SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
0answers
24 views

How to use Wireshark to capture SSL+DHE encrypted mail traffic (SMTP/POP/IMAP)

(Please forgive and correct my inaccurate terminology, as I am not a security expert.) Wireshark is not decrypting my SMTP / POP / IMAP traffic, and I think it is because the "Cipher Suite" is ...
-8
votes
0answers
88 views

If https is so good (as to completely replace http), why is DJB not using it? [on hold]

D. J. Bernstein, http://cr.yp.to/djb.html, @hashbreaker, is famously known for his crypto and hashbreaking abilities. Outside of the theoretical research that he is engaged in as a professor, his ...
0
votes
1answer
39 views

Is a SSL CA signed certificate necessary when connecting with IP Address?

I'm currently creating a socket server, and would like to encrypt communications. The thing is, the client will connect directly to the ip without any DNS. (Every user will know the Server's IP ...
2
votes
2answers
75 views

How to ensure that a login is really going over http?

So I've been offered the chance to go to a day long security awareness event hosted by some organization. On their site, I noticed the login box in the corner, but the site was delivered on HTTP. ...
1
vote
0answers
18 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
-2
votes
2answers
126 views

Google is going to mark all HTTP traffics as insecure in 2015? [on hold]

Firstly I would like to mention that I got this news from a blog I have read in last few days. This is only, perhaps, a rumor. If this is true, does this mean that anyone using Google Chrome or apps ...
3
votes
1answer
54 views

If I visit a https site from a Family Safety-enabled computer, and someone drops in on the connection, will I be notified?

While reading about Family Safety and HTTPS: Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is ...
1
vote
0answers
31 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
4
votes
1answer
181 views

Multi Domain SSL for different ip? [on hold]

i have 5 domains(example.com,example2.net...) hosted on separate servers. is possible to use one Multi domain SSL certificate for these domain ?
3
votes
3answers
113 views

SSL certificate for “typo” sites

Lets say I own a website say, citiibank.com. (extra i )Will certificate issuing authorities issue a https certificate to the site? For all they know it is a valid website, whose name just happens to ...
3
votes
2answers
117 views

Is HTTPS redirecting to HTTP a vulnerability?

Let's say a user is authenticated, and the entire account authentication process happened under secure HTTPS. Upon successful login, the user is redirected back to the homepage. However, the homepage ...
2
votes
2answers
52 views

How to display friendly notification about no TLS 1.0 support in browser [on hold]

A browser that only has SSL 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
2
votes
3answers
97 views

Is it possible to upgrade the SSL version of a connection from the server's side only?

I am trying to find out if there's a way to upgrade the SSL version from SSLv3 to TLSv1 of a connection by only making server-side changes. In my case, both the client application and server are ...
6
votes
1answer
175 views

Distinguishing SSH and HTTPS traffic

Alice is an employee of Chris, and Chris does heavy traffic monitoring via its company proxy. Alice wishes to use a Bob's web service while preserving privacy and confidentiality. She has full ...
17
votes
4answers
2k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
9
votes
1answer
146 views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
-4
votes
2answers
136 views

Using my own encryption instead of https in app

I am writing a program that uses a webserver as a backend for communication between different users. Is it okay to use my own encryption (such as ...
4
votes
1answer
149 views

Are session keys just the symmetric keys?

From what I read, in TLS, the master secret is used to generate the following: a symmetric key to encrypt the SSL records. an IV (initialization vector) a key for Message Authentication Code (MAC) ...
3
votes
1answer
150 views

Is HTTPS over UDP secure?

Recently, I notice that while using Google search, I am connecting to Google's server using UDP instead of TCP on both port 80 and port 443. It seems that Google is experimenting with some new ...
1
vote
2answers
104 views

Should the whole web *really* be encrypted? Isn't plaintext sometimes faster/better? [duplicate]

It seems to be commonly accepted nowadays that all internet communication should be encrypted. (For example, this is evident in how the HTTP 2.0 standard outright requires HTTPS.) However, I have a ...
1
vote
0answers
33 views

Collecting Pre-Authorized Debit (PAD) & Credit Card (PACC) Agreements Electronically

I am looking for best practices regarding the collection of Pre-Authorized Debit (PAD) agreements electronically. The Canadian Payment Association only seems to provide the following statement ...
1
vote
1answer
50 views

Should a private key be protected by a password even if the software using it needs to know that password?

We have an embedded device running a web server. That web server uses HTTPS and so has a private certificate which is embedded on the device. Right now we are unsure if this private key should be ...
22
votes
6answers
3k views

What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?

I've been learning about PGP, and I asked myself, "Why?" For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used? I can ...
1
vote
0answers
102 views

Server sends RST during TLS handshake. Why?

I have a problem with a machine to machine communication where for me it looks like our server hangs up the TCP during the handshake, but I cannot understand why. We have been running for several ...
1
vote
1answer
30 views

Parallel HTTPS connection remote and local host

Let's assume we've a architecture like this: [HTTPS JSON API] <-- INTERNET --> [Single-Page-Webapplication using XHR] <---> [Locally installed HTTP Server] The users browser would refuse the ...
-1
votes
1answer
51 views

TLS/SSL and password transmission

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat ...
0
votes
1answer
107 views

Java TLS1.0 POODLE

Does java implementation affected? https://www.imperialviolet.org/2014/12/08/poodleagain.html
1
vote
1answer
187 views

POODLE attack against TLS vulnerability

According to a Qualys Blog, POODLE can now be used against TLS (all versions). I've read separately that in order to execute POODLE against TLS, the server must skip a step in validating the padding. ...
0
votes
0answers
7 views

How do I keep our website certificate confidential? [migrated]

I want to keep our SSL key for our website confidential where it's stored on 2 USB sticks, one in a safe deposit box and one I keep secure. And then I'm the only one who applies it to the web server ...
-1
votes
0answers
51 views

How to use http:// in https:// using iframe? [migrated]

my website is ssl-enabled secure containg https:// Now i want to add a website link in my webpage using iframe which is in http:// How can i use it, Here problem is with http:// not working in ...
0
votes
1answer
50 views

Is my sha1 SSL cert safe if they expire before 2016?

According to the Google [1], if my SSL cert expire after 2016 and at some points they will show a warning. But, if all my cert expired before 2016, so I assume no action need to be taken to prevent ...
2
votes
1answer
194 views

“What's my IP” shows a different result when running over https than over http [closed]

We had issues with one internet provider, and switched to another one. However, we received word that the new internet provider is somewhat affiliated with the previous. When running a "what's my ip" ...
0
votes
1answer
31 views

SSL Certificate for use with SSL Inspection on Zyxel USG110

I have a query regarding the SSL inspection functionality on the USG110 series and above. I have a requirement to provide a public Wi-Fi access point, and I’m looking at using a USG110 to provide ...
1
vote
1answer
57 views

certificate authentication between apps

I have a .NET MVC Application which is hosted in IIS. Users of the Application will be company only and it will be access so it will be on the intranet - app wont be exposed via internet. Within IIS I ...
0
votes
1answer
28 views

How is protected connection between the client and the server carried out when using cloud storage?

How is protected connection between the client and the server carried out when using cloud storage? Based on use of VPN connections or protected protocols at various levels (SSH, TLS/SSL, IPSec)? But ...
0
votes
2answers
66 views

nginx recommended ssl_ciphers

I am looking for some advice on setting the ciphers for nginx with SSL. What would you recommend for a good compromise between security and compatiblity at the moment? I have made some research but ...
-1
votes
1answer
34 views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
1
vote
2answers
67 views

What kind of SSL certificate do I need? [duplicate]

I am making a web site which can be considered similar to Reddit in some ways. I need to implement a sign up form so I will store informations about the users. My idea is to store the username, ...
0
votes
0answers
51 views

Is my Postfix and Dovecot configuration secure?

Today I set up my first server with Dovecot and Postfix. These are excerpts from the configuration files: Dovecot: disable_plaintext_auth = yes ssl = required ssl_prefer_server_ciphers = yes ...
0
votes
0answers
16 views

testing cipher suite using openssl for tomcat server is resulting in wrong manner [migrated]

I am using tomcat 6.0.28. and I have configured connector with "TLS_ECDHE_RSA_WITH_RC4_128_SHA" but when i am testing whether cipher is suited as follows I am getting following error: > ...
0
votes
0answers
7 views

TLS Authentication with OpenVPN Server [duplicate]

I'm looking into VPN service providers and trying to find one that provide OpenVPN using certificates for authentication. I've been advised that one provider uses TLS auth and does not require ...
2
votes
1answer
110 views

Which forward secrecy cipher suites are supported for TLS1.0 protocols?

May I know which are all forward secrecy ciphers supported in TLSv1.0 protocols?
3
votes
2answers
132 views

How can a connection be secure, if somebody observes it from the beginning? [duplicate]

If somebody observes a connention between client, and the server, then he can see the keys, by the following data encrypted is. As far as I know, if I connect to a server, then it sends me some keys, ...
1
vote
1answer
41 views

Statistics about webservers and browsers SSLv3.0 support

Since I'm working on a little historical document about the SSLv3.0 protocol and it's most important attacks, it would be lovely to add some statistics about how many webservers and browsers still ...
1
vote
1answer
48 views

Can TLS fallback work with server side support only?

I have patched my server with OpenSSL 1.0.1j for the Poodle vulnerability. Been reading the spec on TLS_FALLBACK_SCSV. From what I can tell in order for TLS fallback prevention to work properly it ...
0
votes
0answers
23 views

Client Cert Auth [migrated]

I would like to setup Client Certificate Auth with my tomcat. I've configured the webapp for this auth and this is my tomcat config. I'm using Windows PKI for my certificates so I have pfx files. The ...
38
votes
4answers
10k views

Is SSL dying? Should I buy SSL certificates for my sites any more?

I'm planning to purchase a SSL certificate for one of my sites when I'm concerned about points made in these articles: WiredTree: The Most Significant Issue With SSL – And How To Solve It ...
-2
votes
2answers
43 views

TLS - Are signatures still needed?

The story: I'm currently writing a web service that allows for communications to be made remotely via TCP/IP. I first thought about signing each packet using HMAC-SHA1 with a password, appending the ...
0
votes
0answers
67 views

google recaptcha V2 on apache shared server: How to get it to work with SSL [migrated]

I implemented google's reCAPTCHA V2 on http:// on the remote apache shared server and it worked 100%. I then changed the protocol to my shared server SSL using the same script as the non-SSL script. ...
0
votes
1answer
96 views

Difference between SSL connection and SSL session

What is the difference between SSL connection and SSL session ??? This is what my lecture notes has to say which I makes no sense to me ( I am new to SSL) SSL Connection: A transient ...