-2
votes
1answer
50 views

Can OCSP stapling reduce or eliminate the weaknesses inherrent with OCSP? [closed]

Specifically, the problems with OCSP that Adam Langley talks about here?
1
vote
1answer
179 views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
39
votes
6answers
6k views

How does a country block/censor an encrypted website (HTTPS)?

Given that Site X uses HTTPS, how can it be blocked by a country? My browser reads: 128-bit encryption | ECDHE_RSA as key exchange. I say it's blocked since when I use Tor, it works fine. One ...
0
votes
2answers
82 views

How does Matrix SSL perform certificate validation?

We use a custom app which uses Matrix SSL (client side) to perform certificate validation on MAC and Linux systems. My question is, does Matrix SSL keep a cert store cache of intermediate and trusted ...
1
vote
2answers
155 views

How do proxy servers protect their SSL certificates?

Suppose that there is a http proxy server outside the firewall of an organization hosting a web server. All client connections to the web server happen through this proxy. The client negotiates SSL ...
8
votes
2answers
536 views

How are browsers able to find and construct an alternate trusted chain path?

We had a web server that had the wrong SSL certs installed yet the browser was able to find another trusted path to a root and supply the page properly over HTTPS. We also have proprietary software ...
1
vote
2answers
140 views

Will an IP packet to the own IP address ever leave the computer? [duplicate]

I am working on a system that consists of several applicaitons communicating with each other. Some of these applications will run on the same server and some will run on a different one. So there is ...
1
vote
1answer
108 views

Server + Client certificate vs Server certificate + Client password

There are three different ways how TLS (1.2) can be used: server and client authenticate, only the server authenticates or neither authenticates. If neither server nor client authenticates using a ...
0
votes
1answer
108 views

How do SSL/TLS certificates work?

I'm trying to understand how SSL/TLS certificates work, but I'm missing something. I have obtained my current understanding from this website: ...
7
votes
2answers
355 views

How can we revoke all ssl certificates issued for our domain?

After having the hostmaster@domain.com email compromised, we found that someone issued a Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked. Is there ...
2
votes
1answer
116 views

TLS WG Charter and Security Goals

I was looking at the TLS Working Group Charter. I noticed that confidentiality and integrity of messages for those who desire it are not goals for the group. Naively, I believe confidentiality and ...
0
votes
2answers
200 views

client SSL authentication .pem file and .crt files

So I have minimal knowledge of security really but I'm a primary developer on an application which handles some sensitive data that we want to be secure. The application communicates with one other ...
1
vote
0answers
93 views

Self signed certificate on application server behind web front end

I have a Tomcat application which is front ended by an Apache web server - end users connect to the Apache web server (never directly to Tomcat) and Apache has a valid, externally issued SSL etc The ...
0
votes
2answers
77 views

Encryption mechanism

I want to send data over the Internet securely. For that, I am using an public key of the receiver to encrypt the data. In this case, if an intruder in the network modifies the data, like placing the ...
0
votes
1answer
223 views

How is the Premaster secret used in TLS generated?

I believe that it uses some combination of the random values sent in the hello messages. From RFC 2246: (TLSv1.0) RSA encrypted premaster secret message Meaning of this message: If RSA is ...
0
votes
1answer
47 views

EAP-TLS fragmentation implementation

I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a ...
1
vote
1answer
109 views

How to force browsers to accepte all further SSL certificates

I am using the last versions of IE, Firefox and Google Chrome web browsers on Windows 8. How can force these browsers to accept automatically the SSL certificates of any website I will visit ? I know ...
2
votes
2answers
128 views

When visiting an HTTPS page for the first time, why isn't there a prompt for the certificate?

I installed a fresh Windows 7. I wonder why when I visit website using HTTPS, I do not get asked to accept their certificate like shown on this picture:
13
votes
5answers
2k views

Can sites which check your password as you type pose a security risk?

Some sites that I use check my password as I type it into the login (not registration) form. So, for example, to begin with I might have: Username: sapi ✓ Password: passw × and by the time I've ...