SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
1answer
32 views

How do SSL certificates become compromised after expiring [duplicate]

I'm reading into security issues surrounding SSL, and one of that has come up is certificate expiration. The general idea is that once a certificate expires, the site is insecure. What is the ...
3
votes
2answers
85 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
2
votes
1answer
54 views

Why is the first line of http message unreadable after decryption

I have a TLS Record containing HTTPs application data. I extracted the encrypted plain text with mac from the application data, then, when I decrypted the extracted data using AES CBC mode, I am ...
1
vote
0answers
7 views

Can usernames & passwords + client certificates exist in Activesync?

Every Activesync writeup I've seen, by MSFT or 3rd parties seems to encourage the deployment of client certificates with the "require" feature, as opposed to the "Accept/Optional" selection. I want ...
1
vote
1answer
39 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
2
votes
1answer
47 views

SSL communication between a C# Server and an Android Client App

I'm using a C# server and a C# tcp client example I extracted from the MSDN and I have created a self signed certificate using makecert.exe. I have got this to communicate with one another and it ...
0
votes
0answers
15 views

HTTP DoS prevetion with UFW firewall [migrated]

I am trying to creator an HTTP DoS attack on my servers using UFW firewall using this Resource. I edited /etc/ufw/before.rules to get the following rules. # # rules.before # # Rules that should be ...
-3
votes
0answers
27 views

TLS vs other security protocols [on hold]

I'm currently working on my bachelor thesis, and without going to much into detail the main mission is to develop the possibility for sending media (pictures, videos and recordings) from the app on ...
1
vote
1answer
78 views

mail.google.com identity doesn't match

I got This website doesn't supply identity information in firefox while browsing gmail.com, I understand that would be because I understand it is required when it needs to load content using ...
8
votes
1answer
238 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
0
votes
0answers
14 views

keytool commands to replace existing SSL certificate? [migrated]

I've a linux centos server running glassfish 3.1.2 app server. The default certs coming from GlassFish install for ports 4848 and 8181 are 1024 bits. I need to replace these with 2048 bits versions. ...
15
votes
2answers
296 views

Are the certificates from “skype click to call” and “avast! Web/Mail Shield” any better than superfish?

My Girlfriend has a years-old laptop from lenovo. I checked it over and wasn't surprised that the Superfish / Komodia Root CA certificate was not present. However I found some others that appear to ...
0
votes
0answers
16 views

TLSv1 dosnt work witout enabling the sslv2 [migrated]

I'm using Apache 2.2.4 version. i already know this version only support the sslv2, sslv3 and tlsv3. but something wired happens when i use it: when sslv2 is disable: the web browser (internet ...
2
votes
1answer
52 views

Is TLS enough to prevent eavesdropping? [duplicate]

Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?
13
votes
3answers
688 views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
0
votes
0answers
99 views

How actually Lenovo's Superfish works in general (step-by-step)?

There isn`t a clear, step-by-step explanation about Superfish adware here, all questions and answers are kind of specific for different aspects of it, but nothing in general. So, how Lenovo's ...
3
votes
2answers
33 views

Issues with using TLS Session Id for Web App Session?

Apache Tomcat has the ability to use the TLS Session ID instead of a session cookie or JSESSIONID in the querystring. My site is HTTPS Everywhere. This seems useful in that I don't have to worry ...
51
votes
4answers
6k views

Why was the private key of the Superfish certificate so easily extractable?

Robert Graham detailed on the Errata Security blog how he was able to get the private key of the Superfish certificate. I understand that attackers can now use this key to generate certificates of ...
2
votes
1answer
250 views

Contents of Lenova/Superfish certificate

I would like to examine the Lenova/Superfish root certificate being used in the wild. I've worked through articles like Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections, ...
2
votes
4answers
132 views

How safe is SSL on an untrusted computer and network?

In situations where the consumer doesn't trust/control the workstation and the network, can consumer safely do potentially sensitive activities (like making a payment or transferring confidential ...
1
vote
0answers
26 views

How can i know my security level as “ SSL 256 bit encryption” [duplicate]

I am using openssl tool to create certificate self-signed certificate I have known that [2048 bit SSL] it is the length of the public key then what about [256 bit encryption] how can i know type of ...
3
votes
0answers
59 views

Can serving HTTPS to Internet Explorer on Windows XP be made secure?

Answers to Why is HTTPS not the default protocol? state that a lot of sites still use clear HTTP instead of HTTPS because all of these are true: A substantial number of visitors to the site use ...
40
votes
3answers
5k views

How to detect if I am vulnerable to “Superfish,” and how to remove it?

The site has already a discussion of the security risks of "Superfish". It seems to me that anything that tampers with the bits of one's connection is bad. If it tampers with TLS connections, it is ...
2
votes
0answers
44 views

Decrypt TLS from an IDS

So I am trying to figure out what the packet payload is off of a possible TLS HeartBleed alert from my IDS. I have read that Wireshark is able to do it with some certain keys, but isn't that in real ...
52
votes
4answers
3k views

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
2
votes
2answers
128 views

SSL / TLS: Is a server always required to respond to a close notify?

I'm a developer and I'm implementing a socket connection with SSL (using javax.net.ssl.SSLEngine). For testing I'm opening connections to arbitrary HTTPS servers on the Internet to see how the ...
0
votes
0answers
15 views

VPS cloud data security encryption [closed]

I have a vps for personal projects, holding a blog , notes , some test applications Some of the notes etc have personal info. I have configured apache-ssl with snake-oil for transit. Should I do ...
1
vote
0answers
24 views

Startcom StartSSL + nginx client certificate

Startcom issues client certs. I'm using mine for seamless authentication in nginx as follows, in somewhat the same manner as was suggested by this Q/A: server { ssl_certificate ...
4
votes
3answers
131 views

What part of TLS specifies how to verify a certificate chain

I have sometimes run into a situation where I see a root CA certificate which is set to expire sooner than the intermediate CA certificate. My question is - if you were interested in keeping your ...
1
vote
1answer
73 views

Perfectly secure Postfix MTA (SMTP) configuration

I want to secure my root server (further) service by service, starting with the SMTP service (Postfix MTA) as the most busy one. I the course of setting everything up, I read a lot about security and ...
2
votes
1answer
115 views

Intercepting HTTPS Android app traffic

I'm trying to intercept Android application traffic from my Android phone....Basically what worked before was that i had simply installed fiddler proxy on my PC, exported the root certificate (and ...
2
votes
2answers
89 views

How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)

I'd like to have my server APIs only accept requests from my own app, to prevent other "rogue" clients of my service. As i understand it, the way to do this would be with a "client certificate" that ...
2
votes
1answer
66 views

Easy explanation of SSL client certificates for a developer

I've been thinking about using client certificates for my web apps, desperately hoping for security-conscious users to put their private key on HSMs so they don't get stolen even if the machine is ...
34
votes
8answers
5k views

Why do browsers default to http: and not https: for typed in URLs? [duplicate]

When I type example.com without any scheme into the browser bar and press Enter it is interpreted as HTTP://example.com, not HTTPS://example.com. Why? And where are the plans to fix this? (To be ...
5
votes
2answers
96 views

Prevent a desktop client application from abusing an API access token obtained through OAuth2 on behalf of an application

I have the following use case: I want to write a desktop application that makes use of a third-party API (e.g. Dropbox) This API requires an access_token to be sent to the server with each request. ...
2
votes
1answer
95 views

If your company/university requires you to install root certificates what protects you from man in the middle attacks?

Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is ...
3
votes
1answer
118 views

Is RDP susceptible to the BEAST attack?

I have Windows 2008 R2 servers which are failing a PCI vulnerability scan because they have RDP enabled (needs to be disabled). I have applied the PCI settings of IISCrypto tool, but I have to leave ...
1
vote
0answers
63 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just ...
0
votes
0answers
25 views

SSL certificate for Web App + website [migrated]

I have a WordPress + WooCommerce online store which is hosted on a managed hosting. I just bought non-wildcard SSL Certificate for that online store. I am also developing a CherryPy Python Web App ...
0
votes
0answers
35 views

Strict-Transport-Security header set, but Firefox and Chrome still using HTTP [migrated]

My website makes use of Universal SSL from CloudFlare and I would like to have the browser redirect to HTTPS automatically. However, as not all browsers support the type of SSL cloudflare uses, I ...
1
vote
1answer
59 views

Why don't very many HTTPS websites supply ownership information in their certs?

Why don't very many HTTPS/SSL websites supply identity information in their certs?
1
vote
3answers
57 views

Secure tunnel set up in an office environment

Suppose I am a rogue employee and I want to syphon some sensitive data out of the office and I only have office internet access for this. My office internet access needs to go through a proxy server, ...
27
votes
4answers
2k views

Can any CA sign any domain?

Can any CA sign any cert for any domain? If the answer is yes, what prevents having two different CAs creating a valid cert for the same domain? Does that mean that the whole TLS security has the ...
1
vote
1answer
67 views

In PSK TLS, how is the key used for encryption derived?

I'm trying to decrypt a message sent over a secure communication channel using TLS_PSK_WITH_3DES_EDE_CBC_SHA. I now have the client random number, server random number, PSK identity and PSK value. My ...
1
vote
0answers
23 views

Cannot disable RC4 [migrated]

I'm trying to disable RC4 ciphers by using this configuration on apache: SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 ...
0
votes
0answers
12 views

What ciphers do I need to disable in tomcat to match a specific apache conf? [migrated]

I have instructions to disable weak ciphers in apache by adding SSLCipherSuite ALL:!MD5:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM to my httpd.conf. I am actually running tomcat, and in my ...
1
vote
0answers
26 views

How to use Charles as proxy to decrypt HTTPS messages in Wireshark? [migrated]

I know I can view decrypted HTTPS data directly in Charles. But I want to view lower level SSL messages in Wireshark. So I setup Charles as the SSL proxy, using my own certificate, and I setup SSL ...
2
votes
1answer
64 views

Is an SSL/TLS HTTPS certificate 'fingerprinting' attack possible?

If you download a friend's site's unique HTTPS root certificate (independent of default browser-shipped ones), or you simply make a 'permanent exception' to an obscure self-signed cert, in Firefox, I ...
0
votes
0answers
34 views

refuse non ssl/tls connection? [migrated]

i have a webserver and I have enabled the apache2 ssl/tls. so I can access my website with "https://IPADDR". but i can also access with just "http://IPADDR". is it possible to block non-ssl/tls ...
22
votes
9answers
3k views

Why can protocols on higher layers be left unchanged?

In his answer to "How does SSL/TLS work?", Luc gives an explanation of how SSL works: SSL (and its successor, TLS) is a protocol that operates directly on top of TCP (although there are also ...