Linked Questions

2 votes
4 answers
2k views

Does the SSL termination happen with the ISP or a mobile service provider? [duplicate]

Is it true that when I connect to a site over HTTPS , my mobile service provider or the ISP gets to snoop in the communication? Can they play MITM?
user917279's user avatar
4 votes
1 answer
6k views

TLS Authentication/OpenVPN/MITM Attacks on Public Wifi [duplicate]

My question is about how an SSL VPN connection such as OpenVPN is protected against MITM/Spoofing attacks on a public Wifi. For example, if somebody has a 'pineapple' or router setup as a honeypot ...
user843521's user avatar
6 votes
3 answers
6k views

Why isn't it possible for a third party to decrypt HTTPS traffic? [duplicate]

I really don't know much about HTTPS. But I always hear people saying that it is 100% safe and bullet proof. My question is: Is that true or even possible. I mean there are lots of tools that allow ...
Forivin's user avatar
  • 1,019
0 votes
1 answer
4k views

Is TLS secure when full eavesdropping on the network occurs? [duplicate]

Possible Duplicate: How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it? Alice connects to Bob's site via a TLS secured connection (for ...
Brett's user avatar
  • 111
-1 votes
2 answers
707 views

How does TLS stop an ISP from spying on you [duplicate]

Here is what I understand about how clients trust the tcp channels they are connected to. Alice asks Bob for his certificate, signed by a CA's private key Bob sends the certificate, which includes ...
Seph's user avatar
  • 158
5 votes
0 answers
724 views

Why is it not possible for an ISP to man-in-the-middle attack an SSL connection? [duplicate]

If the ISP carries my data, why do people seem to think they cannot see the contents? Wouldn't they be holding the key?
Vaughan Hilts's user avatar
0 votes
1 answer
552 views

Why middleman cannot capture the encryption key of https/tor traffic? [duplicate]

When we use Tor or https traffic , the encryption- decryption key has to be exchanged between the browser and the website server. Why somebody who can capture entire traffic , say ISP or somebody who ...
gostela's user avatar
1 vote
2 answers
439 views

Reg HTTPS man in the middle [duplicate]

Possible Duplicate: How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it? A browser sends a request to gmail.com, gmail sends the cert ...
kalyan's user avatar
  • 447
1 vote
2 answers
276 views

How do certificates work in protecting against a man-in-the-middle attack? [duplicate]

As I understand it, if Alice and Bob wants to communicate securely, they must first agree on the protocols that will be used. Then they must confirm that they are indeed communicating with each other. ...
Dasherman's user avatar
  • 111
0 votes
0 answers
84 views

How can HTTPS be secure when used over open/cracked WiFi? [duplicate]

In the top answer to Consequences of the WPA2 KRACK attack it is recommended: Generally, use HTTPS for anything that needs to be secure (you should do this anyway, also over ethernet, but ...
Wildcard's user avatar
  • 158
0 votes
0 answers
39 views

How client and server exchanges keys over Tor network using HTTPS? [duplicate]

When someone uses a browser to connect to https://google.com via Tor network, the client needs to exchange a key with Google in order to keep all the data hidden from the exit node, right? Otherwise, ...
Incognitex's user avatar
0 votes
0 answers
38 views

How can it be possible to have encrypted communication between a server and a client if the server has only a public key [duplicate]

If only the server has an electronic certificate (User ID, Version, Public key), how can be possible the encrypted communication between the client and the server?
joana prifti's user avatar
0 votes
0 answers
24 views

MITM attack on public wi-fi and ISP wired connection [duplicate]

I know how MITM attacks work (theory/videos on the subject etc), but I am a bit confused and not sure what are the worst-case scenarios that can happen. If I'm using a public VPN and someone is indeed ...
kingJulian's user avatar
1288 votes
3 answers
688k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
Polynomial's user avatar
  • 135k
217 votes
7 answers
216k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
jojo's user avatar
  • 2,281
110 votes
6 answers
33k views

Why can't I MitM a Diffie-Hellman key exchange?

After reading the selected answer of "Diffie-Hellman Key Exchange" in plain English 5 times I can't, for the life of me, understand how it protects me from a MitM attack. Given the ...
orokusaki's user avatar
  • 1,362
65 votes
6 answers
101k views

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET: www.mycoolsite.com/index?id=1&type=...
TomJ's user avatar
  • 753
76 votes
3 answers
29k views

symmetric encryption session keys in SSL/TLS

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
lurscher's user avatar
  • 1,230
70 votes
5 answers
208k views

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm What exactly is the difference here and why are two encryption bits ...
JohnJ's user avatar
  • 867
32 votes
5 answers
8k views

SSH - If Eve has the passphrase and public key, can she derive the private key?

I have used ssh-keygen for creating an RSA 4096-bit SSH private and public key pair. I used a passphrase for the private key. If an attacker, Eve, knows the passphrase in addition to the public key: ...
unseen_rider's user avatar
22 votes
5 answers
47k views

How can I explain the concept of public and private keys without technical jargon? [duplicate]

Possible Duplicate: Principle of asymmetric algorithm in plain english In the spirit of How can I explain SQL injection without technical jargon?, do you have any suggestions on how to explain ...
NickAldwin's user avatar
28 votes
1 answer
25k views

My understanding of how HTTPS works (gmail for example)

I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting. I will use Gmail as an example: My laptop tries to connect to the Gmail server ...
Xianlin's user avatar
  • 409
12 votes
3 answers
7k views

Preventing a spoofing man in the middle attack?

I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
Griffin Nowak's user avatar
6 votes
2 answers
11k views

Is it possible to decrypt a SSL/TLS session without doing a MITM-attack?

I'm not talking about decrypting the connection while the SSL/TLS is happening (MITM) but after the connection is closed and I have a pcap file of the entire negotiation/data transfer process. How ...
YSY's user avatar
  • 2,259
4 votes
3 answers
3k views

Public key in SSL protocol

I have gone through many of the posts including My understanding of how HTTPS works (gmail for example). Everywhere it's mentioning that before creating a https connection, the browser verifies the ...
kevin's user avatar
  • 63
7 votes
2 answers
739 views

How are two systems able to set up a secure SSH tunnel over a public connection?

As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on ...
Hoytman's user avatar
  • 483
2 votes
2 answers
4k views

Can a wifi provider decrypt HTTPS usind MITM without users noticing? [duplicate]

As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid. So I could MITM all https traffic, and spy on my users?
Antonio's user avatar
  • 31
2 votes
3 answers
5k views

IPSec VPNs and symmetric keys

When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...
SwaroopGiwali's user avatar
4 votes
1 answer
2k views

What would be a simple example of an asymmetric encryption function (asymmetric function)?

I am trying to understand RSA encryption but the algorithm seems quite complex. I know that with asymmetric encryption you use a key and a function to encrypt data and a different function to decrypt ...
yoyo_fun's user avatar
  • 183
4 votes
1 answer
2k views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
Alexandru's user avatar
  • 175

15 30 50 per page