Linked Questions

9
votes
4answers
6k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
9
votes
5answers
1k views

Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?

In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
6
votes
2answers
3k views

With reference to using Gpg4win, which is better: OpenPGP or S/MIME?

Which is better -- OpenPGP or S/MIME for higher security?
5
votes
3answers
1k views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
7
votes
4answers
714 views

What fields in a suspicious certificate should I look at?

Looking at a certificate for a web-site (in Windows/Google Chrome) I see it lists the following fields Version Serial number Signature algorithm Issuer Valid from Valid to Subject Public Key Basic ...
4
votes
3answers
1k views

Paypal IPN, SSL and man-in-the-middle attacks

Okay, suppose I have been implementing paypal IPN, and my server will respond by verifying with "https://www.paypal.com/cgi-bin/webscr" and got the VERIFIED message back. First, if my server connects ...
6
votes
3answers
205 views

Guarding against rogue certificates

There has been a lot of news recently about certificates being falsely issued (due to the issuing authority having poor system security!). Apparently the targeted users were mostly Iranians, but it's ...
5
votes
3answers
370 views

Why are root certificate authorites allowed to issue certificates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
2
votes
2answers
3k views

Restrict Microsoft Network Policy Server (NPS) to only trust client certificates from a given CA?

I'm working on an install of a Microsoft Network Policy Sever (NPS) / RADIUS server for controlling access to corporate Wi-Fi using 802.1x / WPA2-Enterprise - using client certificates for ...
6
votes
1answer
123 views

Are there “master keys” that can be used to generate valid SSL keys?

I was in a discussion about SSL, and I was explaining that it's impossible to decrypt data sent over SSL if you don't have the key. Someone responded with the following, that really confused me: ...
3
votes
2answers
149 views

Is it possible to use an open collection of default SSL certificates for my browser?

Browsers and Operating Systems come with a set of default SSL certificates for well known organizations, such as root certificates from CAs. I understand that the trust model is as follows: I pick (...
3
votes
2answers
175 views

Can BlackBerry keep us safe from network providers

I recently brought a BlackBerry mobile and the reason I have gone with BB was the security it ensures and now I have a doubt. That said in the Internet, Massage from BBM will first reach Canada via ...

15 30 50 per page