Linked Questions

2 votes
4 answers

Does the SSL termination happen with the ISP or a mobile service provider? [duplicate]

Is it true that when I connect to a site over HTTPS , my mobile service provider or the ISP gets to snoop in the communication? Can they play MITM?
user917279's user avatar
4 votes
1 answer

TLS Authentication/OpenVPN/MITM Attacks on Public Wifi [duplicate]

My question is about how an SSL VPN connection such as OpenVPN is protected against MITM/Spoofing attacks on a public Wifi. For example, if somebody has a 'pineapple' or router setup as a honeypot ...
user843521's user avatar
6 votes
3 answers

Why isn't it possible for a third party to decrypt HTTPS traffic? [duplicate]

I really don't know much about HTTPS. But I always hear people saying that it is 100% safe and bullet proof. My question is: Is that true or even possible. I mean there are lots of tools that allow ...
Forivin's user avatar
  • 1,019
0 votes
1 answer

Is TLS secure when full eavesdropping on the network occurs? [duplicate]

Possible Duplicate: How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it? Alice connects to Bob's site via a TLS secured connection (for ...
Brett's user avatar
  • 111
-1 votes
2 answers

How does TLS stop an ISP from spying on you [duplicate]

Here is what I understand about how clients trust the tcp channels they are connected to. Alice asks Bob for his certificate, signed by a CA's private key Bob sends the certificate, which includes ...
Seph's user avatar
  • 158
5 votes
0 answers

Why is it not possible for an ISP to man-in-the-middle attack an SSL connection? [duplicate]

If the ISP carries my data, why do people seem to think they cannot see the contents? Wouldn't they be holding the key?
Vaughan Hilts's user avatar
0 votes
1 answer

Why middleman cannot capture the encryption key of https/tor traffic? [duplicate]

When we use Tor or https traffic , the encryption- decryption key has to be exchanged between the browser and the website server. Why somebody who can capture entire traffic , say ISP or somebody who ...
gostela's user avatar
1 vote
2 answers

Reg HTTPS man in the middle [duplicate]

Possible Duplicate: How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it? A browser sends a request to, gmail sends the cert ...
kalyan's user avatar
  • 447
1 vote
2 answers

How do certificates work in protecting against a man-in-the-middle attack? [duplicate]

As I understand it, if Alice and Bob wants to communicate securely, they must first agree on the protocols that will be used. Then they must confirm that they are indeed communicating with each other. ...
Dasherman's user avatar
  • 111
0 votes
0 answers

How can HTTPS be secure when used over open/cracked WiFi? [duplicate]

In the top answer to Consequences of the WPA2 KRACK attack it is recommended: Generally, use HTTPS for anything that needs to be secure (you should do this anyway, also over ethernet, but ...
Wildcard's user avatar
  • 158
0 votes
0 answers

How client and server exchanges keys over Tor network using HTTPS? [duplicate]

When someone uses a browser to connect to via Tor network, the client needs to exchange a key with Google in order to keep all the data hidden from the exit node, right? Otherwise, ...
Incognitex's user avatar
0 votes
0 answers

How can it be possible to have encrypted communication between a server and a client if the server has only a public key [duplicate]

If only the server has an electronic certificate (User ID, Version, Public key), how can be possible the encrypted communication between the client and the server?
joana prifti's user avatar
0 votes
0 answers

MITM attack on public wi-fi and ISP wired connection [duplicate]

I know how MITM attacks work (theory/videos on the subject etc), but I am a bit confused and not sure what are the worst-case scenarios that can happen. If I'm using a public VPN and someone is indeed ...
kingJulian's user avatar
1289 votes
3 answers

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
Polynomial's user avatar
  • 135k
219 votes
7 answers

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
jojo's user avatar
  • 2,301
111 votes
6 answers

Why can't I MitM a Diffie-Hellman key exchange?

After reading the selected answer of "Diffie-Hellman Key Exchange" in plain English 5 times I can't, for the life of me, understand how it protects me from a MitM attack. Given the ...
orokusaki's user avatar
  • 1,372
65 votes
6 answers

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET:
TomJ's user avatar
  • 753
78 votes
3 answers

symmetric encryption session keys in SSL/TLS

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
lurscher's user avatar
  • 1,250
70 votes
5 answers

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: What exactly is the difference here and why are two encryption bits ...
JohnJ's user avatar
  • 867
33 votes
5 answers

SSH - If Eve has the passphrase and public key, can she derive the private key?

I have used ssh-keygen for creating an RSA 4096-bit SSH private and public key pair. I used a passphrase for the private key. If an attacker, Eve, knows the passphrase in addition to the public key: ...
unseen_rider's user avatar
22 votes
5 answers

How can I explain the concept of public and private keys without technical jargon? [duplicate]

Possible Duplicate: Principle of asymmetric algorithm in plain english In the spirit of How can I explain SQL injection without technical jargon?, do you have any suggestions on how to explain ...
NickAldwin's user avatar
28 votes
1 answer

My understanding of how HTTPS works (gmail for example)

I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting. I will use Gmail as an example: My laptop tries to connect to the Gmail server ...
Xianlin's user avatar
  • 409
12 votes
3 answers

Preventing a spoofing man in the middle attack?

I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
Griffin Nowak's user avatar
6 votes
2 answers

Is it possible to decrypt a SSL/TLS session without doing a MITM-attack?

I'm not talking about decrypting the connection while the SSL/TLS is happening (MITM) but after the connection is closed and I have a pcap file of the entire negotiation/data transfer process. How ...
YSY's user avatar
  • 2,259
4 votes
3 answers

Public key in SSL protocol

I have gone through many of the posts including My understanding of how HTTPS works (gmail for example). Everywhere it's mentioning that before creating a https connection, the browser verifies the ...
kevin's user avatar
  • 63
7 votes
2 answers

How are two systems able to set up a secure SSH tunnel over a public connection?

As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on ...
Hoytman's user avatar
  • 483
2 votes
2 answers

Can a wifi provider decrypt HTTPS usind MITM without users noticing? [duplicate]

As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid. So I could MITM all https traffic, and spy on my users?
Antonio's user avatar
  • 31
2 votes
3 answers

IPSec VPNs and symmetric keys

When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...
SwaroopGiwali's user avatar
4 votes
1 answer

What would be a simple example of an asymmetric encryption function (asymmetric function)?

I am trying to understand RSA encryption but the algorithm seems quite complex. I know that with asymmetric encryption you use a key and a function to encrypt data and a different function to decrypt ...
yoyo_fun's user avatar
  • 183
4 votes
1 answer

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
Alexandru's user avatar
  • 175
3 votes
3 answers

Help with SSL teaching material

I am taking a course on security next month. As the concepts of SSL/TSL are bit hard. I am looking for a nice way of presenting it to my students. They are Compsci undergrads. It would be nice to ...
user2315's user avatar
  • 473
4 votes
3 answers

ssl - Can the attacker generate his own symmetric key if ClientHello and ServerHello are intercepted?

After reading this awesome explanation of how SSL works, I now have a confusion. The answer states that the first messages of SSL are ClientHello and ServerHello(in response to ClientHello). Both of ...
ng.newbie's user avatar
  • 275
3 votes
1 answer

Security of OpenVPN against sophisticated DPI solution

I'm planing to build a device (prototype) that act as a portable security gateway. To make this, I choosed OpenWRT running on Raspberry Pi with OpenVPN for VPN connection. My main purpose of this ...
sameera's user avatar
  • 227
3 votes
2 answers

How can a connection be secure, if somebody observes it from the beginning? [duplicate]

If somebody observes a connention between client, and the server, then he can see the keys, by the following data encrypted is. As far as I know, if I connect to a server, then it sends me some keys, ...
Iter Ator's user avatar
  • 193
-4 votes
1 answer

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
T. Webster's user avatar
  • 2,379
5 votes
2 answers

If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?

What are the vulnerable areas when two endpoint connect via TLS? Does the physical layer or data link layer a factor of security concern between the two endpoints? Does it matter in terms of security, ...
Drew Lex's user avatar
  • 2,033
2 votes
1 answer

TLS working and the symmetric key exchange

Is this TLS working correct? Using facebook as e.g. here - The CA has it's own pub and pvt key. CA gives fb a pub and pvt key All browsers have the CA pub key already - the root cert. When ...
allwynmasc's user avatar
-1 votes
1 answer

Who can view my https browsing habbits? [closed]

I was wondering about HTTPS security and how easily is compromised. I have already read the similar threads in here, but I have some more questions: Let's say I am searching something at Google. ...
py_script's user avatar
  • 781