Tag Info

New answers tagged

5

What you have done is a pretty thorough test, but you can get ironclad proof this way: Install Wireshark on your own computer, turn on packet capture, and perform the login. If HTTPS, the packets you capture will be marked as such, and will be encrypted. If not, you will be able to see the login credentials en claire in the captured data. Do note that ...


3

I played around with Family Safety on Windows 8.1, and from what I can tell, it's seems to be smart enough to check the validity of the original certificate before it proceeds to replace it with a Microsoft certificate. From the screenshot below, you can tell that when I visited Google, Google's real certificate was replaced by the Microsoft Family Safety ...


3

The most sure fire way would be to place a router in line and monitor the packets, but at the end of the day it is really irrelevant. At best, they are rolling their own crypto, which is still horribly bad. There are any number of ways a non-HTTPS page could be compromised to give up the credentials even if they are doing some form of client side ...


6

Yes, the Chrome team ("Google", if you wish) intends to "gradually change their UX to display non-secure origins as affirmatively non-secure" [1]. The exact implementation details are still a subject of discussion (see the "Proposal: Marking HTTP As Non-Secure" on the browser's mailing lists), and as such it is a bit premature to make any claims about how ...


5

This sounds like a story that has grown massively in the telling. In August, Google announced that https websites would get a small boost in their search rankings compared to http sites. That's all; the http sites won't be marked or flagged as insecure. On your point 2, SSL providers are likely to get poorer, not richer, because the EFF is launching a new ...


6

The short answer: if you own a domain you can get an certificate for that domain, period. It's similarity to another domain is irrelevant. The bigger question seems to be "what sort of looking at an https page do I need to do to ensure it's really the page I think it is before entering my credentials". The short answer to that is that you should look ...


1

In terms of browsing security/privacy, any time you are over http, your traffic could be (and often is, see cache discussion below) intercepted and fiddled with by servers along the way. Period. You can't be sure if the page you see over an http connection is in fact the page that the webserver sent in response to your web client's request. As far as ...


9

Yes, you can. You can have all of the domains listed in the SAN (Subject Alternate Name) field in the one certificate, and use it for them all. This comes with a couple of things to consider, namely: If any of your servers are compromised, or the certificate is leaked, you'll have to replace it everywhere. You now have approximately five times the ...


1

If you own a domain that is very similar to another you can still get your own SSL. It will be issued to you, as the owner, and not to the other entity. While I'm not sure citiibank.com is the best example, there are numerous similar sites out there due to the fact that common names are the domains of choice. If some guy named Bob owns bob.com and has an SSL ...


3

It depends on the CA and on the type of certificate. Ordinary certificates are issued right after verifying that you control the domain in question; there is no further tracing (this is how, among other things, free StartSSL certificates are issued: they verify that you can receive mail to an address traditionally controlled by the system administrator). ...


0

You can't get a nice notification to the user without establishing the TLS connection first. This means that your server or some middlebox (load balancer) in between must still be able to talk TLS 1.0. But you then could then check the protocol version of the client inside your web application and show the nice notification there. But, if and how this can be ...


0

If you were to really think about it, having multiple sites to host your downloadable content, together with the hash keys would stop most run of the mill replacement attacks. Once again the assumption is the threat model where the attacker would have to replace in situ as opposed to in transit. Even with a single source, the copies would stop anyone from ...


2

Yes, however, this is a common pattern. For example, this is how reddit's authentication works and Instagram's. Frankly, the only thing it protects against is sending your password over the network in plaintext. But the process does expose your session and all of your browsing data over HTTP, which just means your session has the same strength as HTTP. A ...


0

A good load balancer, such as a Citrix Netscaler can offload SSL and redirect traffic based on the ability to encrypt or redirect according to what is minimally acceptable.


0

Any connection made on SSL v3 and using CBC Ciphers is vulnerable to Poodle attack. Browsers (Older browsers and other clients) will negotiate SSL as we write about it. Although most have disabled SSL by default and only work with TLS. Note that there is a new Poodle on TLS vulnerability that we will not talk about in this thread. The only ...


0

In the SSL/TLS handshake, the client sends (as part of its ClientHello) the maximum version that it supports; then the server chooses the version that will be used, which should be the highest that the server supports but it not higher than the value sent by the client. If the client sends "SSL 3.0" as highest supported version, then the server is right in ...


0

You can simply disallow the lower level of connection if you don't want it used. When establishing an SSL/TLS connection, the server lets the client know what it can support and the two work out what the best option is. If the client supports TLS and is being forced in to SSL3.0 then something is likely wrong on the client end (or it may be an older SSL ...


0

Something is amiss on the client side it sounds like. The client should initiate the session indicating the highest protocol version it can accept. TLS v1 is enumerated as "3.1" to indicate > SSL3: Since the Version numbers negotiated in the ClientHello and ServerHello messages of SSL are 3.0 and below, version numbers to be negotiated with TLS ...


4

From the iOS 7 Deployment Technical Reference document (opens a PDF): Certificate validation The first time a user opens an app, the distribution certificate is validated by contacting Apple’s OCSP server. Unless the certificate has been revoked, the app is allowed to run. Inability to contact or get a response from the OCSP server isn’t ...


0

Possibly not the best wide-usage answer, but definitely answered my problem specifically: Draytek have now released a firmware upgrade for the router that solves the issue with HTTPS sites not getting filtered.


8

Yes. SSH has standardized and quite distinct handshake packets, so you can very easily detect an SSH session initiation. Here is a transcription of Wireshark capture of an SSH session initiation: Encrypted request packet len=41 Encrypted response packet len=39 Client: Key Exchange Init Server: Key Exchange Init Client: Diffie-Hellman Key Exchange Init ...


0

TLDR: As long as the network connection to the DB is secure, and as long as salted hashes are stored in your tables, calling a stored procedure with a plaintext password is fine. I think your time and effort is better spent protecting the database from unauthorized access of the kind that makes it possible to obtain a trace of stored procedure calls. ...


8

Trust no one. Use secure strings to hold plain text passwords and hash them immediately. Gone are the times when you can hope your system is secure. It is not. It's just matter of time/money until a determined attacker can access your system. Even when traffic gets encrypted with SSL/TLS I can come up with several scenarios, each leading to passwords leak, ...


1

So it depends on the the trust worthiness of the environment. If you have zero trust in it, perhaps some encryption would be good. Additionally, the low branch set of configuration would probably be to restrict to only hosts that require SQL connectivity, though there are many different reasons why you'd want to open it up to access.


13

SQL Server has the option to encrypt the connection between application and database. When you operate SQL server in an untrusted environment, it is recommended that you enable it. When you do, hashing the passwords before sending them to the database is unnecessary as long as you trust your DB administrator. Additionally, most deployments of SQL server ...


4

When you are browsing TOR hidden services, the TOR system already provides end-to-end encryption, so another TLS layer is redundant. It is in fact counter-productive, because one of the goals of TLS is to de-anonymize the server. It makes no sense to go through the trouble to set up a hidden service and then get a certificate from a certificate authority ...


12

No, it isn't safe because you expose (in your program) a key which should be secret. Your proposal is based on symmetric key cryptography, where both ends of the communication channel need a copy of the same key. Symmetric key cryptography is effective only when both ends of the channel are secure. As others have pointed out, a key embedded in a program ...


4

No, this is not a secure alternative. It is entirely possible that a hard-coded key could be discovered, which would leave you with application traffic that is essentially unencrypted. So, if you feel the data is not sensitive enough to secure, don't bother encrypting it at all. Deliver it over HTTP. If, however, there is any reason to secure it, do ...


0

There are some misconceptions or half-truth about HTTPS: Performance: If you have lots of short connections it will be much slower because the main costs are in the initial key exchange and in the additional round-trips needed to establish the SSL connection on top of the TCP connection. The encryption itself is cheap, that is the more you transfer over ...


7

The RFC for TLS does not contain or define the term Session Key. It simply says: The master secret is expanded into a sequence of secure bytes, which is then split to a client write MAC key, a server write MAC key, a client write encryption key, and a server write encryption key. Each of these is generated from the byte sequence in that order. ...


4

HTTPS over UDP is secure. This is because the security of HTTPS doesn't use any of the properties of TCP except that it is a transport layer. Just like UDP, TCP is easy to spoof and manipulate. TCP is only to make things more reliable, not more secure. With UDP, packets can be doubled, missed or sent in the wrong order. TLS is a means to fix these issues. ...


1

Unluckily, although PGP is awesome in theory, the "real world" benefits of PGP are quite limited, if existent. If PGP was the default that everybody uses, it would rock. TLS gives you (ignoring the possibility of exploits) a secure connection to your mail server. You have the guarantee that the server you talk to is really your mail server, and that nobody ...


2

The additional overhead caused by the encrypting your payload is almost zero since CPUs today can encrypt at speeds of up to hundreds of MB/s. The only noticable delay is during connection setup, as you need a few additional round trips to set up SSL/TLS. However, if you are transferring large files, this round trip cost is negligible. Yes, caching of ...


1

If the device has a way to keep the password separate from the key file (like in firmware) it will avoid abuse when someone can copy the key file out of the device. If the password resides in a script or a configuration file, it does not add much.


9

HTTPS only protects your email between you and Google. From then on it is transferred unencrypted. That means your email can be read by: Google (and they admit that they read it!) any routers between Google and the mail service of the receiver the receivers mailserver when the receiver isn't also using https, any router between their mailserver and them. ...


6

In short, PGP protects the contents of the email, both in-flight and at rest; TLS protects the communication channel while the message is transiting a network. PGP vouches for a person and an email address; TLS vouches for a server (and optionally a client).


24

There is more at risk in using SSL/TLS than potential 0-days, because there are already known attacks that can circumvent TLS. Moxie Marlinspike has been giving Def Con presentations on it since at least Def Con 17. One of the most notable tools is sslstrip, created by Marlinspike. TLS also requires a Certificate Authority trust model, which gives ...


54

SSL/TLS protects the email from tampering or eavesdropping as it transits between your computer and Google's server, and possibly during further relays to eventual recipient. And that's all it does. PGP does far more. If you're sending a signed email, the recipient can verify that the email was sent by you, and that it was not tampered with at any point ...


12

non-repudiation -- no one can forge your private key signature of a message, encryption at rest -- the message is encrypted not just in transit, but at rest as well. all of the benefits of mail over SSL/TLS sans a lot of the problems (e.g. Heart Bleed and POODLE) Just to name three.


0

Due to the same-origin policy, JavaScript running on a remote site cannot use an XHR to access content running on another domain. Cross-Origin Resource Sharing (CORS) is one solution to this problem. The server running on localhost, can define a CORS header which permits JavaScript running on a specific domain access to the server.


0

You're right: missing TLS is a far greater problem than just modifying the login form's action. Have a look at the full paragraph from the link you provided: The login page and all subsequent authenticated pages must be exclusively accessed over TLS. The initial login page, referred to as the "login landing page", must be served over TLS. Failure to ...


0

It depends on your Java implementation, but none of them are known to be vulnerable at this time. POODLE over TLS requires that the server has a defective TLS parser that fails to reject certain types of invalid TLS padding. Currently, only hardware SSL endpoints from A10 Networks and F5 Networks are known to be vulnerable (well, and servers using the NSS ...


1

The blog you linked says to use the SSL Labs test for verifying and, if vulnerable, apply the patch supplied by your vendor. If the company wrote their own web server, they are the vendor and will have to write their own patch.


1

But, if all my cert expired before 2016, so I assume no action need to be taken to prevent the warning, right? Correct. Chrome (your link), Firefox (https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/) and Windows (http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx) ...


1

It sounds to me like you need to configure the Tomcat service to request a client side certificate for authentication. I'm wise in the ways of IIS, but unfortunately Tomcat is not my forte. DO NOT give the admin of Tomcat your CSR. I recommend referencing Configure SSL Mutual (Two-way) Authentication Ideally you would use your internal CA to sign a ...


1

Pure speculation without more info, but it could well be a case of HTTP proxying. HTTPS proxying is not feasible without a complex set up, which would be why you see a different IP over HTTPS (your IP) than over HTTP (the proxy's IP). While this indeed can be used to "spy" on your HTTP traffic, it could also be a caching service, used to reduce unnecessary ...


1

Can't be done. Not without you buying a Sub-CA certificate. (Which no self-respecting CA will/should sell to just anybody.) While there are ways around this, none of them are practical. (And that's a good thing.): 1) You don't care about detection. You just man-in-the-middle everyone, give them an untrusted certificate and hope they will click through the ...


0

I had the same issue while renewing the certificate for our server at www.tpsynergy.com . After importing the new server certificate and restarting the tomcat, the error we were getting was ERR_SSL_VERSION_OR_CIPHER_MISMATCH. After lot of research, I used this link https://www.sslshopper.com/certificate-key-matcher.html to compare the csr (certificate ...


0

No answer The answer to your question is dependent on which cloud storage provider you are talking about, there is no official "cloud storage security layer" shared across all providers. The best way to secure cloud data is still an open ended question, so the different attempts at it are myriad.


1

I have the following in my nginx /etc/nginx/perfect-forward-secrecy.conf, which gives me an A grade on SSL labs. Your certificate should be SHA256 though. ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 ...



Top 50 recent answers are included