Linked Questions

36 votes
3 answers
12k views

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site example.com. If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
user104545's user avatar
28 votes
1 answer
30k views

In SSL server handshake, does server also send CA certificate [duplicate]

In the TCP SSL sever handshake, does the server also send CA certificates? Does the server need to send all intermediate CA certificates in the Server Hello?
Rahul_cs12's user avatar
20 votes
5 answers
6k views

Can a phishing website use the original (HTTPS, TLS) certificate? [duplicate]

If one has a phishing website that uses the original certificate that was obtained by accessing that website, can an attack fool users to believe they are accessing legitimate websites? If not, how ...
Kevin JJ's user avatar
  • 317
14 votes
2 answers
7k views

Why does SSL use both asymmetric cryptography and symmetric cryptography algorithms together? [duplicate]

SSL uses both asymmetric cryptography and symmetric cryptography. Why can't it, or why doesn't it, just use one of them?
Wika's user avatar
  • 165
17 votes
1 answer
23k views

What's the point of the pre-master key? [duplicate]

In SSL, the client generates a pre-master key from random data from itself and also the server. It then encrypts this with the server's public key, sends it to the server and then both client and ...
Michael Deardeuff's user avatar
6 votes
2 answers
3k views

In a browser web server communication, who decides which encryption protocol to use [duplicate]

My IE browser has SSLv3.0, TLS 1.0,1.1 and 1.2 enabled in the advanced settings. And (I was informed by my server admin) my web server can encrypt data in SSLv3.0 and TLS 1.0 Now which system (...
nJoshi's user avatar
  • 171
11 votes
3 answers
17k views

How does the SSL connection protocol work with self-signed certificate? [duplicate]

I'm using the self-signed certificate, but I don't know how this protocol works. I connect two apps with a socket SSL and it works fine. The server is a Python app and the client is an Android app. I ...
juve164's user avatar
  • 111
-1 votes
2 answers
43k views

SSL protocol : Port 443 [duplicate]

I want to use the SSL protocol. SSL protocol uses port 443. During the initial handshake does the communication occur on port 80 or does the handshake start on port 443? If not during the initial ...
ssk's user avatar
  • 79
3 votes
2 answers
19k views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
Vũ Đức Lộc's user avatar
5 votes
3 answers
7k views

How does the Certificate Authority work [duplicate]

I'm learning how the Certificate Authority work and have a question. As my understanding, the Certificate Authority can guarantee that the client get the true public-key: Saying that I'm a server and ...
Yves's user avatar
  • 361
3 votes
3 answers
3k views

Does HTTPS allow replay attack on authentication request? [duplicate]

If I sent a username and the password to a website over HTTPS, is it possible that someone on the net would save this request and re-send it later to authenticate on the website?
Tony's user avatar
  • 141
4 votes
1 answer
9k views

Why is it not possible to fake a digital certificate? [duplicate]

When a client accesses an HTTPS webpage, (please correct me if I'm wrong), it just checks whether the certificate of that website has been signed by a trusted CA or not, but does not ask directly the ...
Franzech Domâs's user avatar
8 votes
2 answers
904 views

Question About HTTPS Security [duplicate]

I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong. I got to know that as part of ...
shazin's user avatar
  • 189
2 votes
2 answers
8k views

How is man-in-the-middle attack prevented in TLS? [duplicate]

As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-...
Hemanth's user avatar
  • 121
6 votes
2 answers
3k views

Why are SSL handshakes secure and why can't a hacker look at that and decrypt the data? [duplicate]

If I understand right, there is a "handshake" where both the server and the browser verify who they are and agree on an encryption key. Why cannot a hacker just watch the network for the keys going ...
Anonymous Penguin's user avatar
4 votes
3 answers
743 views

How to fix SSL algorithm for more security [duplicate]

SSL uses Asymmetric Encryption like this : Server sends a copy of its asymmetric public key. Browser creates a symmetric session key and encrypts it with the server’s asymmetric public key. Server ...
Elahe's user avatar
  • 191
-3 votes
2 answers
4k views

How is it that SSL/TLS is so secure against password stealing? [duplicate]

I know that it is very easy to steal a username and password from someone who is signing in to some website over HTTP, but we protect against that with just SSL/TLS. ​ How's that possible? I mean, ...
ShinobiUltra's user avatar
-2 votes
1 answer
2k views

HTTP POST Request Encryption [duplicate]

I have a client and a server that exchange information with each other and i want to encrypt the contents of the POST request? What kinds of encryption are supported by the HTTP Post request? Thanks
Yousif Shibeika's user avatar
0 votes
1 answer
2k views

How do SSL/TLS certificates work? [duplicate]

I'm trying to understand how SSL/TLS certificates work, but I'm missing something. I have obtained my current understanding from this website: http://www.moserware.com/2009/06/first-few-milliseconds-...
Java Addict's user avatar
2 votes
4 answers
399 views

How could online encryption ever work? [duplicate]

I have recently read about the german enigma machine in WW2, It worked in a way that every day the machine configuration was sent per mail to the different operators. (I couldn't find official sources ...
downrep_nation's user avatar
1 vote
1 answer
4k views

Can't I forge an SSL certificate? [duplicate]

I read What's keeping a malicious man in the middle server from forging a valid certificate?, but when the client goes to verify the certificate, can't an attacker intercept that connection and say ...
Java Is Cool's user avatar
0 votes
1 answer
3k views

How does ssl prevent MITM attacks [duplicate]

My understanding of how it works : A victim asks for the public key of a server. The attacker just forwards this request. The server now responds with a certificate which contains the Public key. The ...
Zapnologica's user avatar
0 votes
2 answers
2k views

Is HTTPS based on a private key on the user side? [duplicate]

Is HTTPS it based on private key on user side? Where does the user get the private key in the first place? Suppose the user gets the private key by downloading a browser (Chrome, Firefox), then isn'...
guestguest's user avatar
2 votes
1 answer
761 views

Are Free SSL/TLS Certificates Trustworthy ? Can Cert Providers Snoop On Traffic? [duplicate]

I know nothing about encryption, SSL, TLS, certificates and have come across several companies offering free SSL/TLS certificates. How trustworthy are these offers? Why would I want to adopt this ...
lowtechsun's user avatar
0 votes
2 answers
3k views

What is the use of private key of a SSL certificate? [duplicate]

I have read a few wrong information about HTTP/SSL (I think) and those information was saying that the private key from a certificate is used for message decryption. I have followed a tutorial on ...
Adrian's user avatar
  • 103
1 vote
1 answer
2k views

Does client certificate do any encryption in https connection? [duplicate]

In Https connection asymmetric encryption (with Server certificate) is used during handshake and to create symmetric keys. Am I right that in this case client certificate does no encryption? The ...
Eugene To's user avatar
  • 111
1 vote
1 answer
1k views

HTTPS without SSL VS HTTP [duplicate]

I'm working on local server for Linux repositories. We have been using HTTPS without SSL Verification for establishing connection between the Server and the Agents. Are there really any differences ...
Subramanian Sridharan's user avatar
4 votes
1 answer
938 views

Why can't a self-made SSL certificate have a fake signature? [duplicate]

Let me explain what I mean. I've read Why is faking SSL certificate difficult, and my question is sort of a step beyond that. If some random person creates a certificate, what's stopping them from ...
Celeritas's user avatar
  • 10.2k
3 votes
2 answers
304 views

How can a connection be secure, if somebody observes it from the beginning? [duplicate]

If somebody observes a connention between client, and the server, then he can see the keys, by the following data encrypted is. As far as I know, if I connect to a server, then it sends me some keys, ...
Iter Ator's user avatar
  • 193
0 votes
2 answers
301 views

Understanding SSL certificates [duplicate]

How does an SSL certificate prove the emitter is who he pretends to be ? If Bob (holding a certificate) and Alice wanted to establish a SSL-secured connection, wouldn't John be able to get the ...
Cookiewill's user avatar
1 vote
1 answer
2k views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
Northern Pole's user avatar
0 votes
2 answers
2k views

Find out Browser's AES generated key on SSL/TLS [duplicate]

When it comes to TLS handshakes. first of all I'm wondering how the AES keys which are responsible for encrypting data is generated? is it generated randomly on the browser and it's securely sent to ...
Michael wanna know's user avatar
0 votes
1 answer
1k views

What is the role of leaf certificate private key In TLS handshake [duplicate]

What is the role of leaf certificate's private key if this certificate is signed by the intermediate certificate's private key and the certificate signature will only be validated using its public ...
Mo Haidar's user avatar
  • 449
-7 votes
2 answers
399 views

Why does everyone assume 'https' is secure? [duplicate]

Why are they certificate authorities? What do they do that ensures the information is 'secure'? I know that they verify if a 'certificate' is from a 'trusted' source but who decides which sources are '...
SpellsOfTruth's user avatar
0 votes
3 answers
1k views

What about SSL makes it resistant to man-in-the-middle attacks? [duplicate]

Here's how I understand what SSL certificates actually do, in 4-year-old-child terms. There need to be three parties involved. Two parties are just my client, and the server I'm communicating with, ...
Digital Ninja's user avatar
0 votes
1 answer
955 views

Is there any way to encrypt form data header values which can be seen in network resources? [duplicate]

I'm able to see my credentials here in this picture which is fb's form data I don't know if that is supposed to be like that or a problem of browser But for my website, I don't want this in ruby on ...
Bhargav Reddy's user avatar
1 vote
0 answers
1k views

Usage of Diffie Hellman key exchange in TLS [duplicate]

As far as I know, this is the process of establishing a TLS connection between a client and a web server: Client sends a TLS request (using a packet called Client Hello) to the server. Server answers ...
Ebrahim Ghasemi's user avatar
0 votes
1 answer
764 views

How does TLS verify a certificate belongs to a domain? [duplicate]

Say I own a domain called Bob.com, and I've sent an API request to Google.com. But instead of supplying a certificate for Bob.com, I send a certificate for Alice.com (which I got from a previous API ...
user2521119's user avatar
1 vote
2 answers
558 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
JThree's user avatar
  • 131
0 votes
1 answer
490 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...
Mohammad Jolani's user avatar
-2 votes
1 answer
785 views

Authentication process between the server and the browser [duplicate]

How the browser ensures that it is communicating to the right server?
Saksham Gupta's user avatar
1 vote
2 answers
688 views

ssl_error_bad_certificate_domain, does Firefox still validate the certificate? [duplicate]

I have a private NAS device. It uses a self-signed SSL certificate. I can import the cert into Firefox and everything works as long as I'm accessing the device from somewhere on the internet. SSL ...
PhilippVerpoort's user avatar
0 votes
1 answer
629 views

Possibility of Man in the Middle attack in SSL Protocol during initial Handshake [duplicate]

This is my understanding of Digital Certificate Signing mechanism so far. Correct me if I am wrong. www.abc.com(SSL enabled) is typed in the browser for the first time The server of abc.com sends it'...
Sathyamoorthy R's user avatar
1 vote
1 answer
367 views

How does TLS protect against a MITM cipher suite downgrade? [duplicate]

The initial TLS handshake agrees on a cipher suite to use, but what stops an attacker from MITM-ing the initial handshake and downgrading the cipher suites?
user avatar
1 vote
0 answers
577 views

SSL/TLS handshake potential vulnerabilities [duplicate]

After handshake one could be assure that data are encrypted and secure. But before that, handshake parameters are transferred via not secured channel. One could be MitM during the handshake procedure....
Maxim Korobov's user avatar
1 vote
3 answers
429 views

Where do my keys come from for requests over SSL? [duplicate]

From what I understand, when you send information to a website over SSL, you encrypt the information you send with their public key. However, if you want to be able to decrypt the information they ...
IQAndreas's user avatar
  • 6,845
0 votes
2 answers
428 views

SSL can stop MiTMs ... but on the long run, can it really? [duplicate]

SSL uses CAs which sign certificates for the domains after they validate that the person requesting is truly the owner and by a public/private key pair a encrypted connection is achieved which cant be ...
user36976's user avatar
  • 3,243
-2 votes
2 answers
257 views

How does SSL work? Simpler Explanation? [duplicate]

I'd like to explain my understanding first then ask a question. This question is meant as a simpler overview of other question..and talks about implication and not process as much. My understanding ...
Muhammad Umer's user avatar
-5 votes
2 answers
617 views

How the process of SSL handshake works? [duplicate]

I have been trying to understand the working of SSL. I know that any https website has a digital certificate with it. So when the client requests something from the server, the server sends with ...
Naser Hassan's user avatar
1 vote
1 answer
280 views

what prevents replay of an mTLS client cert [duplicate]

during playing with nginx "ssl_verify_client optional_no_ca" i made the discovery that it does not very the cert signature of a self signed cert. I think this is the intended behaviour, ...
aep's user avatar
  • 173

15 30 50 per page
1
2 3 4 5
7