Tag Info

New answers tagged

-1

Also one thing to consider very carefully, is that certain antiviruses work by scanning the traffic. If the site is using HTTPS, a virus can in fact slip undetected past the radar. This is especially important if you either have a antivirus service provided by your ISP, your employer, or your school, which is based on a "Proxy". This is why some proxies ...


1

Can you confirm what you're actually asking here; Is it that you have two domain names IE; 1 - Networkguys001-website.co.uk 2 - Networkguys001-mobileapp.co.uk and you want to have 1 certificate which secures both domains? If this is the case then what type of certificate did you buy from Digicert, I've included a list below; WildCard SSL ...


1

Authentication of the client does not prevent cross-site attacks against the web application like CSRF or reflected XSS. They only prevent direct access by a third party. It does not matter what kind of authentication you use, i.e. all the same for password, two factor, client certificates or whatever. The same is true for VPN.


1

If you use a VPN you still need to authenticate the user to establish the VPN. A client certificate is a very good authentication factor but should be used in conjunction with a password as there are several examples of malware that steals certificates in addition to other ways they can be compromised. Client certificates tend to have a support overhead ...


0

There are lot of strange things people doing wrong when using SSL. And while I've not seen this one it might be, that they are trying to use the serial number as 32 bit, which means a maximum value of 4294967296 (or 2147483648 is they use signed int). This would fit into your description where 10 digit is ok (at least if below 4294967296), but 12 digit is ...


3

The secure from https isn't related to content on a website/service. It is called 'secure' because theoretically the security protocols (ssl/tsl and some others) do not allow the information being exchanged to be easily understood (it encrypts the data flow), so, even if someone would catch your packets, they would have to decrypt it to understand the ...


-1

I realize this was a while back, but there were DNS resolution issues with certain Linksys routers. May have been a cause.


2

In addition to the other points raised, it's worth mentioning that even a trusted site (for example, your bank), could still be infected by a virus that makes it behave maliciously. So even if you trust the organization, https still does not guarantee that the website doesn't do malicious things.


1

A Pharming attack can be used to redirect your traffic to a malicious server. This server will connect to the legit one and will authenticate on it as if it is you. Then it will present to you the information or web page from the legit server. For you - it will appear as you are connected securely to the legit server but now there is a MITM that has access ...


0

When the cookie is created by the web app, there are optional flags which can be set to restrict how the cookie is used. With no flags set, the cookies can be read over an insecure connection or may be used in unexpected and unplanned ways. To remediation your finding, you will need to ensure that the correct flags are set when the cookie is created. In a ...


5

In short: Yes, it can indeed be malicious! Accessing a site via HTTPS means that the connection between your computer and the website's server is encrypted and secure. What HTTPS does Encrypt the data being transmitted over the network between your computer and the website's server to prevent third parties from intercepting it. Prevent man in the ...


0

A cookie that has the secure attribute set will only be sent over an HTTPS connection, so if the client in future attempts to connect to the server over unencrypted HTTP, the cookie will not be sent with the request, and will not, therefore, be exposed to theft. As to how to ensure your specific cookie is marked as secure, you will have to consult with ...


0

Yes, they can. For example, https connections to Google are blocked in China while user can access other websites via https, such as Bing.


8

Connecting to VPN and using the Internet in the scenario you described is actually very secure. In the case you're talking about (mutual authentication), it is safe to say that ISPs aren't able to intercept and eavesdrop on the connection to know what the user is doing. However, in the example you made about war situations, government agencies don't just ...


3

Yes, it can easily be - malicious JavaScript or viruses can be transferred over HTTPS as easily as over HTTP no problem. It may be somewhat less likely as the source of the valid verified HTTPS message is known. However still may happen if the HTTPS site has had security hole, has been attacked, compromised and malicious content has been installed on it. It ...


1

Yes. In your case, one of the servers plays the role of a SSL client. It initiates a SSL connection and sends mail to another server that plays the role of a SSL server. From the document that you mentioned in your post: All versions of OpenSSL are vulnerable on the client side. Only 1.0.1 and above are currently known to be vulnerable on the server ...


2

Add to the list that the CA itself could have been hacked (e.g. DigiNotar) and used to issue fake certificates, or your browser might be forced to use fake CAs specifically so that your connection might be intercepted and tampered with - as is sometimes used on corporate networks. Oh, also the certificate might have been faked because it was using MD5. As ...


1

Banks are usually not known to work in an agile way and quickly follow the latest developments. Like with lots of other large companies there is lots of paper work involved if somebody tries to change something, which costs efforts, man power, time and thus money. I don't think that a system administrator just can decide to change the ciphers. Instead it ...


3

I guess the most concise answer to this question is: They are insured. Currently industry standards don't require PFS and therefore insurances pay even if the bank had no PFS. There was a similar question on 30c3, about why the banks are using Windows XP as their operating system. Those standards can also be a reason why banks can't implement new methods ...


22

No, HTTPS does not necessarily mean that a site is not malicious. HTTPS means very little as to the security of a site. It's specifically geared to keep your communication with the site secure from eavesdroppers and tampering, but offers nothing as to the security of the site itself. Yes, a site serving content over HTTPS has a certificate. That means ...


29

Not at all a guarantee. HTTPS means that the web page has SSL, which simply means that your connection to the page is encrypted. The content on the page could be anything that could be posted on any web site whether encrypted by SSL or not.


5

What an ISP could do As the network operator, the ISP could block all traffic to/from some IP addresses for port 443, which is the standard TCP port used for HTTPS. That could be a simple firewall rule. By "block", I mean preventing the TCP connection from being established at all. (Sending back a denial page over HTTPS is quite a bit more challenging — ...


7

Current browsers all do SNI (Server Name Indication) to make it possible to setup different hostnames on the same IP but with different certificates. To make this work the hostname of the target server is included in clear in the initial handshake packet from the client (ClientHello). By selectively blocking the ClientHello if it contains specific strings ...


8

Technically, an ISP can block any traffic since they are your path out to the rest of the Internet. They can block any ports, websites, etc. If you are asking if they can downgrade a site you request with HTTPS to regular HTTP, it possible they could serve you such a page. But it would not appears as HTTPS, you would see the URL as HTTP and would see no ...


3

Your question is fundamentally misguided. In some cases, the government may have been given access to private keys voluntarily by the organization that controls the keys, but if this is the case, they could just as easily share the contents of what is sent over the VPN as well. The government could potentially use a complicit CA to sign something ...


5

First of all, HTTPS, if implemented correctly is not weak. Second of all if you are on the radar of a government, your last worry should be that they start decrypting your HTTPS traffic using a MiTM. If they are really interested in you, strong crypto won't be able to protect you from getting wrenched to the knee. Most secure VPNs solutions use strong ...


1

The «reference browsers» are marked with an R in the table below. What results were you given there? The problem may be on some of them (IE?) not supporting those ECDHE_RSA_* ciphers.


1

Usually you can say that maintaining the OS' CA list is the responsibility of the admins of the client servers. Even if it weren't for your application, they should maintain that list, as long as there are applications that rely on it. If you have special requirements for the security of the https connection, you could run your own CA, and create a special ...


3

OpenSSL does not come with a list of trusted certificate agencies, it only has a default path where it looks for these CA. On Linux and *BSD this path is usually populated by the OS, often based on the list Mozilla uses in the Firefox browser. But, there is no such list on Windows, because OpenSSL can not deal with they way windows stores the certificates. ...


0

It is clearly not safe to post your private data without the https, steer clear of it. The potential for theft of your private information on public networks for the purpose of stolen identity while promising people government documents is just too high. I cannot imagine a government site would create such a service on an insecure platform. This looks like a ...


1

As far as I know, iframe are always vulnerable to Clickjacking. This is a big reason why website should not do log in in an iframe and why you need the header X-Frame-Options or now frame-ancestors on your log in page. Also, as mentioned in your post and that answer, the content of the http page can be intercepted and changed by a man in the middle. Since ...


2

https login iframes are secure from passive eavesdropping but won't help against active MITM. The js vulnerabilities may have been closed, but the issue remains, as the parent html (served over http) can still be modified, including the url of the iframe. Then the MITM can set up the login page via http and that will be loaded by targeted users. Only users ...


0

The observation and behavior is correct, but the conclusion is wrong. The SSL certificate is issued in two ways To the site. In your case soundcloud.com . As per the naming convention, soundcloud.com and www.soundcloud.com are two different names. Hence https site accessed with www.soundcloud.com, it denied saying the certificate is not issued to ...


1

I think it's more of a security concern as highlighted in 1. CAs like VeriSign uses the two-tier hierarchy (or trust chain) concept to provide more security. This is because the roles of the primary and secondary CAs are separated and may be hosted in different servers, maybe in different geographical locations. So, most probably more precautions are ...


13

Your browser is showing this warning because Sound Cloud apparently has incorrectly configured redirect for the following URL: https://www.soundcloud.com/oembed redirects to: http://soundcloud.com/oembed Notice the normal "http". This is why the browser is raising a red flag when embedded inside another https-based website/page. Whereas, ...


1

The key to security is understanding attack vectors. Who is trying to get access to your data? It's a fundamental theorem that you can't ungive information. If a client has received data from your server, that can't be undone. Cryptography just makes sure that the right client receives information. In particular, "the app itself" is not something which you ...


2

The first thing you should do is to ensure that all communication between your app and the server uses HTTPS rather than HTTP. This should protect you from casual packet inspection. To make this setup more secure, you may also consider using certificate pinning to prevent any man-in-the middle attacks involving a forged certificate for your site. If you are ...


85

I think you are making a huge assumption with your question: Why does Chrome consider the "www." in an HTTPS url as a security risk? as this is simply not the case. What is happening is that SoundCloud is forcing users from www.soundcloud.com to soundcloud.com with a 301 redirect. The problem is that they are redirecting all traffic to ...


0

There are multiple families of curves. NIST choice was about short weiertstrass equation for prime fields (y^2 = x^3 + ax + b) %p with order n, cofactor h. Custom curves in SSL is the choice of different a,b,p,n,h for the same equation NIST binary fields is a different curve family ed25519 is from the family of twisted edwards curve c25519 is a curve ...


1

For what it's worth, John Hardin's answer was correct when written, but there has been some good news. In August 2014, AWS announced support for new AES cipher suites, including the nice ECDHE ones used in the question. That configuration should now work perfectly with CloudFront. The cipher suite documentation linked above includes the new list.


12

HTTPS gets you confidentiality (encryption), authentication (identity), and integrity (tamper-evident connections). You don't care about so much about the first one in your case, but you should care about the second two. The "identity" part implicitly protects you from certain DNS attacks, but there is the chicken-and-egg problem (hence HSTS). There's also ...


9

Other than the cost, are there any downsides to HTTPS? Yes, HTTPS traffic cannot be cached by third party proxies. If your content is highly cacheable (very likely if your site is mostly static content) and you have lots of users that have slower internet connection (e.g. most people in developing countries rely solely on slow, congested mobile ...


1

HTTPS is SSL on top of HTTP, that is yet another layer. This introduces overhead which can be a problem, see Is there ever a good reason _not_ to use TLS/SSL?. As an additional layer it also introduces more complexity on the server side, because you get all the server-side problems of HTTP (application level DOS like this) and then the problems of SSL (like ...


4

HTTPS is still useful even without sensitive data being passed over the wire. SSL also guarantees identity, so the client knows that the information does indeed come from you and not someone else. The only real downside for a long time was performance. However, this has largely disappeared now as SSL/TLS implementations have got better and technology ...


1

Quite simple :-) First of all I got some weird errors when I run your script: PHP Notice: Use of undefined constant curlopt_cainfo - assumed 'curlopt_cainfo' in ... PHP Warning: curl_setopt() expects parameter 2 to be long, string given in ... So I replaced with curlopt_cainfo with CURLOPT_CAINFO - that seems to get rid of them. I added the following ...


1

HTTP(s) services on office printers are not generally necessary for normal operation. While the information and configuration options available through the web interface are useful, the same is most often also available by other means. User interfaces on the hardware itself, printer drivers, and sometimes even telnet/SSH are common alternatives to using the ...


4

If you are not using the HTTPS connection, then it would seem security is not a concern and it would be irrelevant whether the HTTPS is displaying and error. The certificate is part of what gives authenticity to the connection. If you consider the HTTPS lack of a certificate to be a security issue, then just using HTTP itself would also be an issue. If the ...


1

Forward Secrecy The key used to protect transmission of data must not be used to derive any additional keys, and if the key used to protect transmission of data is derived from some other keying material, then that material must not be used to derive any more keys. In this way, compromise of a single key permits access only to data protected by that ...


2

EDIT : If the proxy SSL certificates are already installed on the user computer then yes absolutely and here's the right answer. Otherwise keep reading... Yes and no. No because by replacing the SSL certificate of the server by your own, the user's browser will raise a big scary warning that the certificate is invalid and will warn the user that he should ...


1

Each session means each SSL session. An SSL session can be reused over multiple TCP connections (that is SSL connections) if both client and server implement session reuse and each of the SSL connections gets closed in a clean way. A SSL connection might also consist of multiple SSL sessions if you do multiple full SSL handshakes within the same connection. ...



Top 50 recent answers are included