SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

10
votes
4answers
882 views

Cloudflare's free SSL options require trusting them, what could they do to change that?

So Cloudflare offers 3 free SSL options: Flexible SSL, Full SSL, and Full Strict SSL. This article explores the shortcomings of the Flexible and Full (non-strict) SSL options: ...
1
vote
1answer
101 views

How to explain BEAST attack to non-tech people

I'm looking for the best way to describe the Browser Exploit Against SSL/TLS (BEAST) attack to non-technical people, without being too general. So I am not looking for: "did you ever noticed the lock ...
1
vote
2answers
187 views

Should I invest my time in making my site HTTPS-only?

I'm building a Django website that does not need to have registration/authentication. The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
-5
votes
0answers
36 views

Tunnelling for security [on hold]

I want to tunnel HTTP over DNS over IPSEC over PPTP over Telnet over PNG (imbedded via Steganography) over HTTPS How to do dis? EDIT: Software I am using is notepad.exe I have tried to do ...
2
votes
2answers
74 views

HTTPS POST request header versus request body

Is there any security difference between placing sensitive data, such as an API key in a POST request header versus the POST request body assuming the API server is HTTPS-only? While you frequently ...
3
votes
0answers
66 views

Impact if password is visible on interceptor in case even we deployed HTTPS

Our application is on HTTPS but password is visible on interceptor while when we check it via Wireshark it's encrypted. Is there any risk in it? And what kind of impact it can have?. We provided the ...
4
votes
2answers
109 views

Usage of Ephemeral Diffie-Hellman ciphers in 2015 and beyond

In determining TLS standards for my company, I have come to wonder why all recommendations still suggest the use of the Ephemeral Diffie-Hellman TLS ciphers starting in TLS_DHE_xxx Background and ...
0
votes
3answers
104 views

Best way to securely send passwords from an application to a user operated server

I have the following situation: A user sets up a server that will have to receive login details. Other users then create accounts and login to this server. All this happens only over LAN. I'm ...
0
votes
0answers
49 views

How can I protect a mobile application from LogJam?

I develop a two-factor authentication app on iOS and Android and I recently noticed that they run perfectly fine against a local dev server that is vulnerable to LogJam. Is there any way to secure ...
1
vote
0answers
43 views

Can TLS provide integrity/authentication without confidentiality

It was a bit surprising when wikipedia has switched to TLS because we all know it's public information available to anyone, but I suppose that the real purpose for that is to provide ...
2
votes
1answer
45 views

Bi-directional authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the abovementioned CA. Server has its own ...
0
votes
0answers
27 views

“encrypted using an obsolete cypher suite” - After using IIS Crypto best practices [duplicate]

I've used the IIS Crypto tool, using best practices and I still get "encrypted using an obsolete cypher suite" In Google Chrome. There's so many various cypher suites, and I'm yet to find a ...
0
votes
1answer
30 views

Getting a certificate warning for one email but not another

When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private". Here are the ...
1
vote
2answers
47 views

Is the (SSL3-based) SSTP VPN protocol vulnerable to the POODLE attack?

The Secure Socket Tunneling Protocol is a VPN protocol developed by Microsoft. It sends traffic over an SSL version 3 connection. Since SSlv3 is vulnerable to the POODLE attack, does this mean that ...
3
votes
1answer
38 views

Is intercepted ssh-socks traffic revealing HTTP object count and sizes?

I read an article titled the network is hostile, in which the following is stated: Traffic analysis remains a particular problem: even knowing the size of the files requested by a TLS-protected ...
0
votes
1answer
39 views

What is the proper setup procedure for SSL Tunnel certificates?

I am a systems integrator using a system designed for bringing HVAC data up to a common interface; this system/software platform is called Niagara AX. The combination of the customer's network setup ...
0
votes
0answers
41 views

RSA BSAFE Crypto-J JCE provider - “Server Hello” returns unassigned Named Curve

I'm using the RSA BSAFE Crypto-J 6.2 JCE provider in Java as SSL/TLS server (in FIPS 140 Compliant Mode for SunJSSE). when I use any elliptic curve based key exchange mechanism the handshake fails ...
1
vote
1answer
27 views

Will TLS_FALLBACK_SCSV on a server that only supports TLSv1 block a connection from a client using TLSv1.2

I've read the draft RFC in relation to TLS_FALLBACK_SCSV and understand that if both the client and server implement this feature and a client sends this as part of clienthello, the server must reject ...
-2
votes
0answers
50 views

Can I block HTTP and HTTPS traffic that is going to non-common ports? [closed]

Is there a way to block HTTP and HTTPS traffic over ports that are over 1000? If so how can I do that with either firewall rules or content filtering? Reason being: Crypto is getting dropped through ...
2
votes
1answer
39 views

How often should TLS Session Ticket Keys be rotated?

I am configuring a non-sticky load balanced cluster of HTTPS servers. To enable TLS session resumption when a previous client reconnects to a different server in the cluster I will be configuring ...
2
votes
2answers
97 views

Named curve value 0xffff in 'Server Hello' message

I'm using the RSA BSAFE Crypto-J 6.2 JCE provider in Java as SSL/TLS server (in FIPS 140 Compliant Mode for SunJSSE). It seems like at least Chrome and Firefox cannot establish a connection if ...
2
votes
1answer
51 views

Why not use same certificate for webserver TLS and Signing in SAML?

I have read a bit about configuring shibboleth, and recommendations for SAML at internet2 I get the point that a certificate does not have to be signed when used for SAML, because actually only the ...
15
votes
3answers
1k views

Why are CA-issued certificates considered so much more secure than self-signed certificates

I looked at other Stack Exchange posts explaining why self-signed certificates are not as secure as CA-issued certificates, and most of these pages say the same thing: If it's self-signed, and the ...
-5
votes
0answers
51 views

Blocked HTTPS in browser [closed]

My browser will not open any site without writing https://www, but when I write https://www then site opens as regular.
1
vote
3answers
143 views

MITM on popular sites - DNS

Can a MITM attack on popular sites such as Facebook.com Google.com be done by intercepting the DNS requests? Will the user notice something? For instance: Loading https://fb.com The client ...
1
vote
1answer
62 views

Certificate expiry validation - in what stage?

I'm implementing certificate expiry validation for a client. I'm not sure about the following. Is there a standard/popular implementation regarding the order of validation- Check if the ...
0
votes
0answers
34 views

Enable only TLS 1.2 connection to my website [migrated]

All those web browsers that cant make a TLS 1.2 connection to my website should not be able to access it. I am using apache tomcat server. What all configurational changes do I need to make in order ...
-1
votes
1answer
42 views

Scanning and SSL Bypass Options

I'm looking at implementing SSL Interception on my local firewall, as well as implementing URL filtering. How would I be able to tell if a site was being 'blocked' or not accessible because of the ...
1
vote
0answers
27 views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: ...
0
votes
2answers
71 views

Encryption in case of distributed architecture

I have application infrastructure as follows - web client -> load balancer -> Apache (web server) -> Weblogic (application server). I could understand that in case of HTTPS request, SSL handshake ...
2
votes
1answer
37 views

How to securely provide SSL certs to a Docker app

What is the most secure way to provide SSL certificates (for HTTPS) to a Docker application? The approaches I've considered: The environment It's common (but obviously not required) to use the ...
2
votes
1answer
38 views

Setting node.js TLS ciphers vs observed behavior

I have a node.js server that I'm configuring for TLS 1.2. I set the following options in the config of my https server: ciphers: ...
1
vote
0answers
15 views

Testing my TLS1.1 connection code [migrated]

I have a desktop client application (Windows) developed using C++. It connects to the web services hosted on the IIS on the server. Currently I am in the process of porting this application to use ...
2
votes
1answer
113 views

How can Heartbleed checkers determine if a site is vulnerable?

As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or ...
3
votes
1answer
124 views

Why does IE11 refuse to back navigation caching for HTTPS?

On my website, I get this error message in the console: DOM7011: The code on this page disabled back and forward caching. For more information, see: http://go.microsoft.com/fwlink/?LinkID=291337 ...
-1
votes
3answers
59 views

Can a website that uses https be absolutely reliable? [duplicate]

Https websites cover some security requirements and certify the author, but how can we be sure that an author of such an https website is not malicious?
2
votes
1answer
104 views

Server sends RST after receiving Client Hello when binding certain certificate

The server environment: Windows Server 2012 R2 + IIS8.5. We are testing three self-signed certificates created by: C#(System.Security.Cryptography.X509Certificates), makecert+pvk2pfx and openssl ...
5
votes
2answers
155 views

Are the GET values also encrypted/secured by SSL?

For example we submit a form on the following site: https://example.com (SSL Encrypted) Then the form is submitted as GET method, so it becomes like this: ...
4
votes
3answers
333 views

SSL/TLS Certificate Update?

We had a setup which used openssl0.9.8 so it had only support for SSLv2 and TLSv1.0. We had a script which generates self-signed X.509 certificates and uses openssl library. Now we have upgraded ...
9
votes
2answers
205 views

Is it possible to guess the length of a password by sniffing TLS packets?

In this answer, the author states that it is possible to tell the length of your password, by sniffing your TLS packets. Is this true, and how would this be done in practice?
-3
votes
0answers
21 views

How to disable some ciphers in nsSSL3ciphers command? [migrated]

Referring to Sun Directory Server Man Page Reference, can anybody tell whether - or + is really needed for scenario? I need to: enable only TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, and disable ...
0
votes
1answer
32 views

xmlhttprequest with https - can I test the fingerprint before sending any data

I am making https calls in javascript via xmlhttprequest. I know the server and its public key in advance. For extra security, I would like to check the public key (or its fingerprint) if its is what ...
2
votes
1answer
55 views

Logout tied to cookie expiry

I am looking for an event to automatically logout a user from the application. Typically I would do it when an inactive session expires. I was wondering if it is secure to do so using cookies. So here ...
5
votes
1answer
502 views

Point several HTTPS domains to the same web server

We are currently running a SaaS over HTTPS(abc.net) and one of our clients(xyz.com) wants to do some custom branding. The client xyz.com will have their own subdomain xyz.abc.net which looks like its ...
0
votes
1answer
47 views

Relationship between SSL cert database and that at the CA site

Say I am using a trusted third party CA site to manage my cert. I created a new cert called CertA at the CA web interface, downloaded the signed cert and use it on my web server. Some time later I ...
0
votes
1answer
132 views

Any real-world examples of root certificate store compromises?

Apart from the infamous Superfish/Lenovo case this year, are there any other known cases of a malicious root certificate being installed on a target machine to allow transparent MITM attacks, whether ...
-1
votes
0answers
39 views

Is it possible to do HTTPS like encryption with libSodium over HTTP?

My application is already using libSodium and I am wondering if I really have to add another dependency (OpenSSL) to get HTTPS working. The application is communicating with an Apache server over HTTP ...
1
vote
1answer
32 views

How can Key Compromise Impersonation be mitigated?

This paper describes a successful attack on TLS called Key Compromise Impersonation. It states that the attack can be mitigated thus: Disable non-ephemeral (EC)DH handshakes Set appropriate X509 ...
4
votes
2answers
337 views

Can an eavesdropper detect the use of a TLS client-side certificate?

Basically what the above says, assuming the eavesdropper must be completely passive, and cannot connect to the server to check if the server requires a client certificate.
2
votes
1answer
71 views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...