Tag Info

Hot answers tagged

85

I think you are making a huge assumption with your question: Why does Chrome consider the "www." in an HTTPS url as a security risk? as this is simply not the case. What is happening is that SoundCloud is forcing users from www.soundcloud.com to soundcloud.com with a 301 redirect. The problem is that they are redirecting all traffic to ...


13

Your browser is showing this warning because Sound Cloud apparently has incorrectly configured redirect for the following URL: https://www.soundcloud.com/oembed redirects to: http://soundcloud.com/oembed Notice the normal "http". This is why the browser is raising a red flag when embedded inside another https-based website/page. Whereas, ...


12

HTTPS gets you confidentiality (encryption), authentication (identity), and integrity (tamper-evident connections). You don't care about so much about the first one in your case, but you should care about the second two. The "identity" part implicitly protects you from certain DNS attacks, but there is the chicken-and-egg problem (hence HSTS). There's also ...


9

Other than the cost, are there any downsides to HTTPS? Yes, HTTPS traffic cannot be cached by third party proxies. If your content is highly cacheable (very likely if your site is mostly static content) and you have lots of users that have slower internet connection (e.g. most people in developing countries rely solely on slow, congested mobile ...


8

Not at all a guarantee. HTTPS means that the web page has SSL, which simply means that your connection to the page is encrypted. The content on the page could be anything that could be posted on any web site whether encrypted by SSL or not.


7

Technically, an ISP can block any traffic since they are your path out to the rest of the Internet. They can block any ports, websites, etc. If you are asking if they can downgrade a site you request with HTTPS to regular HTTP, it possible they could serve you such a page. But it would not appears as HTTPS, you would see the URL as HTTP and would see no ...


5

No. HTTPS means very little as to the security of a site. It's specifically geared to keep your communication with the site secure from eavesdroppers and tampering, but offers nothing as to the security of the site itself. Yes, a site serving content over HTTPS has a certificate. That means that the individual who requested the certificate from the CA ...


5

Current browsers all do SNI (Server Name Indication) to make it possible to setup different hostnames on the same IP but with different certificates. To make this work the hostname of the target server is included in clear in the initial handshake packet from the client (ClientHello). By selectively blocking the ClientHello if it contains specific strings ...


5

First of all, HTTPS, if implemented correctly is not weak. Second of all if you are on the radar of a government, your last worry should be that they start decrypting your HTTPS traffic using a MiTM. If they are really interested in you, strong crypto won't be able to protect you from getting wrenched to the knee. Most secure VPNs solutions use strong ...


4

HTTPS is still useful even without sensitive data being passed over the wire. SSL also guarantees identity, so the client knows that the information does indeed come from you and not someone else. The only real downside for a long time was performance. However, this has largely disappeared now as SSL/TLS implementations have got better and technology ...


3

Your question is fundamentally misguided. In some cases, the government may have been given access to private keys voluntarily by the organization that controls the keys, but if this is the case, they could just as easily share the contents of what is sent over the VPN as well. The government could potentially use a complicit CA to sign something ...


3

OpenSSL does not come with a list of trusted certificate agencies, it only has a default path where it looks for these CA. On Linux and *BSD this path is usually populated by the OS, often based on the list Mozilla uses in the Firefox browser. But, there is no such list on Windows, because OpenSSL can not deal with they way windows stores the certificates. ...


2

The first thing you should do is to ensure that all communication between your app and the server uses HTTPS rather than HTTP. This should protect you from casual packet inspection. To make this setup more secure, you may also consider using certificate pinning to prevent any man-in-the middle attacks involving a forged certificate for your site. If you are ...


2

https login iframes are secure from passive eavesdropping but won't help against active MITM. The js vulnerabilities may have been closed, but the issue remains, as the parent html (served over http) can still be modified, including the url of the iframe. Then the MITM can set up the login page via http and that will be loaded by targeted users. Only users ...


2

I guess the most concise answer to this question is: They are insured. Currently industry standards don't require PFS and therefore insurances pay even if the bank had no PFS. There was a similar question on 30c3, about why the banks are using Windows XP as their operating system. Those standards can also be a reason why banks can't implement new methods ...


1

Banks are usually not known to work in an agile way and quickly follow the latest developments. Like with lots of other large companies there is lots of paper work involved if somebody tries to change something, which costs efforts, man power, time and thus money. I don't think that a system administrator just can decide to change the ciphers. Instead it ...


1

What an ISP could do As the network operator, the ISP could block all traffic to/from some IP addresses for port 443, which is the standard TCP port used for HTTPS. That could be a simple firewall rule. By "block", I mean preventing the TCP connection from being established at all. (Sending back a denial page over HTTPS is quite a bit more challenging — ...


1

The «reference browsers» are marked with an R in the table below. What results were you given there? The problem may be on some of them (IE?) not supporting those ECDHE_RSA_* ciphers.


1

Usually you can say that maintaining the OS' CA list is the responsibility of the admins of the client servers. Even if it weren't for your application, they should maintain that list, as long as there are applications that rely on it. If you have special requirements for the security of the https connection, you could run your own CA, and create a special ...


1

As far as I know, iframe are always vulnerable to Clickjacking. This is a big reason why website should not do log in in an iframe and why you need the header X-Frame-Options or now frame-ancestors on your log in page. Also, as mentioned in your post and that answer, the content of the http page can be intercepted and changed by a man in the middle. Since ...


1

I think it's more of a security concern as highlighted in 1. CAs like VeriSign uses the two-tier hierarchy (or trust chain) concept to provide more security. This is because the roles of the primary and secondary CAs are separated and may be hosted in different servers, maybe in different geographical locations. So, most probably more precautions are ...


1

The key to security is understanding attack vectors. Who is trying to get access to your data? It's a fundamental theorem that you can't ungive information. If a client has received data from your server, that can't be undone. Cryptography just makes sure that the right client receives information. In particular, "the app itself" is not something which you ...


1

For what it's worth, John Hardin's answer was correct when written, but there has been some good news. In August 2014, AWS announced support for new AES cipher suites, including the nice ECDHE ones used in the question. That configuration should now work perfectly with CloudFront. The cipher suite documentation linked above includes the new list.


1

HTTPS is SSL on top of HTTP, that is yet another layer. This introduces overhead which can be a problem, see Is there ever a good reason _not_ to use TLS/SSL?. As an additional layer it also introduces more complexity on the server side, because you get all the server-side problems of HTTP (application level DOS like this) and then the problems of SSL (like ...



Only top voted, non community-wiki answers of a minimum length are eligible