Tag Info

New answers tagged

1

The password in SRP is actually a shared secret of (possibly) low entropy. It can be the "password" as the human user understands it, or anything that is deterministically derived from the password. In your case, yes, using a password hashing function such as PBKDF2 is a valid approach. It has the following caveats: PBKDF2, like bcrypt and other good ...


11

To complement the answer from @raz, one must be aware of Protocol Downgrade Attacks. Browsers like IE send their maximum supported version, and then the server chooses (in your case, IE says "I know up to TLS 1.2" and the server responds with "we will do TLS 1.0"). However, browsers know that there exist buggy servers out there, that will simply have an ...


9

The server chooses which cipher suite to use for establishing the secure channel. The client (browser) poses the protocols and encryption algorithms that it will accept. The server chooses the one it deems most secure (based on its own list of acceptable protocols) and that is used for the secure channel. If the server does not see any cipher suites that ...


2

Sending one type of network traffic over another protocol is called network tunneling or covert channeling. This is quite easy to do, and with some experience, you can send plaintext data over port 443 (to make it appear encrypted to the untrained eye) or send IM messaging traffic over port 80...the opportunities are endless. The method of sending data ...



Top 50 recent answers are included