Linked Questions

36 votes
3 answers
12k views

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site example.com. If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
user104545's user avatar
28 votes
1 answer
30k views

In SSL server handshake, does server also send CA certificate [duplicate]

In the TCP SSL sever handshake, does the server also send CA certificates? Does the server need to send all intermediate CA certificates in the Server Hello?
Rahul_cs12's user avatar
20 votes
5 answers
6k views

Can a phishing website use the original (HTTPS, TLS) certificate? [duplicate]

If one has a phishing website that uses the original certificate that was obtained by accessing that website, can an attack fool users to believe they are accessing legitimate websites? If not, how ...
Kevin JJ's user avatar
  • 317
14 votes
2 answers
7k views

Why does SSL use both asymmetric cryptography and symmetric cryptography algorithms together? [duplicate]

SSL uses both asymmetric cryptography and symmetric cryptography. Why can't it, or why doesn't it, just use one of them?
Wika's user avatar
  • 165
17 votes
1 answer
23k views

What's the point of the pre-master key? [duplicate]

In SSL, the client generates a pre-master key from random data from itself and also the server. It then encrypts this with the server's public key, sends it to the server and then both client and ...
Michael Deardeuff's user avatar
6 votes
2 answers
3k views

In a browser web server communication, who decides which encryption protocol to use [duplicate]

My IE browser has SSLv3.0, TLS 1.0,1.1 and 1.2 enabled in the advanced settings. And (I was informed by my server admin) my web server can encrypt data in SSLv3.0 and TLS 1.0 Now which system (...
nJoshi's user avatar
  • 171
11 votes
3 answers
17k views

How does the SSL connection protocol work with self-signed certificate? [duplicate]

I'm using the self-signed certificate, but I don't know how this protocol works. I connect two apps with a socket SSL and it works fine. The server is a Python app and the client is an Android app. I ...
juve164's user avatar
  • 111
-1 votes
2 answers
43k views

SSL protocol : Port 443 [duplicate]

I want to use the SSL protocol. SSL protocol uses port 443. During the initial handshake does the communication occur on port 80 or does the handshake start on port 443? If not during the initial ...
ssk's user avatar
  • 79
3 votes
2 answers
19k views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
Vũ Đức Lộc's user avatar
5 votes
3 answers
7k views

How does the Certificate Authority work [duplicate]

I'm learning how the Certificate Authority work and have a question. As my understanding, the Certificate Authority can guarantee that the client get the true public-key: Saying that I'm a server and ...
Yves's user avatar
  • 361
3 votes
3 answers
3k views

Does HTTPS allow replay attack on authentication request? [duplicate]

If I sent a username and the password to a website over HTTPS, is it possible that someone on the net would save this request and re-send it later to authenticate on the website?
Tony's user avatar
  • 141
4 votes
1 answer
9k views

Why is it not possible to fake a digital certificate? [duplicate]

When a client accesses an HTTPS webpage, (please correct me if I'm wrong), it just checks whether the certificate of that website has been signed by a trusted CA or not, but does not ask directly the ...
Franzech Domâs's user avatar
8 votes
2 answers
904 views

Question About HTTPS Security [duplicate]

I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong. I got to know that as part of ...
shazin's user avatar
  • 189
2 votes
2 answers
8k views

How is man-in-the-middle attack prevented in TLS? [duplicate]

As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-...
Hemanth's user avatar
  • 121
6 votes
2 answers
3k views

Why are SSL handshakes secure and why can't a hacker look at that and decrypt the data? [duplicate]

If I understand right, there is a "handshake" where both the server and the browser verify who they are and agree on an encryption key. Why cannot a hacker just watch the network for the keys going ...
Anonymous Penguin's user avatar
4 votes
3 answers
743 views

How to fix SSL algorithm for more security [duplicate]

SSL uses Asymmetric Encryption like this : Server sends a copy of its asymmetric public key. Browser creates a symmetric session key and encrypts it with the server’s asymmetric public key. Server ...
Elahe's user avatar
  • 191
-3 votes
2 answers
4k views

How is it that SSL/TLS is so secure against password stealing? [duplicate]

I know that it is very easy to steal a username and password from someone who is signing in to some website over HTTP, but we protect against that with just SSL/TLS. ​ How's that possible? I mean, ...
ShinobiUltra's user avatar
-2 votes
1 answer
2k views

HTTP POST Request Encryption [duplicate]

I have a client and a server that exchange information with each other and i want to encrypt the contents of the POST request? What kinds of encryption are supported by the HTTP Post request? Thanks
Yousif Shibeika's user avatar
0 votes
1 answer
2k views

How do SSL/TLS certificates work? [duplicate]

I'm trying to understand how SSL/TLS certificates work, but I'm missing something. I have obtained my current understanding from this website: http://www.moserware.com/2009/06/first-few-milliseconds-...
Java Addict's user avatar
2 votes
4 answers
399 views

How could online encryption ever work? [duplicate]

I have recently read about the german enigma machine in WW2, It worked in a way that every day the machine configuration was sent per mail to the different operators. (I couldn't find official sources ...
downrep_nation's user avatar
1 vote
1 answer
4k views

Can't I forge an SSL certificate? [duplicate]

I read What's keeping a malicious man in the middle server from forging a valid certificate?, but when the client goes to verify the certificate, can't an attacker intercept that connection and say ...
Java Is Cool's user avatar
0 votes
1 answer
3k views

How does ssl prevent MITM attacks [duplicate]

My understanding of how it works : A victim asks for the public key of a server. The attacker just forwards this request. The server now responds with a certificate which contains the Public key. The ...
Zapnologica's user avatar
0 votes
2 answers
2k views

Is HTTPS based on a private key on the user side? [duplicate]

Is HTTPS it based on private key on user side? Where does the user get the private key in the first place? Suppose the user gets the private key by downloading a browser (Chrome, Firefox), then isn'...
guestguest's user avatar
2 votes
1 answer
761 views

Are Free SSL/TLS Certificates Trustworthy ? Can Cert Providers Snoop On Traffic? [duplicate]

I know nothing about encryption, SSL, TLS, certificates and have come across several companies offering free SSL/TLS certificates. How trustworthy are these offers? Why would I want to adopt this ...
lowtechsun's user avatar
0 votes
2 answers
3k views

What is the use of private key of a SSL certificate? [duplicate]

I have read a few wrong information about HTTP/SSL (I think) and those information was saying that the private key from a certificate is used for message decryption. I have followed a tutorial on ...
Adrian's user avatar
  • 103
1 vote
1 answer
2k views

Does client certificate do any encryption in https connection? [duplicate]

In Https connection asymmetric encryption (with Server certificate) is used during handshake and to create symmetric keys. Am I right that in this case client certificate does no encryption? The ...
Eugene To's user avatar
  • 111
1 vote
1 answer
1k views

HTTPS without SSL VS HTTP [duplicate]

I'm working on local server for Linux repositories. We have been using HTTPS without SSL Verification for establishing connection between the Server and the Agents. Are there really any differences ...
Subramanian Sridharan's user avatar
4 votes
1 answer
938 views

Why can't a self-made SSL certificate have a fake signature? [duplicate]

Let me explain what I mean. I've read Why is faking SSL certificate difficult, and my question is sort of a step beyond that. If some random person creates a certificate, what's stopping them from ...
Celeritas's user avatar
  • 10.2k
3 votes
2 answers
304 views

How can a connection be secure, if somebody observes it from the beginning? [duplicate]

If somebody observes a connention between client, and the server, then he can see the keys, by the following data encrypted is. As far as I know, if I connect to a server, then it sends me some keys, ...
Iter Ator's user avatar
  • 193
0 votes
2 answers
301 views

Understanding SSL certificates [duplicate]

How does an SSL certificate prove the emitter is who he pretends to be ? If Bob (holding a certificate) and Alice wanted to establish a SSL-secured connection, wouldn't John be able to get the ...
Cookiewill's user avatar

15 30 50 per page
1
2 3 4 5
11