SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

1
vote
2answers
36 views

Can you sniff traffic to ip address from outside of your network?

I am not sure what it is called or even if it is possible but here is the scenario I am curious about: I login to a site that does not use SSL/TLS to do some work (unfortunately I must use this site ...
2
votes
3answers
66 views

SSLv3 HandShake but TLSv1 client hello

I am trying to understand the handshake protocol, when we had our ssl debug mode on we saw that the handshake is SSLv3, but the Client Hello as TLSv1. http-8443-14, READ: SSLv3 Handshake, length = 87 ...
1
vote
0answers
9 views

Client Authentication with DH cert example using openssl command line

I want to perform client authentication with DH certificate from client side using openssl command line tool. when i am running server and client as below client is not taking certificate provided ...
-1
votes
0answers
116 views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
1
vote
2answers
83 views

Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?

Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs. Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
0
votes
0answers
18 views

Java Updates Restrict Unsafe SSL Renegotiation With Active Directory Servers

We have two active directory (AD) hosts, ead01.domain.com and ead02.domain.com; we also have a corresponding service domain, at eadauth.domain.com which round-robins between these AD hosts (via DNS). ...
2
votes
2answers
117 views

Is plain text over https really a good idea? [duplicate]

Sending plain text passwords over https is quite secure, the traffic is encrypted, making eavesdropping virtually impossible. However, once on the server side, it is still plain text. Of course, ...
1
vote
3answers
53 views

IDS over HTTPS connection

I am designing an anomaly-based intrusion detection system in java. It basically consists of a sniffer that identifies HTTP header fields and then analyze them according to a previous configured XML ...
4
votes
1answer
254 views

POODLE and TLS…not SSL

In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent ...
1
vote
1answer
31 views

End-to-end encryption with a reverse proxy and an application server

Lets say that I have an nginx reverse proxy that proxies the traffic to a Tomcat on the same server. I think the most common way to configure this setup is to enable SSL on nginx and then proxy the ...
0
votes
1answer
40 views

Secure no-login REST API for very few clients

I'm designing a very simple data collection device for a research project. Because we are logging, among other stuff, the GPS position of actual vehicles, we need to protect the data. Since we ...
1
vote
1answer
74 views

HIPAA vs. HTTPS

In the medical/pharmaceutical space as part of legal operating requirements, everyone has to comply with HIPAA standards ( http://health.state.tn.us/hipaa/ ) for moving personal medical information ...
22
votes
6answers
2k views

Possibility to sniff HTTPS traffic on devices without installing a certificate

My goal is to sniff the HTTPS traffic of some digital devices (AppleTV, game consoles, etc.), and decrypt the HTTPS packets in my local network. I cannot figure out a way by using some HTTPS ...
1
vote
1answer
55 views

How strong is the performance impact of signing when using RSA_AES_256_ECDH

To encrypt web communication, I use SSL with a RSA key with a length of 2048 bit, AES key's with a length of 256 bit and the ECDH-algorithm for the negotiation of the AES key's (or to exchange the ...
2
votes
1answer
89 views

Why do major sites(Facebook, Google, etc) still send passwords unhashed? [duplicate]

QUICK SUMMARY: It seems like modern websites, for security's sake, should all have the client hash their own passwords before sending them to the server, who will rehash them, in order to avoid ...
1
vote
0answers
34 views

How to implement secure client-server communication over https using python and m2crypto?

I want to secure the communication between a server and multiple clients. The communication goes this way: The client connects to a specific page at the server and checks for a software version. ...
2
votes
1answer
84 views

Are there any client-side mitigations for FREAK?

While we wait for patches to address the TLS FREAK vulnerability, is there anything relatively straight forward on the client-side that can be done to mitigate the risk in the meantime?
0
votes
1answer
65 views

How NSA intercepts the traffic beyond ssl [on hold]

According to this link, when you send an email or otherwise use the internet, the data travels from your computer, through telecommunication companies' wires and fiber optics networks, to your ...
1
vote
1answer
582 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
9
votes
4answers
2k views

In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as has been clarified ...
1
vote
0answers
25 views

How can I view the Chrome padlock SSL certificate information in Chrome Mobile on Android? [migrated]

When I'm on my Desktop Chrome, I can click on the padlock icon in the address bar and see the information about my SSL connection, like the TLS version, the certificate strength, the authority that ...
0
votes
0answers
3 views

Jradius Client : Invalid or unexpected EAP payload received [migrated]

I am trying to integrate with jradius client to communicate with Cisco ISE server for EAP-TLS authentication. I ran a sample test and below is the issue I am seeing in ISE logs: "TLS packet parsing ...
2
votes
3answers
47 views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
3
votes
1answer
49 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
0
votes
0answers
25 views

why tor nodes maintain tls keys with all other tor nodes?

I read that tor proxy maintains session key with tor nodes and use it while encrypting data but why tor nodes maintain keys with other tor nodes?
0
votes
0answers
14 views

Did anyone encounter a problem with ssl certificate from network solutions on mobile device? [migrated]

We have a mobile app that calls Web Service on our server. We are planning to setup ssl on the server and going to buy a wildcard certificate from network solutions. Wildcard certificate from Network ...
1
vote
1answer
107 views

Completely getting rid of SSLv3 on Apache

Our security team is asking that we completely disable SSLv3 on some of our servers running Apache. I've used the SSLProtocol entry in the ssl.conf file (like SSLProtocol ALL -SSLv2 -SSLv3) and ...
1
vote
1answer
35 views

Protecting the root ca bundle

Applications (e.g. Firefox) often include a root ca bundle file containing trusted certificates. How can I protect those files from malicious agents trying to modify them? I think signing is not an ...
2
votes
1answer
39 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
-5
votes
0answers
56 views

Link to more active security sites? [closed]

I have a BS/MS in Computer Science and have worked as a developer for 15 years. Currently I have been reading a lot about computer security. Serverfault and Stackoverflow seem to be the go to place ...
0
votes
0answers
25 views

Choosing a SSL Certificate Issuer [duplicate]

I am going to buy a new ssl certificate that supports SHA2 algorithm for our web services. Web services will be used by variaous java clients written in java6, java7 and java8. We have got a ssl ...
8
votes
2answers
681 views

Question About HTTPS Security [duplicate]

I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong. I got to know that as part of ...
1
vote
0answers
26 views

Imported CA certificate to Firefox Browser not working [migrated]

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
1
vote
3answers
107 views

How to make a secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces, one is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
0
votes
1answer
45 views

How do SSL certificates become compromised after expiring [duplicate]

I'm reading into security issues surrounding SSL, and one of that has come up is certificate expiration. The general idea is that once a certificate expires, the site is insecure. What is the ...
3
votes
2answers
105 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
2
votes
1answer
72 views

Why is the first line of http message unreadable after decryption

I have a TLS Record containing HTTPs application data. I extracted the encrypted plain text with mac from the application data, then, when I decrypted the extracted data using AES CBC mode, I am ...
1
vote
0answers
10 views

Can usernames & passwords + client certificates exist in Activesync?

Every Activesync writeup I've seen, by MSFT or 3rd parties seems to encourage the deployment of client certificates with the "require" feature, as opposed to the "Accept/Optional" selection. I want ...
1
vote
1answer
44 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
2
votes
1answer
91 views

SSL communication between a C# Server and an Android Client App

I'm using a C# server and a C# tcp client example I extracted from the MSDN and I have created a self signed certificate using makecert.exe. I have got this to communicate with one another and it ...
0
votes
0answers
15 views

HTTP DoS prevetion with UFW firewall [migrated]

I am trying to creator an HTTP DoS attack on my servers using UFW firewall using this Resource. I edited /etc/ufw/before.rules to get the following rules. # # rules.before # # Rules that should be ...
1
vote
1answer
90 views

mail.google.com identity doesn't match

I got This website doesn't supply identity information in firefox while browsing gmail.com, I understand that would be because I understand it is required when it needs to load content using ...
9
votes
1answer
290 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
0
votes
0answers
14 views

keytool commands to replace existing SSL certificate? [migrated]

I've a linux centos server running glassfish 3.1.2 app server. The default certs coming from GlassFish install for ports 4848 and 8181 are 1024 bits. I need to replace these with 2048 bits versions. ...
16
votes
2answers
374 views

Are the certificates from “skype click to call” and “avast! Web/Mail Shield” any better than superfish?

My Girlfriend has a years-old laptop from lenovo. I checked it over and wasn't surprised that the Superfish / Komodia Root CA certificate was not present. However I found some others that appear to ...
0
votes
0answers
16 views

TLSv1 dosnt work witout enabling the sslv2 [migrated]

I'm using Apache 2.2.4 version. i already know this version only support the sslv2, sslv3 and tlsv3. but something wired happens when i use it: when sslv2 is disable: the web browser (internet ...
2
votes
1answer
60 views

Is TLS enough to prevent eavesdropping? [duplicate]

Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?
13
votes
3answers
721 views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
1
vote
0answers
107 views

How actually Lenovo's Superfish works in general (step-by-step)?

There isn`t a clear, step-by-step explanation about Superfish adware here, all questions and answers are kind of specific for different aspects of it, but nothing in general. So, how Lenovo's ...
3
votes
2answers
39 views

Issues with using TLS Session Id for Web App Session?

Apache Tomcat has the ability to use the TLS Session ID instead of a session cookie or JSESSIONID in the querystring. My site is HTTPS Everywhere. This seems useful in that I don't have to worry ...