Linked Questions

1 vote
2 answers

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
mag725's user avatar
  • 113
2 votes
1 answer

Whats the difference between certificate pinning and a truststore in Android/iOS? [duplicate]

I‘m facing the implementation of certificate pinning and often get asked why if there are trust stores within Android, iOS does not have such a concept. So I’m required to build the standard HPKP and ...
BennX's user avatar
  • 123
1 vote
0 answers

Mobile internet not working via zap proxy [duplicate]

I have to test the native android application on device, so I Installed the zap certificated on my device and set the proxy in my device to my system ip where zap is installed and port to 8085. In ...
Rick's user avatar
  • 121
117 votes
18 answers

Does an established HTTPS connection mean a line is really secure?

From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
Peter Smit's user avatar
  • 2,759
101 votes
5 answers

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
Lernkurve's user avatar
  • 1,144
50 votes
7 answers

How would you detect an Evil Twin attack, especially in a new environment?

Let's say you are traveling, and you pause in the airport lounge, or your hotel lobby, or a nearby coffee shop. You haul out your laptop and scan the available wireless networks. You know the name of ...
J Kimball's user avatar
  • 2,127
36 votes
7 answers

Could governments and banks become CAs?

When you apply for a passport, driver's license, home mortgage, bank account, credit card, etc., the issuing organization must verify your identity. In the course of doing so, would it be feasible for ...
shadowtalker's user avatar
57 votes
4 answers

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
Rory McCune's user avatar
28 votes
5 answers

How does having a custom root certificate installed from school or work cause one to be monitored?

I was reading an article which said that if you install custom root cert from a third party then they can decipher all communication between you and others. But that doesn't make sense. What I ...
Muhammad Umer's user avatar
22 votes
7 answers

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a http-...
Pervy Sage's user avatar
19 votes
2 answers

Are VPNS vulnerable to active man in the middle attacks?

I know that with SSL/TLS, man in the middle attacks are not possible. For example if Alice and Bob are trying to communicate and Trudy is trying to perform a man in the middle attack, then when Alice ...
Steven K's user avatar
  • 295
12 votes
4 answers

Does a TLS interception proxy present the user's browser with the end server's certificate?

I know that TLS (commonly but mistakenly called SSL) interception works by establishing two encrypted tunnels between a client and server, with the interception device (proxy) terminating both tunnels ...
sentinel's user avatar
  • 121
10 votes
7 answers

Cheating or service disruption by altering client-side code

A reasonably white-hatted hacker has demonstrated the ability to insert text of his own choosing into the communication between a java applet and a web based server. Not a simple MITM attack, but ...
ddyer's user avatar
  • 2,006
7 votes
3 answers

What if someone steals a Certificate authority's private key? [duplicate]

What if someone could steal a Certificate authority's private key? I know this will (probably) never happen, but what would happen to the certificates that were already signed with this private key? ...
Sam Hendrickx's user avatar
9 votes
3 answers

Does checking the fingerprint of a self signed certificate improve security?

I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
WMEZ's user avatar
  • 341

15 30 50 per page