Linked Questions

419 votes
14 answers

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
Joshua Carmody's user avatar
309 votes
3 answers

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
Kyle Rosendo's user avatar
  • 4,025
248 votes
4 answers

SSL3 "POODLE" Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What is the ...
tylerl's user avatar
  • 83.5k
134 votes
4 answers

Is it safe to include an API key in a request's URL?

Lately I've seen plenty of APIs designed like this: curl "" Isn't it elementary that passing an API key in a query string as a part of ...
Incerteza's user avatar
  • 2,247
117 votes
18 answers

Does an established HTTPS connection mean a line is really secure?

From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
Peter Smit's user avatar
  • 2,759
110 votes
6 answers

Why can't I MitM a Diffie-Hellman key exchange?

After reading the selected answer of "Diffie-Hellman Key Exchange" in plain English 5 times I can't, for the life of me, understand how it protects me from a MitM attack. Given the ...
orokusaki's user avatar
  • 1,362
101 votes
5 answers

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
Lernkurve's user avatar
  • 1,144
94 votes
4 answers

SSL Certificate framework 101: How does the browser verify the validity of a given server certificate?

(I have a basic understanding of public/private key, hashing, digital signatures... I have been searching online & stack forums last couple days but cannot seem to find a satisfactory answer.) ...
SecurityNoob's user avatar
  • 1,051
76 votes
3 answers

symmetric encryption session keys in SSL/TLS

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
lurscher's user avatar
  • 1,230
43 votes
2 answers

What is the difference between a certificate and a private key?

What is the difference between a certificate and a private key? In answering another question on this site, I wanted to point to a canonical answer to this question, but to my surprise I don't see ...
Mike Ounsworth's user avatar
41 votes
5 answers

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
user53029's user avatar
  • 2,737
40 votes
9 answers

How does SSL/TLS PKI work?

We have lots of questions that address portions of SSL/TLS as it relates to PKI, but none of them seem to bring everything together. A canonical answer that we can point people to I think would be ...
RoraΖ's user avatar
  • 12.5k
36 votes
3 answers

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site If this site is https and I write will the URL be sent in clear text since it's the first time I connect ...
user104545's user avatar
34 votes
4 answers

Why does the SSL/TLS handshake have a client and server random?

In the SSL handshake both the client and server generate their respective random numbers. The client then generates a pre master secret and encrypts it with the server's public key. However, why can't ...
George Robinson's user avatar
29 votes
7 answers

How can I be sure that I am using the real Facebook?

I type into my browser's address bar and press enter, then use Facebook. Could I actually be visiting a fake Facebook even if I see a URL of and a lock icon ...
again's user avatar
  • 964

15 30 50 per page
2 3 4 5