Linked Questions

9
votes
4answers
7k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
28
votes
3answers
7k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
3
votes
3answers
3k views

Restrict Microsoft Network Policy Server (NPS) to only trust client certificates from a given CA?

I'm working on an install of a Microsoft Network Policy Sever (NPS) / RADIUS server for controlling access to corporate Wi-Fi using 802.1x / WPA2-Enterprise - using client certificates for ...
112
votes
18answers
19k views

Does an established HTTPS connection mean a line is really secure?

From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
4
votes
2answers
93 views

Is pinning global root CA almost same as not having any certificate pinning at all?

I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all? ...
30
votes
9answers
11k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...
250
votes
7answers
45k views

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
5
votes
3answers
1k views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
5
votes
3answers
387 views

Why are root certificate authorites allowed to issue certificates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
3
votes
2answers
154 views

Is it possible to use an open collection of default SSL certificates for my browser?

Browsers and Operating Systems come with a set of default SSL certificates for well known organizations, such as root certificates from CAs. I understand that the trust model is as follows: I pick (...
14
votes
1answer
3k views

Is it safe to let apt-get applications install root certificates?

I've recently installed Pinta, a program for drawing and image editing, and as part of the installation it installed 173 root certificates (see below). Is it normal practice to do so? Why does it ...
25
votes
4answers
23k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
6
votes
1answer
152 views

Are there “master keys” that can be used to generate valid SSL keys?

I was in a discussion about SSL, and I was explaining that it's impossible to decrypt data sent over SSL if you don't have the key. Someone responded with the following, that really confused me: ...
3
votes
2answers
175 views

Can BlackBerry keep us safe from network providers

I recently brought a BlackBerry mobile and the reason I have gone with BB was the security it ensures and now I have a doubt. That said in the Internet, Massage from BBM will first reach Canada via ...
8
votes
5answers
23k views

Are services like Hide My Ass and UnoDNS reasonably safe to use?

While in Germany, I want to keep using my Netflix account, watch PBS, CNBC. I have found following services: A VPN: https://hidemyass.com/vpn/promo/1/5/ A DNS: http://www.unotelly.com/unodns/ I an ...

15 30 50 per page