Tag Info

New answers tagged

0

Note: Java/JSSE doesn't implement real SSLv2 (only hello) so no need to disable it. As the linked article says, recent updates disable SSLv3 by default, but you can re-enable it; try not to. Attacks: I don't think there are any direct attacks from v2Hello, but there may be functional limitations. Primarily it prevents use of extensions, some of which are ...


0

This sounds like a good plan. Some things to consider are: Private keys need to be private. That likely means a secure store with some kind of password/key to unlock the store. Frequently OS or framework support is easiest. HSMs will be a more secure alternative but I'm guessing that they would be overkill in your situation. You need to provide ...


-1

Only intermediate entities (firewalls) can't see the https URLs, the remote server and your browser obviously can. If it is a parental control system, maybe you don't need to defend against a highly sophisticated attack (here "highly sophisticated" == "can uninstall browser plugins"). There are numerous plugins for the task (example). Some of them has also ...


2

Fast answer No! Acceptable workaround Even an HTTPS connection from IE or Windows XP can't be considered as secured by a normal and even a skilled user. It was a known weak combination long before Microsoft announced its support deadline. Hence I would suggest a 2 steps approach for a webserver architect. Detect the referer, and if it is IE any version ...


2

So I decided to put my comment to "StackzOfZtuff" answer in a new post, as you can actually dissect the key exchange in more detail with this method. This answer is copied from this post over at superuser.com (so all thanks go Thomas Pornin): use openssl with its -msg option yields the information we care for openssl s_client -connect mail.example.com:143 ...


0

An offline machine that wants to still verify code signatures, maybe.


1

I believe your understanding is correct. I think Windows stores intermediates because: 1) Having local copies of intermediate certs allows it to "cope" with connection scenarios where the remote server is not chained properly. I've seen scenarios where a web server isn't configured properly but IE doesn't complain. 2) The certificates are used for other ...


0

I can only guess it's to enable caching of frequently used certificates, so that the AIA isn't queried and downloaded for End Entity certs


0

You may want to look into setting your webserver to HSTS (Strict Transport Security) which uses a special response header to tell the browser to only accept https traffic. Full Disclosure: As you might have expected, IE support < 11 I believe is limited. If you must use something client-side to check for https I think you could use ...


5

TLS_FALLBACK_SCSV fails to protect against Logjam for the same reason that Logjam actually works. That anti-fallback mechanism relies on the client putting it in the ClientHello, and being ultimately part of the input to the hash function that computes the final Finished message. This works only as long as the active attacker cannot break the handshake ...


0

You might try the following: Create a cookie with Javascript. Set the secure flag on the cookie, so that it is only usable for https connections. Make a https request to the server and check if the secure cookie was received. If it was not received then you can assume that the request on the client side was not done with https, i.e. something like sslstrip ...


1

No. TLS_FALLBACK_SCSV won't work for this. It's just the client saying "Look, you made me come back a second time and with a downgraded protocol version!" But Logjam or FREAK do not depend on a second connection. It works with the first connection. The downgrade is not on the protocol level. It's in the parameters that are delivered.


0

I believe your reasoning is solid, its just flawed as @SOJPM pointed out: I think SCSV prevents Protocol downgrade attacks (f. ex. TLS -> SSL) whereas FREAK and Logjam attack weak cipher suites. – SOJPM So TLS_FALLBACK_SCSV protects the protocol used not the cipher suite. You should disable export ciphers, SSL, RC4, etc... due to the simple ...


0

As an addition to the awnser I list my practise: For the moment I would not allow direct communications with tomcat, but setup a Reverse Proxy Connection using nginx. And have nginx do all the SSL bits. The main advantages are that nginx can be setup with better DH keys and Cipher support. as a bonus if someone is trying to 'hack' my tomcat through ...


6

https://www.ssllabs.com/ssltest/analyze.html?d=uk.care.com&s=46.137.89.126 https://www.ssllabs.com/ssltest/analyze.html?d=uk.care.com&s=54.228.236.90 The padlock is yellow because you have a certificate that uses SHA-1 in the certificate chain and Google have declared war on SHA-1 certificates. Chrome uses the operating system's root CAs. If the ...


0

I'm sure that Apple tries to make it secure but there's no real way to know exactly how they define "secure". As it sounds like you have some fairly strict requirements for considering such a connection secure, I'd assume that what the OS provides is using a lower standard. So, if you can, open the page in your browser and perform your standard security ...


7

So I think I've interpreted your question correctly. If not, fire away in the comments. Confusingly there are several factors in diffie hellman: are you doing it over elliptic curves or not, what size group have you got (let's assume "strong" and "not strong") and whether you generate ephemeral private/public keypairs or not. The problem with logjam is ...


6

Do the smoke test: (stolen from OpenSSL blog. (Archived here.)) openssl s_client -connect www.example.com:443 -cipher "EDH" | grep "Server Temp Key" The key should be at least 2048 bits to offer a comfortable security margin comparable to RSA-2048. Connections with keys shorter than 1024 bits may already be in trouble today. (Note: you need OpenSSL ...


-2

Disable any CBC mode ciphers and SSL protocols, only enable TLS 1.1 & 1.2 protocols in your server.xml. Mozilla has a good guide for allowed ciphers as well. https://wiki.mozilla.org/Security/Server_Side_TLS


0

AFAIK, there is no alternative to just trying it out. You also want to check, that both requests return the same content; in principle it is possible to configure, e.g., the popular Apapche httpd such that it returns different content depending on the protocol used.


2

I'm going to assume that you are talking about HSTS. HSTS is TOFU (Trust on first use). So from the second use onwards, you are protected. But what about that first use? I don't think there's a unified strategy. But here's some ideas: What works today HSTS Preloading: Use a browser that makes use of the HSTS preload lists. (Chrome, Firefox) And hope ...


0

For some good background, please see my presentation How to Build and Operate Your Own Certificate Management Center of Mediocrity. The gist of the presentation is that the thing most required isn't a list of the commands to run, but rather a deep understanding of all the various controls that go into operating a commercial CA, how they interact together, ...


2

Update May 2015: Facebook now uses HSTS. Good work. $ http -h get https://www.facebook.com Strict-Transport-Security: max-age=15552000; preload See also https://www.ssllabs.com/ssltest/analyze.html?d=facebook.com


0

When the server uses IIS, client authentication means mapping the client certificate to an identity, i.e. an account (local account or domain account, depending on context). IIS may apply two distinct methods, with confusing names: clientCertificateMappingAuthentication: IIS will look for a domain account that either contains a copy of the exact client ...


0

I'm not sure that there's any one solution. Different strategies work for implementing different functionality. A common strategy for a B2B deployment is for the server's organization to act as CA and sign public keys from clients. When a client cert is received, the server validates the signature and then maps the cert to a user. The user mapping is ...


21

This message is Google trying to push people nilly-willy into the 21st century of cryptography. So they point and mock when they see "RC4" or "SHA-1". This does not mean that such algorithms can be broken immediately. Only that Google would find the world a better place (or possibly a googler place) if everybody were using algorithms more to their liking, ...


68

In a nutshell: SSL/TLS client and server agree to use some weak crypto. Well, turns out that weak crypto is weak. In more details: In SSL/TLS, the client sends a list of supported cipher suites, and the server chooses one. At the end of the initial handshake, some Finished messages are exchanged, encrypted and protected with the newly negotiated crypto ...


4

Logjam is a cipher downgrade attack where a man in the middle can trick the end points into using a weak cipher. A weak cipher would allow the man in the middle to easily decrypt intercepted traffic. As with all other cipher downgrade attacks the best way to prevent it is to disable weak ciphers in the first place. If weak ciphers are not available even a ...


21

Logjam shouldn't really be called a "new" vulnerability - it's a rehash of FREAK which targets export-grade DH rather than export-grade RSA. Practical exploitation relies on the following flaws: The TLS protocol is vulnerable to having its key exchange protocol downgraded by an attacker. Servers are still supporting export-grade Diffie-Hellman (e.g. ...


0

On IE-8 after you have browsed to an https site you can select File->Properties and it will show the type of encryption being used. For Firefow click the lock icon to the left of the URL and select More Information.


0

Either the serial number assigned already exists for this CSR or the CN (commonName) attribute exists and must first be revoked or renewed.


0

Usefull when resuming a session In TLS master secret is used with server and client random bytes in a PRF function to calculate a key block. key_block = PRF(SecurityParameters.master_secret, "key expansion", SecurityParameters.server_random + SecurityParameters.client_random) Then key block ...


2

Whats wrong? The waring you are getting is about "Mixed-Mode" which is basically when some parts of a site are sent over HTTPS and others are sent over HTTP. Some people down play this as unimportant because "The important data is encrypted" and while in a sense they are correct it can still be a security risk. Browser generally flag it for two reason: ...


2

(Moved from comment to answer) On Firefox, I found 2 Security Warnings in the Console: Loading mixed (insecure) display content "http://julian.referata.com/w/images/background-normal.png" on a secure page Loading mixed (insecure) display content "http://juliancubillos.com/favicon.ico" on a secure page They are most likely the reason why a warning sign is ...


2

I just did a small audit if your site, here are my findings. ssllabs test report grade A which is good a curl -vvv https://www.jcwiki.website/wiki/Main_Page | grep "http:" yielded no results, also good. Opening the site in Google Chrome (Version 42.0.2311.152) incognito window yields a mixed content warning. I checked the development tools and the reason ...


1

It has been argued that an emailing client, using the POP3 protocol over SSL, will reconnect on a regular basis and send the authentication password at a predictable place within the flow, close to the beginning. Thus, if a RC4-based cipher suite is used, a passive attacker may simply observe and wait, so that the known small biases of RC4 gradually reveal ...


1

Some attacks (e.g. BEAST, CRIME) are only effective against HTTPS. Not really. The underlying problems of ciphers or of use of compression are not specific to HTTPS, only some features of HTTP made it possible to exploit these problems because you were able to add chosen plain text to the encryption etc. You might find exploits for other protocols which ...


2

If you truly wish to be a CA take heed of the security implications of doing so. The private key used to generate the root CA for your intranet should literally be locked in a safe. And access to said safe should be physically monitored. Using a self signed root CA forces your users to not only trust that you are performing due diligence with the safe ...


4

2FA will decrease the chance that an attacker can steal a complete set of login credentials because, as you point out, the second factor is likely limited by lifetime or a once-use policy. But 2FA will not affect snooping or session hijacking. So, while an attacker may find it more difficult to login as you, they can watch your communication stream and send ...


0

As you have stated yourself: it is slightly more secure because it is limited to a < 30 seconds timeframe, but that really doesn't matter much in the grand scheme of things: it is still very insecure and it will mostly just increase the effort legitimate users will have to put in.


3

Disabling RC4 completely would be great in an ideal world, but unfortunately we don't live in an ideal world. If you do disable it, certain mobile and embedded devices may not be able to communicate with you. Keep in mind that IE on Windows XP can only use RC4 because the underlying cryptographic API (CAPI) on the system doesn't have AES. As for the risk, ...


2

I think you're asking the wrong question. To me, "How much will my users be inconvenienced?", is far less important than "How sensitive is the information on this server?", or "How much would I care if it got hacked?". Hardening a system usually leads to some inconvenience. The level of inconvenience you're willing to endure (and inflict on your users) ...


0

RC4 has been proven to be broken so is probably a sensible thing to disable it from a webserver. You shouldn't bother to keep it on just to provide access to obsolete web browsers - after all, they're called obsolete for a reason, and giving the visitor incentives to upgrade his old browser is good.


2

I will answer this in a two-level approach: General term answer and the specific SSL/TLS clarification in blockquotes. Public Key Cryptography (PKC) solves the problem of securely exchanging information without the need of previously agreeing upon a secret key. To be part of PKC, every agent needs to have a Private Key (which should only be kept by the ...


0

It's concerning how slow banks are to update their SSL configuration when their sites are vulnerable to attacks such as Heartbleed and Poodle. In the SSL Labs server tests, banking sites score typically score worse than social networks (Twitter and Gmail take security very seriously). I made this page tabling the SSL Labs scores of British banks ...


12

If your infrastructure is tiny, much of the details of running a CA (e.g. CRLs and such) can probably be ignored. Instead all you really have to worry about is signing certificates. There's a multitude of tools out there that will manage this process for you. I even wrote one many years ago. But the one I recommend if you want something really simple is ...


1

Follow these instructions to configure a Windows Based CA. Since you are issuing client certificates, be aware that SHA2 hashes aren't supported on XP. The simple answer is to: Install AD Install an Enterprise CA on the Domain Controller Edit the Certificate Template to issue End User Certificates (set the permission for users to self-enroll, or go to a ...


0

The client and server then use the random numbers and PreMasterSecret to compute a common secret, called the "master secret". All other key data for this connection is derived from this master secret (and the client- and server-generated random values), which is passed through a carefully designed pseudorandom function.


1

The answer seems quite simple to me. The final decision however, depending on the context, may not be as simple as it implies the notion of trust. SSL is a protocol allowing you to establish a secure connection over an untrusted network. The usefulness of SSL in your case therefore lies in this question: Do you trust the network between the web server and ...


7

From The First Few Milliseconds of an HTTPS Connection: The master secret is a function of the client and server randoms. master_secret = PRF(pre_master_secret, "master secret", ClientHello.random + ServerHello.random) Both the client and the server need to be able to calculate the master secret. Generating a ...



Top 50 recent answers are included