SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

9
votes
5answers
487 views

Possibility to sniff HTTPS traffic on devices without installing a certificate

My goal is to sniff the HTTPS traffic of some digital devices (AppleTV, game consoles, etc.), and decrypt the HTTPS packets in my local network. I cannot figure out a way by using some HTTPS ...
1
vote
1answer
42 views

How strong is the performance impact of signing when using RSA_AES_256_ECDH

To encrypt web communication, I use SSL with a RSA key with a length of 2048 bit, AES key's with a length of 256 bit and the ECDH-algorithm for the negotiation of the AES key's (or to exchange the ...
1
vote
0answers
13 views

How to implement secure client-server communication over https using python and m2crypto?

I want to secure the communication between a server and multiple clients. The communication goes this way: [1] The client connects to a specific page at the server and checks for a software ...
2
votes
1answer
59 views

Are there any client-side mitigations for FREAK?

While we wait for patches to address the TLS FREAK vulnerability, is there anything relatively straight forward on the client-side that can be done to mitigate the risk in the meantime?
0
votes
1answer
51 views

How NSA intercepts the traffic beyond ssl [on hold]

According to this link, when you send an email or otherwise use the internet, the data travels from your computer, through telecommunication companies' wires and fiber optics networks, to your ...
1
vote
1answer
558 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
8
votes
4answers
912 views

In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as has been clarified ...
1
vote
0answers
25 views

How can I view the Chrome padlock SSL certificate information in Chrome Mobile on Android? [migrated]

When I'm on my Desktop Chrome, I can click on the padlock icon in the address bar and see the information about my SSL connection, like the TLS version, the certificate strength, the authority that ...
0
votes
0answers
3 views

Jradius Client : Invalid or unexpected EAP payload received [migrated]

I am trying to integrate with jradius client to communicate with Cisco ISE server for EAP-TLS authentication. I ran a sample test and below is the issue I am seeing in ISE logs: "TLS packet parsing ...
2
votes
3answers
42 views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
3
votes
1answer
47 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
0
votes
0answers
25 views

why tor nodes maintain tls keys with all other tor nodes?

I read that tor proxy maintains session key with tor nodes and use it while encrypting data but why tor nodes maintain keys with other tor nodes?
0
votes
0answers
14 views

Did anyone encounter a problem with ssl certificate from network solutions on mobile device? [migrated]

We have a mobile app that calls Web Service on our server. We are planning to setup ssl on the server and going to buy a wildcard certificate from network solutions. Wildcard certificate from Network ...
1
vote
1answer
93 views

Completely getting rid of SSLv3 on Apache

Our security team is asking that we completely disable SSLv3 on some of our servers running Apache. I've used the SSLProtocol entry in the ssl.conf file (like SSLProtocol ALL -SSLv2 -SSLv3) and ...
1
vote
1answer
35 views

Protecting the root ca bundle

Applications (e.g. Firefox) often include a root ca bundle file containing trusted certificates. How can I protect those files from malicious agents trying to modify them? I think signing is not an ...
2
votes
1answer
37 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
-5
votes
0answers
54 views

Link to more active security sites? [on hold]

I have a BS/MS in Computer Science and have worked as a developer for 15 years. Currently I have been reading a lot about computer security. Serverfault and Stackoverflow seem to be the go to place ...
0
votes
0answers
25 views

Choosing a SSL Certificate Issuer [duplicate]

I am going to buy a new ssl certificate that supports SHA2 algorithm for our web services. Web services will be used by variaous java clients written in java6, java7 and java8. We have got a ssl ...
8
votes
2answers
680 views

Question About HTTPS Security [duplicate]

I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong. I got to know that as part of ...
1
vote
0answers
26 views

Imported CA certificate to Firefox Browser not working [migrated]

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
1
vote
3answers
106 views

How to make a secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces, one is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
0
votes
1answer
45 views

How do SSL certificates become compromised after expiring [duplicate]

I'm reading into security issues surrounding SSL, and one of that has come up is certificate expiration. The general idea is that once a certificate expires, the site is insecure. What is the ...
3
votes
2answers
105 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
2
votes
1answer
72 views

Why is the first line of http message unreadable after decryption

I have a TLS Record containing HTTPs application data. I extracted the encrypted plain text with mac from the application data, then, when I decrypted the extracted data using AES CBC mode, I am ...
1
vote
0answers
9 views

Can usernames & passwords + client certificates exist in Activesync?

Every Activesync writeup I've seen, by MSFT or 3rd parties seems to encourage the deployment of client certificates with the "require" feature, as opposed to the "Accept/Optional" selection. I want ...
1
vote
1answer
44 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
2
votes
1answer
78 views

SSL communication between a C# Server and an Android Client App

I'm using a C# server and a C# tcp client example I extracted from the MSDN and I have created a self signed certificate using makecert.exe. I have got this to communicate with one another and it ...
0
votes
0answers
15 views

HTTP DoS prevetion with UFW firewall [migrated]

I am trying to creator an HTTP DoS attack on my servers using UFW firewall using this Resource. I edited /etc/ufw/before.rules to get the following rules. # # rules.before # # Rules that should be ...
-3
votes
0answers
29 views

TLS vs other security protocols [closed]

I'm currently working on my bachelor thesis, and without going to much into detail the main mission is to develop the possibility for sending media (pictures, videos and recordings) from the app on ...
1
vote
1answer
86 views

mail.google.com identity doesn't match

I got This website doesn't supply identity information in firefox while browsing gmail.com, I understand that would be because I understand it is required when it needs to load content using ...
9
votes
1answer
280 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
0
votes
0answers
14 views

keytool commands to replace existing SSL certificate? [migrated]

I've a linux centos server running glassfish 3.1.2 app server. The default certs coming from GlassFish install for ports 4848 and 8181 are 1024 bits. I need to replace these with 2048 bits versions. ...
16
votes
2answers
369 views

Are the certificates from “skype click to call” and “avast! Web/Mail Shield” any better than superfish?

My Girlfriend has a years-old laptop from lenovo. I checked it over and wasn't surprised that the Superfish / Komodia Root CA certificate was not present. However I found some others that appear to ...
0
votes
0answers
16 views

TLSv1 dosnt work witout enabling the sslv2 [migrated]

I'm using Apache 2.2.4 version. i already know this version only support the sslv2, sslv3 and tlsv3. but something wired happens when i use it: when sslv2 is disable: the web browser (internet ...
2
votes
1answer
60 views

Is TLS enough to prevent eavesdropping? [duplicate]

Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?
13
votes
3answers
716 views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
1
vote
0answers
107 views

How actually Lenovo's Superfish works in general (step-by-step)?

There isn`t a clear, step-by-step explanation about Superfish adware here, all questions and answers are kind of specific for different aspects of it, but nothing in general. So, how Lenovo's ...
3
votes
2answers
39 views

Issues with using TLS Session Id for Web App Session?

Apache Tomcat has the ability to use the TLS Session ID instead of a session cookie or JSESSIONID in the querystring. My site is HTTPS Everywhere. This seems useful in that I don't have to worry ...
54
votes
4answers
6k views

Why was the private key of the Superfish certificate so easily extractable?

Robert Graham detailed on the Errata Security blog how he was able to get the private key of the Superfish certificate. I understand that attackers can now use this key to generate certificates of ...
2
votes
1answer
264 views

Contents of Lenova/Superfish certificate

I would like to examine the Lenova/Superfish root certificate being used in the wild. I've worked through articles like Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections, ...
2
votes
4answers
136 views

How safe is SSL on an untrusted computer and network?

In situations where the consumer doesn't trust/control the workstation and the network, can consumer safely do potentially sensitive activities (like making a payment or transferring confidential ...
1
vote
0answers
26 views

How can i know my security level as “ SSL 256 bit encryption” [duplicate]

I am using openssl tool to create certificate self-signed certificate I have known that [2048 bit SSL] it is the length of the public key then what about [256 bit encryption] how can i know type of ...
3
votes
0answers
65 views

Can serving HTTPS to Internet Explorer on Windows XP be made secure?

Answers to Why is HTTPS not the default protocol? state that a lot of sites still use clear HTTP instead of HTTPS because all of these are true: A substantial number of visitors to the site use ...
40
votes
3answers
5k views

How to detect if I am vulnerable to “Superfish,” and how to remove it?

The site has already a discussion of the security risks of "Superfish". It seems to me that anything that tampers with the bits of one's connection is bad. If it tampers with TLS connections, it is ...
2
votes
0answers
46 views

Decrypt TLS from an IDS

So I am trying to figure out what the packet payload is off of a possible TLS HeartBleed alert from my IDS. I have read that Wireshark is able to do it with some certain keys, but isn't that in real ...
52
votes
4answers
4k views

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
2
votes
2answers
138 views

SSL / TLS: Is a server always required to respond to a close notify?

I'm a developer and I'm implementing a socket connection with SSL (using javax.net.ssl.SSLEngine). For testing I'm opening connections to arbitrary HTTPS servers on the Internet to see how the ...
1
vote
0answers
35 views

Startcom StartSSL + nginx client certificate

Startcom issues client certs. I'm using mine for seamless authentication in nginx as follows, in somewhat the same manner as was suggested by this Q/A: server { ssl_certificate ...
4
votes
3answers
137 views

What part of TLS specifies how to verify a certificate chain

I have sometimes run into a situation where I see a root CA certificate which is set to expire sooner than the intermediate CA certificate. My question is - if you were interested in keeping your ...
1
vote
1answer
89 views

Perfectly secure Postfix MTA (SMTP) configuration

I want to secure my root server (further) service by service, starting with the SMTP service (Postfix MTA) as the most busy one. I the course of setting everything up, I read a lot about security and ...