Linked Questions

2
votes
1answer
3k views

Replaying SSL traffic in an active connection [duplicate]

Possible Duplicate: Are SSL encrypted requests vulnerable to Replay Attacks? I have an SSL connection with my bank open from A to B A -> B Through that connection I transfer $100 to my ...
14
votes
10answers
9k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
20
votes
8answers
19k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
22
votes
3answers
6k views

Security vulnerabilities of POST over SSL

I work for a small company, developing an ASP.NET web-application. Recently, we've had the requirement of exposing an API endpoint come up, such that an automated script running in the cloud can ...
7
votes
5answers
9k views

Hiding sensitive data in URIs

This is a potentially hypothetical question since it has not been determined whether we will be required to do this but I figure it's a question that will come up more often. Background When ...
5
votes
2answers
12k views

nonce in SSL/TLS handshake

In SSL/TLS handshake, a nonce is always sent by the client to server and vice versa. The nonce basically consists of a random number and unix timestamp. Why do we need the unix timestamp? As the ...
1
vote
1answer
5k views

How does Replay attack works on SSL/TLS authentication?

In security+ 401 cert guide there is a line about replay attack as follows, In a replay attack a hacker might use a packet sniffer to intercept data and retransmit it later. In this way the ...
5
votes
2answers
2k views

How to securely communicate with radio controlled device?

Let's say I have a drone that is controlled through radio and I would like to make sure that nobody else can control and gain data from it except for me. I could encrypt the data with a cipher and ...
-2
votes
1answer
1k views

is encrypted body http secure

I'm working on an embedded project that needs to communicate with a server. Both the server and the device have an AES key pre-installed. I have a network device that provides http services but not ...
1
vote
1answer
702 views

Designing a password auth/reg system

I'm designing a user reg/auth system for a website and came up with this design for password based authentication. I'd like to know if this is reasonable. (ignoring cookies for caching credentials, ...
0
votes
2answers
176 views

Is this anti-forgery scheme secure?

To prevent cross-site request forgery attacks, I'm considering the following scheme: For each user, store a random key. If the user submits any "dangerous" information, include a security token and a ...
1
vote
2answers
216 views

Why does WebAuthn require a challenge when asking the client to register a new credential?

When registering a new credential as part of WebAuthn, why does the client need to be sent a challenge? Presumably this is to prevent a replay attack, but wouldn't a replay attack be prevented by TLS ...
0
votes
2answers
123 views

Resend encrypted REST GET request to eavesdrop data

Bob makes a HTTPS GET request to view his personal info on a dating site via a RESTFul web service. He supplies his api key,secret,timestamp and signature to prove that the request came from him. All ...
1
vote
0answers
72 views

Fake registration server with TLS pcap log and MITM device possible?

I have bought a few expensive apps in my mac with registration/serials. Problem is that as soon as I connect my SSD to another mac it wants the registration number again. No problem so far as the ...