Tag Info

Hot answers tagged

8

The Heartbleed bug involves asking the server to return a block of memory that is larger than the actual information being returned. A vulnerable server will return whatever is in memory beyond the data structure it's returning. So, if you ask a server to return the extra memory and it does, then the server is vulnerable. You can examine the code diffs for ...


7

They can. In order to establish a secure HTTPS connection a handshake must happen between you, (the client, i.e. your browser or any other application) and the server. Any data sent within the handshake is not encrypted. About the risks, it's a broad topic to discuss. The plain information that you are connecting to some public server (Facebook, Gmail, ...


6

Yes. This is called "Traffic Analysis". Broadly speaking, the useful information that can be obtained is who you're talking to, and when. So if you're ssh'ed into a server and the packets look like someone typing, it then looks like you're up and actively engaged in some activity with that server. The volume of the data going back and forth can be ...


4

I think you are missing -servername expired.badssl.com $ echo "" | openssl s_client -connect expired.badssl.com:443 -CApath /etc/ssl/certs/ca-certificates.crt -servername expired.badssl.com 2>/dev/null | openssl x509 -noout -subject -dates subject= /OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.badssl.com notBefore=Apr 9 00:00:00 2015 GMT ...


3

This seems to be a bug in Chrome. Root CA Certificates are often still SHA-1 certificates, which is not a security problem (and also not considered a problem by Google: http://googleonlinesecurity.blogspot.ca/2014/09/gradually-sunsetting-sha-1.html), yet Chrome spooks users with the warning - even when the only SHA-1 certificate in the chain is the root CA ...


2

I'm not sure to understand very well what you ask, but I will try to give you an answer. First, Firefox is not compatible with AES256-GCM, only with AES128-GCM and with ECDHE key exchange. You can check this by browsing this page with it: https://www.ssllabs.com/ssltest/viewMyClient.html If you want your configuration to work with Firefox, I suggest you to ...


2

Sure, they can. A proper encryption is supposed only to hide the content, but is not expected to hide: parties involved in the communication size of data exchanged timing of packets (anything else) Moreover, some data may be leaked from the initial handshake. For example, HTTPS with SNI leaks the domain you are connecting to in plaintext even if the ...


2

Both SSH and HTTPS (relying on SSL or TLS) use encryption, but are based on an established TCP/IP existing connection. This means that even if the content is opaque, all TCP/IP information are in clear and available to someone sniffing your network. TCP/IP information includes IP address of each peer, port numbers used. This gives a good hint about protocol ...


1

OpenSSL issues this error because the root cert is not in the location that it is expects it. The default directory for this (tested only my debian wheezy machine) is /etc/ssl/certs. Hope this helps.


1

#Try "-signer" Add the "-signer" parameter. Like so: openssl cms -in demo.p7m -inform DER -verify -signer MYSIGNERCERTIFICATEFILE EDIT: aint' working.


1

Assuming your filenames are accurate, so client_cert.pem and client_prv_key.pem actually contain the client cert and privatekey respectively in PEM format: openssl pkcs12 -export -in client_cert.pem -inkey client_prv_key.pem -certfile root_cert.pem -out client.p12 # prompts for the input-key passphrase, then the output passphrase (twice) # to specify ...


1

Based on the limited information: At a minimum your looking layers of security you trying to accomplish. We'll call this the DMZ. This is the layer that Application A is accessed at, or more simply put, the point of entry for your setup. You don't want anyone beyond this point. The next layer is the backend. This is your application B and you are trying ...



Only top voted, non community-wiki answers of a minimum length are eligible