SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
0answers
11 views

message integrity under ssl connection [duplicate]

I read this article which is a great article to everyone wants to know how SSL works but still I have one other thing which I want to know about the communication using the SSL layer, my question is ...
0
votes
1answer
21 views

Any way to get high quality live proxies other than buying them from a website?

Free & public proxies are not safe when transmitting sensitive info, but even if they were are much too slow. I can't purchase due a potential security risk. I looked into and tried proxy ...
4
votes
2answers
41 views

What are the use cases for anonymous SSL cipher suites?

SSL supports several anonymous cipher suites such as TLS_DH_anon_WITH_AES_256_GCM_SHA384. When these are used, no authentication is performed and no certificates are exchanged. This means that if they ...
0
votes
1answer
16 views

TLS record layer implementation

I have some general confusion about TLS protocol. One question is about session id. Should a session id inside the TLS hellomessage have a session id length field? I do not read anything about it in ...
0
votes
4answers
56 views

Are credentials sent via plain text to HTTP proxy?

If a proxy server requires authentication, and that proxy communicates over HTTP, are the credentials sent over plain text to the proxy server? If this is the case, isn't it possible to sniff the ...
-1
votes
0answers
36 views

How can I use my WIFI for businee and mange it whom to connect from my pc? [on hold]

I am running a cybercafe... I wish to charge for the wifi within this cafe, how is this possible? I am thinking of the easier alternative of manually allowing user through the routers admin panel. ...
0
votes
0answers
53 views

Intermediate proxy intercepting my SSL data between my computer and the ISP

I did a simple scan of my linux firewall today using grc.com's shieldsup on their website (https://www.grc.com/x/ne.dll?bh0bkyd20). Previously when doing this it shows I have full stealth but today it ...
0
votes
2answers
31 views

Is there any security implication of using WebRTC over unencrypted channel for streaming?

I've spend a few hours reading about WebRTC and everywhere it's recommended to use a secure connection for contacting with the signal server, so no MitM attacks could be possible. However, my project ...
1
vote
1answer
87 views

How would a SSL tunnel be exploited?

I am looking at our CI (Bamboo) Server initiating an outbound connection to setup a SSL tunnel to an agent running on an AWS ec2 instance. As per the documentation: All traffic sent between the ...
3
votes
2answers
86 views

Risks of securing REST API using SSL?

We are thinking of building a REST API where all calls are over SSL. After successful login subsequent calls will include a token which was returned by the login service. The server will validate ...
11
votes
2answers
795 views

Are SSL browser sessions kept alive across requests?

When a client requests an SSL web resource via a browser (ie: a login request) and then follows up with additional requests are all the requests executed in the same SSL session? Or does the browser ...
10
votes
3answers
2k views

Can I read the domain name from HTTPS before SSL handshake?

I am researching if I can host multiple domains on one server through HTTPS but for each domain, I have a different certificate. In this case, I would need to know the domain of the incoming ...
4
votes
0answers
20 views

SSL 3.0 for clients without room for chosen plaintext attacks

I've collected the issues that affect SSL 3.0 and found that they are either configuration issues (disabling RC4, RC2, DES, anon, export, null suites, compression, proper key lengths, etc.) or ...
4
votes
1answer
38 views

Is OpenSSL generating Diffie-Hellman parameters that are safe for use in TLS or SSH servers?

I would like to generate Diffie-Hellman parameters on a Debian GNU/Linux "Jessie" 8 with OpenSSL. Lets assume the system CSPRNG was seeded with some real random data. On such a system, is the result ...
0
votes
0answers
24 views

Log to file my own SSL traffic coming from websocket

I have to decode and capture my own traffic that come from a websocket WSS listening on port 7072, when I use browser to connect to my data provider. My idea is: to redirect traffic to ...
-1
votes
0answers
6 views

OpenSSL 0.9.8zg [migrated]

A week ago, as part of the installation a PHP 5.4 cartridge from openshift.com on my Mac with OS X v10.10.5 in the Terminal I noticed a message about it is loading OpenSSL 0.9.8?? for compatibilty ...
-1
votes
1answer
46 views

HTTPS - if this protocol protect against connecting to false server?

I know about SSL certificates. However it is ok to say: protocol HTTPS protects against connecting to false server ?
1
vote
4answers
103 views

Which of the TLS/SSL and IPsec protocols is effective?

Which of those two protocols is the most effective for sending data from a client to a server on a local network (knowing that I aim to use it for FTP traffic)?
-2
votes
0answers
34 views

Are VPNs more secure than TOR? Why? [duplicate]

I've heard from multiple sources that a trusted VPN service is more secure than using TOR. Is this true? Even if TOR is used with SSL? Why or why not? And how do they compare with regard to anonymity? ...
4
votes
2answers
121 views

What is the difference between MITMproxy and SSLsplit?

I am aware that MITMproxy only captures HTTP/HTTPS protocols where SSLsplit is a transparent proxy and therefore can capture also other non-HTTP protocol communications. However MITMproxy can operate ...
19
votes
7answers
4k views

Why are self signed certificates not trusted and is there a way to make them trusted?

I have locally made a Root CA certificate. I used the CA cert to sign the IA cert and used the IA cert to sign the server certificate. When I try to access the local server which uses the server ...
-7
votes
1answer
49 views

why we use SSL/TLS tunnelling instead of creating new secure protocol [closed]

I don't know why people use tunelling SSL instead of creating safce protocol like HTTPS. Could you have an idea ?
3
votes
2answers
39 views

Question about SSL certificate and third party server

I have a system which consume web-services from a public server on Internet (but the data are not public) I have to provide credentials in Basic Auth to get the data, that is why we use SSL. The ...
2
votes
1answer
48 views

Why does my TLS v1.2 handshake take 2 tcp/ip connections?

All, I have an HP VuGen client that is using 2 TCP/IP connections to do the TLS v1.2 handshake with my server when mutual authentication is enabled. According to Wireshark, the sequence is ...
2
votes
1answer
65 views

What are the main advantages of using LibreSSL in favor of OpenSSL

What are the main advantages of using LibreSSL vs OpenSSL? As I understood LibreSSL is a fork of OpenSSL: LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014, with goals of ...
2
votes
1answer
33 views

Is TLS_FALLBACK_SCSV useless if only TLS (1.0, 1.1, 1.2) is supported?

Ssllabs does not give A+ (highest) rating if the server does not support TLS_FALLBACK_SCSV to prevent downgrade attack. But I am wondering, is it really any useful if the server legitimately provide ...
1
vote
1answer
76 views

How secure and how to find if a website use Flexible SSL from Cloudflare?

How secure is that technology? Can someone tamper with your traffic between a server and Cloudflare in the first place? And if the answer is yes, how can you check if a website is using the ...
3
votes
1answer
52 views

Identifying cipher mode in TLS

I'm trying to check my private server for TLS poodle attack. In Microsoft's article it says: "TLS 1.0, TLS 1.1, TLS 1.2, and all cipher suites that do not use CBC mode are not affected" How can I ...
27
votes
7answers
4k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
0
votes
1answer
40 views

Remote VPN access and moving to the cloud

First of all, my question is related to Web Application security. Often when I want to suggest customers to move to the cloud for certain applications, I am being told that our customers are ...
4
votes
3answers
107 views

Can browsers connect HTTPS w/ the NONE cipher?

I came across a mention of the NONE cipher being possible/available for HTTPS. Is it supported by any browsers for accessing any web-sites over the https:// address scheme? (What would be a snippet ...
4
votes
2answers
79 views

Check validity of SSL cert on public network?

So my company has just started issuing their own SSL certificates, so HTTPS sites now show as being secure, but if you check the certificate used the root CA is us, not whoever the site used. This ...
0
votes
1answer
48 views

Sample attack scenarios on file downloads over HTTP

The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow? The downside to serving files over HTTPS is that you will lose the caching as ...
5
votes
2answers
121 views

Why doesn't the HTTP/2 spec require TLS?

Although no browser implements the full HTTP/2 spec right now limiting themselves to just the TLS part there are stories on the internet that this incomplete implementation of the spec is a way of ...
-1
votes
2answers
46 views

what is the different between X.509 certificate and 2-way SSL? or both are same? [duplicate]

Can anyone clarify what is the difference between an X509 certificate and two-way SSL? or both are same?
1
vote
1answer
73 views

Server providing two different SSL certificates

When I check on browser for a site example.com, I see that site has a valid certificate, not expired, with validity till end of 2016. At the same time, When I scan for the same domain on the port 443 ...
2
votes
2answers
50 views

Risk to self-signed SSL certificate on OpenVPN server

I am building an OpenVPN server in AWS for my organization with a DNS record pointing it to vpn.myOrgnization.com. SIDE NOTE: We have recently migrated all of our SSL certificates over to the new ...
-1
votes
1answer
43 views

Plex owns SSL cert correct?

Plex's HTTPS certificate is great to have for the average MITM attack, however it is my understanding that the private key would still be controlled by Plex, correct? They are issuing the certificate, ...
5
votes
3answers
85 views

Is it ok to have self-signed certificates in source control?

I just asked the question SSL self-signed certificates in development vs acquired cert in production? which has promptly been answered (THANKS!). Out of that, I have the following question: Is it ...
3
votes
1answer
30 views

SSL Labs report question: Is “Insecure Renegotiation” possible if weak cipher suites are not available on server?

On one server, we have removed weak cipher suites and insecure protocols to try to pass SSLScan / SSL Labs. One outstanding problem is Insecure Renegotiation. I read that: The Apache Software ...
3
votes
1answer
51 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
1
vote
2answers
208 views

Why do porn websies not use HTTPS? [closed]

It seems that information relating to porn habits is quite telling, why wouldn't porn websites make the effort in protecting them?
1
vote
2answers
68 views

Large file encryption to mitigate MITM

This is both a performance and security question that I'm looking for efficient and long term security with large file pushing over the internet. My scenario is as follows. - Server receives a large ...
0
votes
1answer
113 views

Why doesn't outlook 2013 meet modern security standards?

It is required to turn on the allow less secure apps setting in order to be able to use a gmail account with outlook 2013, despite it is using the IMAP and SMTP services with SSL protocol enabled. ...
6
votes
1answer
197 views

Bank Has Emailed My Social Security Number

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first ...
0
votes
1answer
32 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
0
votes
1answer
36 views

Can I use a TLS certificate (first generated for a Windows Server) on a Linux Server?

I don't have any experience on this kind of things, so please bear with me. And I apologise if this has been asked before, but I couldn't find it in this site. My situation: I have a Windows ...
3
votes
3answers
158 views

Why are root certificate authorites allowed to issue certficates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
0
votes
2answers
39 views

How to avoid writing .pem while signing a csr?

I am using following command to sign a certificate, openssl ca \ -in client.csr \ -keyfile server.key \ -cert server.crt \ -outdir ./some_dir \ ...
0
votes
0answers
27 views

Java Client not able to establish SSL handshake with server [migrated]

I have a Java client which is using the Apache HttpClient 4.1 library to make an HTTPs request to a server which doesn't require authentication. If I call that server with my browser or curl, the ...