1
vote
2answers
235 views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
2
votes
1answer
71 views

HMAC needed with SSL/AccessToken in place?

Is using an HMAC in web service messages overkill if you are already using SSL and Access Tokens? I’m thinking of further ways to secure a service, and HMAC message signing is one. But it comes with ...
0
votes
3answers
101 views

Does semi-sensitive information demand encryption / security? [closed]

Since it's been requested that this question be rewritten: Is SSL (or some other encryption equivalent) required in the below case? From a small local business website, is there any damage that an ...
2
votes
3answers
334 views

What type of SSL certificate do I need for communications between an Android app and a web service?

I am developing a game for Android. The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database. I would ...
3
votes
2answers
1k views

Checking SSL\TLS servers for null encryption support

I have a web server supporting SSL 3 and TLS protocols , the following are the supported cipher suites. TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can i ...
1
vote
2answers
128 views

Question about HTTPS [duplicate]

I have a question about HTTPS, which I need help understanding. So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
3
votes
2answers
260 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
4
votes
4answers
1k views

Why would someone want to encrypt RSS feeds?

I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
4
votes
3answers
830 views

Paypal IPN, SSL and man-in-the-middle attacks

Okay, suppose I have been implementing paypal IPN, and my server will respond by verifying with "https://www.paypal.com/cgi-bin/webscr" and got the VERIFIED message back. First, if my server connects ...