Hot answers tagged

38

You need to import the root certificate into the trust store for the browser. Once the browser knows you trust this root certificate, all certificates signed by this will show up as trusted. Note that this will only make the connection trusted for you, any others who don't have the root certificate installed will still receive an error.


35

Why security indicators fail vs. phishing There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers. You are correct that checking for URL correctness is error-prone, and ...


30

Self-signed certificates are inherently not trusted by your browser because a certificate itself doesn't form any trust, the trust comes from being signed by a certificate that EVERYONE trusts. Your browser simply doesn't trust your self-signed certificate as if it were a root certificate. To make your browser accept your certificate, go into your browsers ...


25

I was going to suggest that ensuring that the login screen for the online banking system showed the name of the bank in green, in the address bar might work. But then I started wondering if any of the local banks I know about did that properly. It's less encouraging than I'd hoped. For these nine fairly large banks, 6 provide the name of the bank in the ...


8

Actually, self-signed certificates can be secure, just not under the model we're using now. Under the wide-spread CA (certificate authority) model that everyone uses currently, the purpose of the certificate being signed by a trusted CA is to provide authentication. When we get a certificate, all we really see is 1's and 0's coming in from the jack in ...


6

There is a very extensive article at Wikipedia and it does not make sense to reiterate everything here. But to give you some highlights: It replaces OpenSSL on OpenBSD, OS X since 10.11 and on some other systems. It started with throwing away lots of stuff which was considered useless for the target platforms or insecure by design and it also added some ...


4

Is it supported by any browsers for accessing any web-sites over the https:// address scheme? I think you are referring to TLS_NULL_WITH_NULL_NULL or similar ciphers were no encryption is done. None of the current browsers offers this cipher and I don't think that there will be a reason in the future to offer such more than weak ciphers because you ...


4

Shorter answer. A lot of answers here, but none seems to get straight to the point: Without a neutral and recognized third party—such as a certificate authority—verifying certificate ownership, a certificate is meaningless. Longer answer. To better understand, when doing something like creating an HTTPS connection you have the following chain: A client ...


4

How can I identify the cipher mode which is used by TLS? There are many ways to enumerate your cipher suites and protocols enabled on your sever. Here are solutions that are assessment or script based that have little overhead and are light on the technical requirements. If it is externally available: Try out SSL Labs' test here: ...


3

[Disclaimer: I'm one of the mitmproxy authors. My opinions may be biased. :)] sslsplit sslsplit is a transparent proxy that can intercept TLS connections using a man-in-the-middle attack. sslsplit supports plain TCP, TLS and also HTTP to the extent that it removes HPKP, HSTS and Alternate Protocol response headers. Intercepted connections can be dumped ...


3

The whole grading mechanism is more propaganda and public relations than actual security. If you want good security, then you must mind the details and understand how things work internally. If you want a good grade then you should do whatever it takes to have a good grade. An "A+" from SSL Labs is a very nifty thing to add at the end of a report, but it ...


3

Making a new protocol to replace SSL/TLS would make sense only if the new protocol was "better" in some substantial way. Though SSL/TLS has a few known shortcomings, making anything better is harder (much harder) than it may seem. And people who are working on that have decided that it should still be called TLS. TLS-1.3, to be precise.


2

The best practice is to trust the root CA, for very practical reasons. Root CAs are a special beast and are expected to have very long lifetimes (20 years or more) because they require replacement in the client software, which is usually a manual process. Intermediate and server certificates are expected to change frequently - in some cases (load ...


2

As far as I understand the aim of LoadRunner (i.e. the software which VuGen is part of) is to simulate a real client like a browser. If a browser connects first to a web site which requires a client certificate then the browser has to interact with the user to find out which certificate should be used and to get the password for the private key. In this case ...


2

Flexible SSL does not provide end-to-end encryption. From here: you can see that the CloudFlare link to the server is unencrypted. However, as the user link to CloudFlare is, this mitigates most typical Man-In-The-Middle scenarios. For example, ranging from Mallory on the coffee shop wifi connection, to rogue employees at an ISP, all the way up to ...


2

Essentially your question is one of authentication. In this case, it's users authenticating the bank website is actually the bank. I think you're right, and the user is going to have difficulty in authenticating the bank through the URL (many banks have multiple URLs for instance). You're also correct that users aren't terribly sophisticated about URLs, ...


2

First, SSL stopped at version 3.0, which is massively flawed. TLS is currently at 1.2 (plus a lot of activity in the TLS 1.3 working group). This is generally a matter of acronym - hopefully when you say SSL encrypted, you actually mean TLS, and you specifically mean TLS 1.2 with AEAD ciphers. Second, for TLS of any type, both protocol version and cipher ...


2

It's not really related to Active Directory or Group Policy. That's just one way to do it. If someone can install their own root cert in your trusted store(s) then they can issue fake certs and everything thing looks legit. See Charles Proxy. One legit use for this is to allow tools like Snort to monitor encrypted traffic on a network. Some applications ...


2

This got me thinking, if I was on a public network somewhere, could they issue their own certificate making it appear trusted, and therefore giving me a green padlock on my bank site for example? Yes. does it appear trusted because of a group policy telling the PC to trust the cert? Yes. (Or some other mechanism telling the PC to trust the cert. ...


2

Any application must be given the list of "root certificates" to be trusted. In case of a browser, there is a defined list that comes by default with any browser, but this list does not contain your certificate. Imagine you don't need to actually give the list of certificates that you trust, then anyone would be able to setup a https website that an ...


2

Self-signed certificates can't be trusted because anyone is able to craft one. An attacker performing a MITM attack could easily replace any certificate by a self-signed one and impersonate any website you're browsing, even if you're using HTTPS. That's why we are using trusted Certificate Authorities to ensure that certificates cannot be falsified.


1

protocol HTTPS protects against connecting to false server ? It depends on what you consider a false server but given this weak phrase I would suggest the answer should be NO. Lets's see what you get with https and what you get not: You get that the browser checks if the hostname of the URL matches the certificates subject and if this certificate is ...


1

We all need a little context. There is a difference between "untrusted" and secure. And "Trusted" does not necessarily imply Secure (or Authentic) A self-signed certificate on an isolated network with only one server and one client is probably more secure than any "trusted" certificate. And "trusted" implies ONLY that a Certificate Authority Certificate ...


1

I like to rely on the auto-fill feature of my password manager for this check. The rationale is that I will not be clever enough to match the site URL in the browser to the expected one, while a password manager will. So when I see that it has filled in the entry for the site - the site is genuine, otherwise I should start to worry. The password manager ...


1

Both will do what you need effectively. Whether you need to use one over the other depends on your use case. From what you have described, as long as there aren't other requirements, I'd go with TLS, as it requires very little additional work on most network architectures. IPSec is just a little more convoluted to set up - but it does provide additional ...


1

NONE cipher can be available in opera 12. It is disabled by default. There seems to be TLS_RSA_NULL_SHA and SHA2, I have only tested sha. For test server, I used openssl s_server, it also requires some special configuration (NULL cipher not enabled by default). Even, when connection successfully, there were some security warning, in browser. openssl used was ...


1

This is a subset of the TLS (or SSL, for really out of date setups) cipher suite negotiation. I go into more detail in My answer to Recommended ssl_ciphers for security, compatibility - Perfect Forward secrecy, but the long and short of it is: Per the TLS 1.2 document RFC 5246 starting at section 7.4.1.2 to see, in the short short form, the cipher suite ...



Only top voted, non community-wiki answers of a minimum length are eligible