Hot answers tagged

4

Generally, it is ill-advised to implementing your own session handling. If you can, you would be better off by using a well known and well tested implementation. These are the issues I see in your procedure. User requests password reset How will you handle misuse of this function - will you send one email per reset attempt, or will you implement a ...


4

Generally speaking†, one cannot intercept HTTPS communications. However, a hot-spot provider can do the following: See the hostnames you want to connect to from your DNS requests See the IP addresses you connect to If you type in say http://yourbank.com, hoping for a redirect to https://yourbank.com, the hot-spot owner can intercept that and ...


3

Try to mark your IPs with type IP. (instead of type DNS.). Namely, make your section look like this: [alt_names] DNS.1 = chacheserver.net DNS.2 = *.chacheserver.net DNS.3 = *.*.chacheserver.net DNS.4 = *.*.*.chacheserver.net DNS.5 = 192.168.1.130 DNS.6 = 192.168.1.70 DNS.7 = 192.168.2.130 DNS.8 = 192.168.2.70 DNS.9 = 192.168.8.70 DNS.10 = 192.168.8.130 ...


3

You've added 127.0.0.1 to your alternative DNS for the certificate, but 127.0.0.1 is an IP address, not a domain name. The DNS field requires the use of a domain name, which means the client does a lookup on the domain name of the IP and gets localhost. Since this doesn't match ("127.0.0.1" != "localhost") you get the mismatch error. The field you're ...


3

If it gets resources from a site like a CDN the certificate will be verified against the URL of this resource, in this case the CDN. The URL of the HTML file embedding these resources does not matter in this case, only the URL of the resource itself. ... with a protocoless path A path like //host/page instead of http://host/page or https://host/page ...


3

You can have multiple valid certificates with the same subject but different keys active at the same time. A possible use with SAN certificates would be to use certificates with the same subject but different key for the different hostnames contained in the certificate. You could even use it for the same hostname (i.e. same hostname on multiple IP addresses) ...


2

Universally Unique ID v 4 with device pre registration sounds about right for this sort of application. When a device is in the factory you flash it's firmware with a UUID in it. Then you register that UUID with the DB. If the UUID exists, you generate and flash a new one. This should be exactly what you want because now if someone grabs a device, they have ...


2

Your primary problem when handling client-provided is going to be XML External Entities (XXE) attacks. Systems with such vulnerabilities can often be exploited to read files or enumerate the internal network which the server is on. In PHP you can help fix this by calling libxml_disable_entity_loader(true); in order to disable external entities. Another ...


1

There is no point in trying to prevent this. Technically I guess you could slow down an attacker by implementing your own crypto (SSL Kill Switch modifies the OS-provided crypto functions) but even that will eventually get cracked given enough time and effort. If you don't control the hardware, your software has no chances. Just live with it and let people ...


1

This doesn't directly answer your question (it was answered adequately above), but given your paranoia the one thing you do need to be wary of is using public terminals provided by a vendor, such as in a library, internet cafe, employer, school, etc. If they are providing you the endpoint/device, they can manipulate the certificate chain and intercept all ...


1

TL;DR Concatenate all but root. It's only required to concatenate site certificate with the intermediate certificate. If there is more than one intermediate certificates you need to concatenate all of them. The "root certificate" is the last certificate in the chain - it's the last because it is self-signed, and no other certificate in the world could ...


1

This sounds like you are looking for a VPN but want TLS to provide the security (instead of e.g. IPSec). If platform compatibility is not your concern, then Microsoft has developed a Secure Socket Tunneling Protocol which uses such an SSL-VPN scheme. If the "some kind of devices" you are talking about are also Windows-based, then you might not even need ...



Only top voted, non community-wiki answers of a minimum length are eligible