Tag Info

New answers tagged

-1

Also one thing to consider very carefully, is that certain antiviruses work by scanning the traffic. If the site is using HTTPS, a virus can in fact slip undetected past the radar. This is especially important if you either have a antivirus service provided by your ISP, your employer, or your school, which is based on a "Proxy". This is why some proxies ...


1

Authentication of the client does not prevent cross-site attacks against the web application like CSRF or reflected XSS. They only prevent direct access by a third party. It does not matter what kind of authentication you use, i.e. all the same for password, two factor, client certificates or whatever. The same is true for VPN.


1

If you use a VPN you still need to authenticate the user to establish the VPN. A client certificate is a very good authentication factor but should be used in conjunction with a password as there are several examples of malware that steals certificates in addition to other ways they can be compromised. Client certificates tend to have a support overhead ...


1

The RFC for CSRs - https://tools.ietf.org/html/rfc2986 - actually gives a different reason why the CSR is signed. It doesn't say anything about preventing the CSR being modified in transit, but says that it is to prevent someone requesting a certificate for a key that is not theirs (and says this is only a minor issue): " Note 2 - The signature on the ...


0

There are lot of strange things people doing wrong when using SSL. And while I've not seen this one it might be, that they are trying to use the serial number as 32 bit, which means a maximum value of 4294967296 (or 2147483648 is they use signed int). This would fit into your description where 10 digit is ok (at least if below 4294967296), but 12 digit is ...


3

The secure from https isn't related to content on a website/service. It is called 'secure' because theoretically the security protocols (ssl/tsl and some others) do not allow the information being exchanged to be easily understood (it encrypts the data flow), so, even if someone would catch your packets, they would have to decrypt it to understand the ...


-1

I realize this was a while back, but there were DNS resolution issues with certain Linksys routers. May have been a cause.


2

In addition to the other points raised, it's worth mentioning that even a trusted site (for example, your bank), could still be infected by a virus that makes it behave maliciously. So even if you trust the organization, https still does not guarantee that the website doesn't do malicious things.


1

A Pharming attack can be used to redirect your traffic to a malicious server. This server will connect to the legit one and will authenticate on it as if it is you. Then it will present to you the information or web page from the legit server. For you - it will appear as you are connected securely to the legit server but now there is a MITM that has access ...


5

In short: Yes, it can indeed be malicious! Accessing a site via HTTPS means that the connection between your computer and the website's server is encrypted and secure. What HTTPS does Encrypt the data being transmitted over the network between your computer and the website's server to prevent third parties from intercepting it. Prevent man in the ...


3

Yes, it can easily be - malicious JavaScript or viruses can be transferred over HTTPS as easily as over HTTP no problem. It may be somewhat less likely as the source of the valid verified HTTPS message is known. However still may happen if the HTTPS site has had security hole, has been attacked, compromised and malicious content has been installed on it. It ...


2

Add to the list that the CA itself could have been hacked (e.g. DigiNotar) and used to issue fake certificates, or your browser might be forced to use fake CAs specifically so that your connection might be intercepted and tampered with - as is sometimes used on corporate networks. Oh, also the certificate might have been faked because it was using MD5. As ...


22

No, HTTPS does not necessarily mean that a site is not malicious. HTTPS means very little as to the security of a site. It's specifically geared to keep your communication with the site secure from eavesdroppers and tampering, but offers nothing as to the security of the site itself. Yes, a site serving content over HTTPS has a certificate. That means ...


29

Not at all a guarantee. HTTPS means that the web page has SSL, which simply means that your connection to the page is encrypted. The content on the page could be anything that could be posted on any web site whether encrypted by SSL or not.


1

I think it's more of a security concern as highlighted in 1. CAs like VeriSign uses the two-tier hierarchy (or trust chain) concept to provide more security. This is because the roles of the primary and secondary CAs are separated and may be hosted in different servers, maybe in different geographical locations. So, most probably more precautions are ...


0

Requirements: Good Knowledge of TCP-IP and the basic knowledge of operating systems, which Windows and Linux. For programming you must know the basic concepts. I recommend you the use of Linux's terminal for learn commands and apply the theory that you have studied. You can found many documents on these arguments.


0

The "DO NOT TRUST" is actually in the certificate itself as created by Fiddler. Fiddler is able to interpret HTTPS connections by acting as an HTTPS proxy. When you connect to a site via HTTPS, Fiddler produces a certificate that claims to be from that site and then accesses the real site. This way Fiddler can see the traffic, but your browser still acts ...


0

The way that I understand that Fiddler (And similar proxyies such as Burp or OWASP ZAP) work is that each installation generates a unique root certificate which it then uses to generate certificates on the fly when you have it assigned as a proxy, so you can intercept and modify traffic flowing over this connection (the purpose of the software). As the root ...


3

It's safe as long as you understand the implications. Fiddler acts as a proxy / man in the middle to intercept and decrypt traffic between you and the target. For SSL sites, it does this by dynamically generating an SSL certificate with the name of the target. The problem is that your browser will not trust certificates issued by Fiddler, hence the ...


0

I'll do my best to answer your points, as each situation is different. 1 - If you're using an SSL VPN solution (which is probably the case), the only way they would be able to decrypt your traffic is if they got a hold of the VPN servers private key (this is the way SSL/TLS works). Even if your traffic is captured, they wouldn't be able to decrypt it ...


1

Quite simple :-) First of all I got some weird errors when I run your script: PHP Notice: Use of undefined constant curlopt_cainfo - assumed 'curlopt_cainfo' in ... PHP Warning: curl_setopt() expects parameter 2 to be long, string given in ... So I replaced with curlopt_cainfo with CURLOPT_CAINFO - that seems to get rid of them. I added the following ...


5

From RFC 5280 3.3 Revocation An entry MUST NOT be removed from the CRL until it appears on one regularly scheduled CRL issued beyond the revoked certificate's validity period. If you have a lot of changes (people leaving etc.) it's best to not make the certificate validity too long otherwise the CRL can grow large (some CRLs are > 30MB which ...


2

Expiration date is "baked" into certificate itself, so even if time on client is incorrect this wouldn't cause server to mistakenly accept the certificate. Server clock, on the contrary, have to be correct. Now, whether or not it is safe to remove expired certificates from the CRL depends on how server verifies certificates and, in particular, whether it ...


2

Key pairs are used for two things: Encrypting a secret value for symmetric encryption Signing data for validation Both RSA and DH are based in asymmetric algorithms. So we have two cases for a secure exchange to occur. RSA Alice signs a message to Bob, and encrypts the message with Bob's public key. Sends message to Bob. Bob decrypts with his ...


1

Forward Secrecy The key used to protect transmission of data must not be used to derive any additional keys, and if the key used to protect transmission of data is derived from some other keying material, then that material must not be used to derive any more keys. In this way, compromise of a single key permits access only to data protected by that ...


1

Each session means each SSL session. An SSL session can be reused over multiple TCP connections (that is SSL connections) if both client and server implement session reuse and each of the SSL connections gets closed in a clean way. A SSL connection might also consist of multiple SSL sessions if you do multiple full SSL handshakes within the same connection. ...


0

Thanks everyone for the suggestions but we have found the problem. Seems that our SSL reverse proxy that was deployed was mis-configured, causing strange issues like this. Once we took it offline to test, the external clients then connected fine.


1

StartSSL does in fact offer free SSL certs for subdomains, though they are Class 1 certificates. You just have to go through a normal domain validation on the actual subdomain. Wildcard certificates (e.g. *.example.com) are not available for free, and are only available when you purchase a Class 2 or 3 cert. I have used these free subdomain certificates on ...


2

Pre-Snowden, I would have dismissed this question as being in the "tinfoil hat" category. Unfortunately, the NSA's pervasive misconduct (not to mention that of its "Five Eyes" junior partners, e.g. GCHQ, CSIS, and whatever the Australian and N.Z spook agencies are calling themselves these days), does indeed raise a troubling question. The specific ...


0

You have to configure your server to provide the chain certificate. How precisely to do this depends on your server. For apache, you need to add to your config: SSLCertificateChainFile /path/to/intermediate.crt For IIS (and most other Windows-native stuff), you have to import the intermediate certificate into your server's "Intermediate Certification ...


0

StartSSL offers free class 1 personal certificates which are accepted by most browsers. However, to get any higher-level certificates, you will have to purchase. http://www.startssl.com/


6

This answer applies to SSL or PGP type digital certificates, which bind an identity to a public key. It has been pointed out to me that the question as originally asked did not specify what kind of certificate, so my answer may not fit the question. Digital certificates which bind an identity to a public key do not need special security because they ...


2

As far as I am aware there is not. I don't believe that CAcert.org was really ever accepted widely by browsers if I remember right. You can get second-level domain certificates for fairly cheap though through GlobeSSL or SSLs.com and by fairly cheap I mean for about $10.00/year. I personally find SSLS.com easier to use than Globe but both are good.


8

The first example is a normal SSL certificate meaning that it's a valid certificate issued by a trusted Certificate Authority, but there was no extended validation of the owner of the domain/site. This could mean that the certificate claims to be from Foo Inc. but the CA did not check that the person/entity applying for the certificate was indeed Foo Inc. ...


2

The difference is that the lower bar indicates an Extended Validation certificate, and the upper bar doesn't. See the support page.


3

You can only use the ECDHE-RSA ciphers from that list if all you have is an RSA certificate. Same thing for ECDSA certificates, which only can be used with the ECHDE-ECDSA ciphers on that list. ECDH-* is fixed in the sense that your certificate contains the fixed public parameters for and key, which can be used for the key exchange. This certificate is then ...


2

This could be due to the length restrictions on certificate keys. Microsoft enforced a minimum key length limit of 1024 bits in August 2012. Check that your self signed cert is created with a key length of at least 1024 bits. For more info you can check out this blog post What does the “This certificate has an invalid digital signature.” message actually ...


2

The "ValiCert Class 2 Policy Validation Authority" root from 1999, along with about a dozen other roots from ValiCert and other CAs, are being phased out because they're only 1024 bits. 1024-bit RSA is increasingly close to being breakable1, so the community has decided to get rid of them in an orderly manner by 20112 to prevent a major security incident and ...


1

Authentication is about reliably recognizing who is at the other end. Since, from the server, you "see" the client only through network packets, and since everybody can buy the same kind of hardware, you may hope to properly authenticate a specific client only if that client is able to compute things that other systems would not. This implies that the client ...


1

Take into account that there are server software (like IBM HTTP Server) that will not start at all if the root CA is not included in the keystore.


1

I send the root when it is convenient to do so. If the client trusts the root, then it makes no difference whether you send it or not. When the client does not recognize the root, in my experience the MS Windows client produces much less confusing diagnostic messages if the untrusted root was provided in the chain. As for how it knows what root to use if ...


1

what does a browser use to compare against for validation since the server won't be supplying its root cert during the handshake The whole idea of certificate checking is that the clients has some root certificates it trusts (shipped with the browser or OS) and that it validates the certificate the browser sends against this local trust anchor. This ...


3

The server always sends a chain. As per the TLS standard, the chain may or may not include the root certificate itself; the client does not need that root since it already has it. And, indeed, if the client does not already have the root, then receiving it from the server would not help since a root can be trusted only by virtue of being already there. What ...


6

Once a computer boots, the operating system is given near exclusive control over the system resources (kernel access). After this occurs, if a program wants to run, it must ask the OS to let it run. Before iOS allows an application to run, it examines the code that is going to be loaded in to memory from the binary and checks it against a signed value that ...


5

An app must be code signed with a certificate issued by Apple. Whenever an app is run this signature is checked using its public key. As long as the certificate chain is traced back to Apple as the Certificate Authority, then the app is authenticated. More info on Code Signing. This is a bit of a generalization. Detailed guide from Mac Developer Library ...


5

It's actually not a SHA1 hash in the CSR. It's a signature of the message. For simplicity, I'll assume we are talking about RSA certificates, where the public key is (N, e) (the modulus and public exponent which is typically 65537) and the private key is (N, d) (the modulus and the private exponent which can be easily calculated via Euclid's extended ...


2

You can add, for example the -sha256 flag to the OpenSSL command line when generating the CSR. I don't believe any CA will change how they sign your CSR based on this, and it certainly won't affect the certificate chain. They're not resigning the cert chain for each key, the only signature operation they do is on your CSR itself. Any intermediate/root CAs ...


2

A cookie has only one function: to be sent back to the server. It is stored on the client, but the client does not understand its contents; and the client does not use it except by sending it back. Which basically explains that the "answer" you quote is not a real answer: it tries to side-step the problem by stating that side-stepping the problem would be ...


0

Is this for WS-Fed or for SAML? I've only ever used this for SAML. In the SAML world, this is imported from the partner metadata and is the public key of the certificate the partner uses to sign assertions (In WS-Fed terms = claims). The RP uses this to validate the assertions.


0

Google "MITM PROXY", you will find a lot of tools. One example is: http://mitmproxy.org/ With cell phones, MiTM attacks are multi-route, so you have to sometimes do some pretty technical set up of environments to completely cover all the paths. Remember you have 3g/4g, sms/mms, wireless, NFC, BT/BTLE. Of course if you are using just the emulator, then you ...



Top 50 recent answers are included