Tagged Questions

1
vote
2answers
1k views

Error code: sec_error_untrusted_issuer

I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
2
votes
1answer
232 views

What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?

I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance. For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
1
vote
1answer
129 views

How do I verify, parse and process the results of the HTML5 keygen tag?

I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST: ...
0
votes
1answer
50 views

Can IE be made to imitate the behavior of Chrome's KeyGen element?

Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element? Assistance getting Safari to work with this optional HTML5 spec would be ...
1
vote
3answers
311 views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
3
votes
1answer
103 views

How can I use certificates to secure my webservices? What is available to javascript?

I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
5
votes
1answer
3k views

Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?

I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug? I'm on a WPA2 encrypted wireless connection using Chrome ...
2
votes
4answers
302 views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
2
votes
4answers
919 views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
4
votes
1answer
130 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
0
votes
2answers
472 views

Issuing browser certificates to Chrome and Firefox with Microsoft CA

Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval. Since many browsers either block or don't support ActiveX controls, how can I enroll them using a ...
3
votes
1answer
296 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: ...
7
votes
5answers
2k views

Does HTTPS Everywhere defend me against sslsniff-like attacks?

http://www.thoughtcrime.org/software/sslsniff/ If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
1
vote
2answers
82 views

How can I force certain the webclient to honor or remember certain parameters from the webserver?

HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...
3
votes
1answer
158 views

How secure is a https website? [duplicate]

Possible Duplicate: Does an established ssl connection mean a line is really secure When I visit a website -- say, https://ebanking.pick-your-bank.com -- my browser (fully patched version ...
3
votes
2answers
244 views

Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]

Recently while trying to log-in to facebook this notification starts to appear at first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website! I ...
3
votes
3answers
139 views

Warn about specific CA in Firefox

Consider a setup where all HTTP/HTTPS traffic goes through a proxy. The certificate of this proxy must be trusted by all browsers (in this case, Firefox). This certificate replaces the original ...
10
votes
4answers
648 views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...
20
votes
8answers
2k views

Is anybody using client browser certificates?

Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...