Tag Info

Hot answers tagged

10

The presented case is the prime example why a self-signed certificate provides almost no security at all: it can encrypt the data but is impossible to authenticate it. Anyone can create any certificate in name of anything and have it encrypt data. That's why there is the certification chains in HTTPS and key signing on PGP keys, for example. In this case, ...


8

[...] is there any way that they can communicate without Eve reading the messages? Nope. Against an active Man in the Middle attack (active adversary traditionally named "Mallory") like this one, you're out of luck. Against a purely passive MITM (passive eavesdropper, traditionally named "Eve") this would have worked.


5

About Chrome According to https://www.google.com/chrome/browser/privacy/whitepaper.html In the event that Chrome detects SSL connection timeouts, certificate errors, or other network issues that might be caused by a captive portal (a hotel's WiFi network, for instance), Chrome will make a cookieless request to http://www.gstatic.com/generate_204 ...


4

A Man-in-the-Middle really is simultaneous double impersonation: the attackers poses as a fake server when talking to the client, and as a fake client when talking to the server. The beauty of the MitM is that since the impersonation is simultaneous, the attacker can hope to reuse answers from the genuine client or server, when responding to the genuine ...


2

These sites set the HSTS header (HTTP Strict Transport Security). If you have visited these site without the Burp proxy before, your browser knows (cached) the HSTS policy and sees a mismatch. The HSTS Policy specifies a period of time during which the user shall access the server in a secure-only fashion. HTTP Strict Transport Security (HSTS) is a web ...


2

The most common reason for this is that you are connected to an enterprise network that has active proxying, data loss prevention, filtering or similar. In order to do that for the increasing number of encrypted sessions, "clever" security devices perform a man-in-the-middle attack on your connection by replacing the normal certificate with their own. So now ...


2

The problem with what your asking for is that there isn't a 1 to 1 mapping of the OSI layer to actual implementations. The OSI layers are really conceptual more than physical. In reality, the demarcation between the various layers is very blurred, which makes it near impossible to implement a tool which can break things up and break them into specifric layer ...


2

Your protocol is not safe by any means! Example for MitM: A sends random nonce G1 to B C intercepts and sends nonce G1c to B B sends back hash_k(G1c) and random nonce G2 C intercepts and sends hash_k(G1) and nonce G2c to A A verifies hash_k(G1) (is OK), then sends back hash_k(G1 | G2c) C intercepts and sends back hash_k(G1c | G2) B verifies and a ...


1

As long as the data travels inside a properly configured SSL/TLS connections, there is no security issue regarding the increase amount of data sent through the internet, the only downside would be an increased load on your server. If you cannot trust local storage, then fetching the data from the server when it is required seems the best option from a ...


1

No. Stick to known protocols such as TLS, Kerberos, SSH & IPSec for key exchanges. Try researching Diffie-Hellman key exchanges and ECDH (Elliptical Curve Diffie-Hellman, the new method of key exchanges like your example).


1

There are some news articles about existing backdoors on CAs for use by Security Agencies, but the trustworthiness of these news must be checked, New NSA Leak Shows MITM Attacks Against Major Internet Services There is no evidence that shows the trusted CAs use their certificates for MITM attacks, because sooner or later will be identified or disclosed ...


1

It may depend on how your certificate is installed. If your client doesn't recognize your certificate, then there's your problem. Go read up on how certificates work to understand what's happening here. If your certificate is installed as a globally-trusted root CA, then the browser will assume that a public CA is behaving badly again, and won't let the ...



Only top voted, non community-wiki answers of a minimum length are eligible