Linked Questions

0 votes
0 answers
32 views

What is the security impact of disabling certificate check [duplicate]

I have this line of code in a client server project: sslContext.init(null, new TrustManager[]{new TrustAnyManager()}, null); A security guy pointed out that this is skipping the validation of the ...
anonymous's user avatar
1 vote
2 answers
52 views

Preventing Data Tampering in HTTPS Requests: Safeguarding User-Initiated Donations

Could a Man-in-the-Middle (MITM) attack compromise the integrity of user-initiated transactions over HTTPS? Specifically, if a user selects an amount to donate on a website, is it possible for a ...
user23570085's user avatar
4 votes
2 answers
625 views

securely tunneling through a MITM proxy

I am wondering if there is a practical way to establish a secure, encrypted network connection through an MITM proxy given the ability to communicate secrets out-of-band with a second, external proxy. ...
Aryeh Leib Taurog's user avatar
0 votes
1 answer
111 views

Detect invalid cert Android client if URL being redirected to a fake server [duplicate]

Here is the scenario: Server A is an authentic server (A.com). Server F is a fake server (F.com) that also has a valid cert for F.com has a copy of A.com certificate to it (to fake as A.com). Client ...
Tung D. Nguyen's user avatar
0 votes
2 answers
428 views

Most secure way to pass data from client to server?

I'm writing an authentication system and would like some suggestions on improving its security. Currently, I use RSA to communicate data between the client and the server. Here's the process: The ...
Daniel Rayburn's user avatar
0 votes
1 answer
430 views

How do TLS clients validate intermediate CA certificates?

I have read many posts related to the intermediate CA certificates and I do hope my question is not a duplication. Where do TLS clients fetch intermediate CA certificates from? In SSL server handshake,...
Michael's user avatar
  • 1,469
0 votes
1 answer
106 views

Man in the middle attack on response from server [duplicate]

Let's assume that I am logging into my Gmail account from my browser using my username and password. I know that my input will be encrypted using Google's private key and the only one who can decrypt ...
yusuf tezel's user avatar
0 votes
0 answers
21 views

How does client data encryption work in HTTPS? [duplicate]

When you connect to a HTTPS server the server encrypts its data using the private key of its private certificate. The client decrypts it using the server's public key of the server's public ...
zomega's user avatar
  • 145
0 votes
2 answers
880 views

Are my Facebook messages or Instagram DMs visible (aside from FB and IG) while using a local wifi?

If I am in a place (not at home) such as an educational or work environment and use their WiFi and send or receive Facebook messages or Instagram DMs, are my messages visible to the IT admins of that ...
user avatar
0 votes
0 answers
28 views

Which Keys TLS uses? [duplicate]

I know that in TLS 1.2 the client generates PMS (Pre Master Secret) which is used to get master_secret and Key_Block. Where Key_Block combined with clinet_random and server_random gives us: clientMAC, ...
dan's user avatar
  • 19
2 votes
2 answers
8k views

How is man-in-the-middle attack prevented in TLS? [duplicate]

As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-...
Hemanth's user avatar
  • 121
1 vote
1 answer
281 views

what prevents replay of an mTLS client cert [duplicate]

during playing with nginx "ssl_verify_client optional_no_ca" i made the discovery that it does not very the cert signature of a self signed cert. I think this is the intended behaviour, ...
aep's user avatar
  • 173
1 vote
2 answers
985 views

Possible attacks using public key in a certificate

this is purely an exploratory question. If this is not the right place to ask for it, please point me to the right one. TLS version: TLS 1.2 CIPHER SUITE : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (any ...
Abhilash Gopalakrishna's user avatar
0 votes
2 answers
474 views

How does a site use the wrong certificate?

I click a link with good content (this doesn't guarantee the site isn't compromised) and Firefox gives me this error: Websites prove their identity via certificates. Firefox does not trust this site ...
Ooker's user avatar
  • 1,591
0 votes
1 answer
1k views

Javascript injection bettercap2 over HTTPS

I use bettercap2 http proxy and arp spoof to inject one-line js alert into http pages. It works fine, however what about https? I couldn’t find any working method to inject it without the browser’s ...
Nodes Hariff's user avatar

15 30 50 per page
1
2 3 4 5
22