SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

2
votes
1answer
109 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
2
votes
1answer
136 views

What is “Multi-Protocol Unified Hello” and what are the impacts of disabling/enabling it?

This article describes how to disable old versions of TLS, but in addition to doing so, "Multi-Protocol Unified Hello" is also disabled. # Disable Multi-Protocol Unified Hello md ...
2
votes
1answer
456 views

HTTP Reverse Proxy: Correct way to do SSL to backend

If I have a HTTP reverse proxy that communicates with it's backends in an untrusted datacenter, or across datacenters, I would want to use HTTPS in the backend, as talked about here: Reverse Proxy ...
1
vote
1answer
256 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
0
votes
1answer
24 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
0
votes
1answer
46 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
0
votes
1answer
47 views

How does Matrix SSL perform certificate validation?

We use a custom app which uses Matrix SSL (client side) to perform certificate validation on MAC and Linux systems. My question is, does Matrix SSL keep a cert store cache of intermediate and trusted ...
0
votes
1answer
195 views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...
0
votes
1answer
116 views

Is keystore file(server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I did to generate .p7b file. I generated jks(java keystore) file using below ...
0
votes
1answer
184 views

Does an HTTPS proxy encrypt traffic between proxy client and server for HTTP requests?

To bypass censorship in a DIY fashion, I plan to set up private proxies for my personal use. One of the possible methods I would try is to use an HTTPS proxy (not a web proxy, to be explicit) hosted ...
-1
votes
1answer
73 views

How does SSL client authentication work?

I read the RFC document, it mentioned that there are some kinds of client certificate type. So I don't understand what does this type mean. For a instance, one type named rsa_fixed_ecdh, it said, the ...
-3
votes
1answer
100 views

What are the risks if a weak ciphers are accepted by a technology that uses SSL

The TLSSLed tool found that the host that I use has SSL connection that accepts 8 different TLSv1 and SSLv3 ciphers that are weak by their length (40 bits). How can an attacker exploit this fact?
3
votes
0answers
139 views

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? ...
2
votes
0answers
69 views

Threats against website running without TLS but with PGP messages

Are there any threats against a web site that isn't running SSL but uses PGP to encrypt all information to the server (except session identifier) The information flow is as such: 1. Session ID set on ...
2
votes
0answers
165 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
2
votes
0answers
394 views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
2
votes
0answers
226 views

What is going on with my download of the recent Apple security update?

The update in question is the Mavericks combined update which, among other things, claims to fix the recent SSL vulnerability/gaping hole. This issue really annoyed me, so I decided to procure ...
2
votes
0answers
60 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
1
vote
0answers
25 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
1
vote
0answers
29 views

Is there a way to restrict hls key file served by cloudfront (over https) to only authorized users

I have a video file which is distributed after hls packaging and encrypted using aes 128. Since HLS key url is part of the m3u8 file I have to restrict the delivery of key file only to authorized ...
1
vote
0answers
74 views

Secure login procedure

I have implemented a login, and session, procedure for a web app and I am wondering whether what I have implemented is secure enough. The authentication is based on login password on https. If the ...
1
vote
0answers
51 views

Self signed certificate on application server behind web front end

I have a Tomcat application which is front ended by an Apache web server - end users connect to the Apache web server (never directly to Tomcat) and Apache has a valid, externally issued SSL etc The ...
1
vote
0answers
46 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
1
vote
0answers
464 views

GnuTLS ServerHello exploit (CVE-2014-3466) - how to verify?

So pretty much all of the GNUTLS world is worrying about CVE-2014-3466. I checked my Kali and it responds with this - # apt-cache rdepends libgnutls26 | grep -v lib Reverse Depends: ...
1
vote
0answers
57 views

Are any major websites offering ECDSA authentication?

At the time the Cloudflare blog post “ECDSA: The digital signature algorithm of a better internet” was authored, Cloudflare was apparently one of "fewer than fifty" users of ECDSA certificates on the ...
1
vote
0answers
180 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
0answers
292 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
0answers
30 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
1
vote
0answers
90 views

Strange TLSv1.2 Handshake

I noticed a strangeness in the TLS 1.2 Handshake and I don't know if I'm missing something. As you can see in this screenshot, the browser (Chrome) puts the value 0x0301 as version in the Record ...
1
vote
0answers
214 views

Designing a security and encryption strategy for MongoHQ

I'm trying to design the best strategy to achieve the following goals: Securing data-on-the-wire between my server and MongoHQ. Encrypting all data-at-rest with MongoHQ (possibly key values as ...
1
vote
0answers
41 views

TLS with non-repudiation; what happened with 'TLS Sign'?

TLS Sign was proposed as an IETF Draft in June 2007. http://tools.ietf.org/html/draft-hajjeh-tls-sign-03 I did not found further information, besides that the draft expired in November 2007. Can ...
1
vote
0answers
117 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
0answers
112 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

I've started thinking about how to approach analyzing my network traffic for information relating to SSL and browser usage for my web server farm. I also suspect there are some shadow (legacy, ...
1
vote
0answers
182 views

Should I tunnel multiple TCP connections through a TLS/SSL tunnel or use TLS/SSL for each connection?

I am developing an application that runs on Windows PCs. The application is able to connect to some kind of devices within a LAN. It can create multiple TCP-connections to the device it is connected ...
1
vote
0answers
354 views

Safe communication via rest api between two known servers

i would like to have some advice on the following scenario: I'm using kinvey as backend but because it doesn't provide the ability to run custom code i have set up another server. So basically when x ...
1
vote
0answers
320 views

Does ZRTP provide useful protection, given that the SAS is not verified?

Firstly, some important backstory. I'm producing a corporate version of an IM/VOIP/Screensharing client using the Open Source Jitsi. We are going to be using a central server and have already ...
0
votes
0answers
36 views

CA Flag in SSL certificate

I have an web portal running as a POC purpose, and then i have a mobile apps to access this web portal. Since it's a POC, I just generate a self-signed SSL cert and load it inside the Web and my ...
0
votes
0answers
39 views

How to convert SSL Certificate for mobile app?

I am in the current process of renewing my SSL cert for my website. I also have a mobile app for my site. I want to use the same cert from my website in my mobile app. How can I do this? Thanks - I ...
0
votes
0answers
29 views

securing my API: concept of accesstokens

first of all I want to excuse for the bad spelling and grammar. English is not my mothertongue. I have built a JSON communication between frontend(website) and my NodeJS webserver. I want to keep in ...
0
votes
0answers
39 views

I Need Wireshark Confirmation on Full Implementation of SSL for YouTube

I've just noticed today that YouTube have implemented SSL over the entire service (including video transfer). I've analyzed the partial SSL YouTube had before and it encrypted the video request but ...
0
votes
0answers
33 views

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or ...
0
votes
0answers
37 views

What are the risks of submiting from iframe to a SSL site?

I have a SSL site where a user can select items to purchase, register and pay. For payment, the user is redirected to a payment gateway. Once the payment is completed, the user is redirected to our ...
0
votes
0answers
34 views

Key differences between IPSec and HAIPE?

HAIPE is derived off IPSec but can someone draw up the differences between using IPSec with Suite B crypto and HAIPE with Suite B? We can drop Suite A or classified info for this question; staying ...
0
votes
0answers
52 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
0
votes
0answers
126 views

Socket.IO & WebSocket security - query certifcate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
0
votes
0answers
44 views

ARR Server and SSL Offloading

we want to implement ARR server in our WAN. the SSL offloading feature is enabled on ARR server. Since SSL offloading terminates encryption , we want to secure connection between ARR server and data ...
0
votes
0answers
41 views

Strange Finished Message in TLS

I've tried to understand the content of the Finished Message of TLS. I'm using wireshark to capture the traffic between my browser and the internet. I noticed a "stangeness" when the chosen ...
0
votes
0answers
50 views

Central Authentication Server

I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication ...
0
votes
0answers
23 views

DTLS CertificateVerify doubt

In DTLS 1.2 RFC 6347, section 4.2.6: CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: ...
0
votes
0answers
299 views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...