0
votes
2answers
98 views

understanding and getting over the SSL performance issue

There are many great articles explaining how SSL/TLS works on this site, but I would like to bring in the performance issue. The thing is that I am serving my web content over HTTPS and the SSL ...
1
vote
2answers
244 views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
3
votes
2answers
203 views

Form submissions over HTTPS are not encrypted?

My question is regarding HTTPS form submission. One of our website is using HTTPS, we display the login page to the user via HTTPS protocol. When the form is submitted, if we try to intercept the ...
2
votes
2answers
172 views

What are good approaches to modify TLS/SSL trafic in order to make a HTTP bot?

If I wanted to make a bot that plays/issues automatic actions/moves in a online browser game, whose communication is realized over HTTP1/1 and WebSocket (https and wws respectively), all TLS ...
15
votes
5answers
1k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
13
votes
6answers
1k views

How secure is redirecting user from http://normal.bank.com to https://secure.bank.com?

I have an application. Which works on http, http://normal.bank.com. But for log-in, performing any action, etc. I am rediecting user to https://secure.bank.com, where user can login and perform ...
0
votes
2answers
517 views

Do i need SSL certificate signed by a CA for hybrid mobile apps?

I have just stepped into ssl domain and started exploring how to implement ssl. My question is i understand ssl certificates signed by CA actually allow the client or browser to validate that the ...
3
votes
1answer
189 views

Is TLS 1.0 sufficiently secure for a bank?

I disabled SSL2 and SSL3 in my Firefox browser, version 24. I only enabled TLS 1.1 and 1.2. Unfortunately when I went to my bank's website, I found that it didn't work until I re-enabled TLS 1.0. ...
4
votes
2answers
295 views

Login security without SSL

I have a web app without SSL (I know it's not good, I try to take it as a challenge). The login is two step. First the admin sshs into the server and runs a maintenance companion program that provides ...
0
votes
1answer
153 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...
3
votes
1answer
296 views

Can Exchange/OWA still compress static images and be immune to HTTP compression attacks?

Microsoft Exchange / OWA (Outlook Web Access) allows for three different types of compression (link for Ex2010) Compression setting Description High Compresses both static and ...
1
vote
1answer
91 views

Impact of using map APIs without SSL support? [duplicate]

We are currently developing a web application which involves map APIs. Most of the map API providers don't provide any SSL support (e.g. Yahoo! doesn't). What will be the security impact of using map ...
1
vote
2answers
108 views

Question about authentication cookies? [duplicate]

Say, I have a website where users are required to login to access certain functionality. Once they are logged in, they are issued an authentication cookie. Some of the pages on the authenticated ...
3
votes
1answer
2k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
4
votes
2answers
7k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
4
votes
3answers
358 views

In what way is a partially encrypted webpage insecure?

What are the potential vulnerabilities that might arise if a webpage is only partially encrypted. I can think of 2 possibilities: You can change the non-encrypted parts of the page (HTML, CSS, ...
9
votes
3answers
213 views

What simple security considerations can I / should I make for a read-only API?

Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
7
votes
3answers
2k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
3
votes
6answers
359 views

Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?

I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case. Is there a way to determine and display the state of HTTPS on a page ...
2
votes
2answers
217 views

Will using SSL to secure Wordpress admin area only still actually be secure?

The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas. There ...
75
votes
2answers
37k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
1
vote
2answers
99 views

How can I set up signed downloads?

Scenario I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
3
votes
1answer
146 views

Exporting data beyond a cryptographic boundary

Scenario We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
3
votes
3answers
157 views

Is it safe to mix authentication methods?

Is it a good idea to "combine" authentication methods? Example we can use username/password method to authenticate a user from a server. What if we used this as a first authentication step to get ...
2
votes
6answers
256 views

Protecting an admin area from the public

We are about a month away from launching a pretty important site, which comes with an admin console to help us manage the site. Now I'm not very interested at just leaving the admin out in the open ...
0
votes
2answers
380 views

OpenID without SSL certificate

Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed? Just to make things clear, ...
0
votes
2answers
786 views

How valid is this statement “SSL sit between application layer and network layer”

taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
16
votes
2answers
7k views

ssltest: Chain issues - Contains anchor

I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)") What does it mean? Should it be fixed? Can it be exploited?
11
votes
7answers
1k views

Should we force user to HTTPS on website?

Should we force website from HTTP to HTTPS , one of the method is using .htaccess: RewriteCond %{SERVER_PORT} 80 RewriteRule ^(.*)$ https://www.example.com/$1 [R,L] But what I notice is that some ...
2
votes
2answers
134 views

Is there a need for SSL on a local site?

Do I need SSL for a site that can only be accessed on the local network? All users log in with windows credentials using Windows Auth with PHP on IIS. And if I don't: What security is needed to make ...
3
votes
1answer
133 views

Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?

Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
0
votes
1answer
262 views

How does a Web Security Gateway analyse SSL Encrypted Traffic?

Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
3
votes
1answer
195 views

Client-side cross-site access in SSL environment - when it's still possible to do?

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
6
votes
3answers
1k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
2
votes
4answers
236 views

What are some common misconceptions about SSL/TLS that members of the general public hold?

Particularly ones that are, to some extent, the result of advice given by companies who utilise it, e.g. banks, e-commerce sites etc.
8
votes
2answers
2k views

What can an attacker do with a stolen SSL private key? What should the web admin do?

What can an attacker do with a stolen website certificate and key? What should the website admin do upon learning this?
1
vote
1answer
286 views

JS frontend for RESTful backend vs authorization

I'm building web-app. And i have concern about security issues. In world a lot of similar questions, but many of them does not have really clear answer(advise,suggestion). This is the reason why i ...
6
votes
3answers
976 views

Securing a multi-tenant architecture

I'm a computer science student looking to expand an already developed web application into using multi-tenant architecture. Considering I'm far from being a security expert, which precautions can I ...
0
votes
3answers
203 views

Is HTTPS necessary for password change if user has already logged in with HTTPS?

I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION. Is this really necessary?
1
vote
3answers
7k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
2
votes
1answer
453 views

Is SSL session based only? Is there a (formal) definition of an SSL connection?

In various docs on SSL there is a mention of connection. But from the context I am not sure if this means the underlying TCP connection or the SSL connection. I am thinking that there is no SSL ...
1
vote
2answers
294 views

Really secure webmail

If I'm feeling paranoid about the CCDP (UK) - requiring ISPs to intercept communications across the internet - then what would be the most secure approach to a webmail system? Obviously, there's some ...
5
votes
2answers
2k views

Google Analytics on a secured site

Just read this article on Google Analytics and the risk of forged certificates, where it said: Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
2
votes
2answers
101 views

Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?

I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols? Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh) ...
7
votes
3answers
566 views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
1
vote
3answers
741 views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
2
votes
2answers
331 views

HTTP + HTTPS + One Time Pad/stream cipher

I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
3
votes
1answer
300 views

Security for a low latency online multiplayer game

I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
2
votes
2answers
1k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
7
votes
5answers
6k views

Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP

The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well. In addition there are a ...