Linked Questions

112
votes
18answers
19k views

Does an established HTTPS connection mean a line is really secure?

From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
30
votes
9answers
11k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...
250
votes
7answers
45k views

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
11
votes
6answers
5k views

when is it safe to click through an SSL warning message?

How does a user know if it's safe to click through scary browser warnings about SSL certificates? Ideally, a user should never need to click through these warning messages, but sometimes honest ...
9
votes
5answers
1k views

Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?

In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
8
votes
5answers
23k views

Are services like Hide My Ass and UnoDNS reasonably safe to use?

While in Germany, I want to keep using my Netflix account, watch PBS, CNBC. I have found following services: A VPN: https://hidemyass.com/vpn/promo/1/5/ A DNS: http://www.unotelly.com/unodns/ I an ...
173
votes
4answers
22k views

Is there anything preventing the NSA from becoming a root CA?

There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference. While there have been attempts ...
58
votes
4answers
5k views

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
45
votes
4answers
3k views

What cryptographic flaw was exploited by Flame, to get its code signed by Microsoft?

Today, Microsoft released a security advisory warning that the "Flame" malware exploited a weakness in a cryptographic algorithm used by Microsoft Terminal Server Licensing Service, and was thereby ...
26
votes
4answers
20k views

What Trusted Root Certification Authorities should I trust? [duplicate]

After two recent Slashdot articles (#1 #2) about questionable Root Certificates installed on machines, I decided to take a closer look at what I have installed on my machines. (I use current versions ...
25
votes
4answers
23k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
9
votes
4answers
7k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
7
votes
4answers
742 views

What fields in a suspicious certificate should I look at?

Looking at a certificate for a web-site (in Windows/Google Chrome) I see it lists the following fields Version Serial number Signature algorithm Issuer Valid from Valid to Subject Public Key Basic ...

15 30 50 per page
1
2