Linked Questions

2 votes
4 answers
2k views

Does the SSL termination happen with the ISP or a mobile service provider? [duplicate]

Is it true that when I connect to a site over HTTPS , my mobile service provider or the ISP gets to snoop in the communication? Can they play MITM?
user917279's user avatar
4 votes
1 answer
6k views

TLS Authentication/OpenVPN/MITM Attacks on Public Wifi [duplicate]

My question is about how an SSL VPN connection such as OpenVPN is protected against MITM/Spoofing attacks on a public Wifi. For example, if somebody has a 'pineapple' or router setup as a honeypot ...
user843521's user avatar
6 votes
3 answers
6k views

Why isn't it possible for a third party to decrypt HTTPS traffic? [duplicate]

I really don't know much about HTTPS. But I always hear people saying that it is 100% safe and bullet proof. My question is: Is that true or even possible. I mean there are lots of tools that allow ...
Forivin's user avatar
  • 1,019
0 votes
1 answer
4k views

Is TLS secure when full eavesdropping on the network occurs? [duplicate]

Possible Duplicate: How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it? Alice connects to Bob's site via a TLS secured connection (for ...
Brett's user avatar
  • 111
-1 votes
2 answers
700 views

How does TLS stop an ISP from spying on you [duplicate]

Here is what I understand about how clients trust the tcp channels they are connected to. Alice asks Bob for his certificate, signed by a CA's private key Bob sends the certificate, which includes ...
Seph's user avatar
  • 158
5 votes
0 answers
724 views

Why is it not possible for an ISP to man-in-the-middle attack an SSL connection? [duplicate]

If the ISP carries my data, why do people seem to think they cannot see the contents? Wouldn't they be holding the key?
Vaughan Hilts's user avatar
0 votes
1 answer
552 views

Why middleman cannot capture the encryption key of https/tor traffic? [duplicate]

When we use Tor or https traffic , the encryption- decryption key has to be exchanged between the browser and the website server. Why somebody who can capture entire traffic , say ISP or somebody who ...
gostela's user avatar
1 vote
2 answers
439 views

Reg HTTPS man in the middle [duplicate]

Possible Duplicate: How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it? A browser sends a request to gmail.com, gmail sends the cert ...
kalyan's user avatar
  • 447
1 vote
2 answers
276 views

How do certificates work in protecting against a man-in-the-middle attack? [duplicate]

As I understand it, if Alice and Bob wants to communicate securely, they must first agree on the protocols that will be used. Then they must confirm that they are indeed communicating with each other. ...
Dasherman's user avatar
  • 111
0 votes
0 answers
84 views

How can HTTPS be secure when used over open/cracked WiFi? [duplicate]

In the top answer to Consequences of the WPA2 KRACK attack it is recommended: Generally, use HTTPS for anything that needs to be secure (you should do this anyway, also over ethernet, but ...
Wildcard's user avatar
  • 158
0 votes
0 answers
38 views

How can it be possible to have encrypted communication between a server and a client if the server has only a public key [duplicate]

If only the server has an electronic certificate (User ID, Version, Public key), how can be possible the encrypted communication between the client and the server?
joana prifti's user avatar
0 votes
0 answers
38 views

How client and server exchanges keys over Tor network using HTTPS? [duplicate]

When someone uses a browser to connect to https://google.com via Tor network, the client needs to exchange a key with Google in order to keep all the data hidden from the exit node, right? Otherwise, ...
Incognitex's user avatar
0 votes
0 answers
24 views

MITM attack on public wi-fi and ISP wired connection [duplicate]

I know how MITM attacks work (theory/videos on the subject etc), but I am a bit confused and not sure what are the worst-case scenarios that can happen. If I'm using a public VPN and someone is indeed ...
kingJulian's user avatar
1288 votes
3 answers
688k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
Polynomial's user avatar
  • 135k
217 votes
7 answers
216k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
jojo's user avatar
  • 2,281
110 votes
6 answers
33k views

Why can't I MitM a Diffie-Hellman key exchange?

After reading the selected answer of "Diffie-Hellman Key Exchange" in plain English 5 times I can't, for the life of me, understand how it protects me from a MitM attack. Given the ...
orokusaki's user avatar
  • 1,362
65 votes
6 answers
101k views

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET: www.mycoolsite.com/index?id=1&type=...
TomJ's user avatar
  • 753
76 votes
3 answers
29k views

symmetric encryption session keys in SSL/TLS

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
lurscher's user avatar
  • 1,230
70 votes
5 answers
208k views

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm What exactly is the difference here and why are two encryption bits ...
JohnJ's user avatar
  • 867
32 votes
5 answers
8k views

SSH - If Eve has the passphrase and public key, can she derive the private key?

I have used ssh-keygen for creating an RSA 4096-bit SSH private and public key pair. I used a passphrase for the private key. If an attacker, Eve, knows the passphrase in addition to the public key: ...
unseen_rider's user avatar
22 votes
5 answers
47k views

How can I explain the concept of public and private keys without technical jargon? [duplicate]

Possible Duplicate: Principle of asymmetric algorithm in plain english In the spirit of How can I explain SQL injection without technical jargon?, do you have any suggestions on how to explain ...
NickAldwin's user avatar
28 votes
1 answer
25k views

My understanding of how HTTPS works (gmail for example)

I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting. I will use Gmail as an example: My laptop tries to connect to the Gmail server ...
Xianlin's user avatar
  • 409
12 votes
3 answers
7k views

Preventing a spoofing man in the middle attack?

I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
Griffin Nowak's user avatar
6 votes
2 answers
11k views

Is it possible to decrypt a SSL/TLS session without doing a MITM-attack?

I'm not talking about decrypting the connection while the SSL/TLS is happening (MITM) but after the connection is closed and I have a pcap file of the entire negotiation/data transfer process. How ...
YSY's user avatar
  • 2,259
4 votes
3 answers
3k views

Public key in SSL protocol

I have gone through many of the posts including My understanding of how HTTPS works (gmail for example). Everywhere it's mentioning that before creating a https connection, the browser verifies the ...
kevin's user avatar
  • 63
7 votes
2 answers
739 views

How are two systems able to set up a secure SSH tunnel over a public connection?

As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on ...
Hoytman's user avatar
  • 483
2 votes
2 answers
4k views

Can a wifi provider decrypt HTTPS usind MITM without users noticing? [duplicate]

As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid. So I could MITM all https traffic, and spy on my users?
Antonio's user avatar
  • 31
2 votes
3 answers
5k views

IPSec VPNs and symmetric keys

When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...
SwaroopGiwali's user avatar
4 votes
1 answer
2k views

What would be a simple example of an asymmetric encryption function (asymmetric function)?

I am trying to understand RSA encryption but the algorithm seems quite complex. I know that with asymmetric encryption you use a key and a function to encrypt data and a different function to decrypt ...
yoyo_fun's user avatar
  • 183
4 votes
1 answer
2k views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
Alexandru's user avatar
  • 175
3 votes
3 answers
461 views

Help with SSL teaching material

I am taking a course on security next month. As the concepts of SSL/TSL are bit hard. I am looking for a nice way of presenting it to my students. They are Compsci undergrads. It would be nice to ...
user2315's user avatar
  • 473
4 votes
3 answers
618 views

ssl - Can the attacker generate his own symmetric key if ClientHello and ServerHello are intercepted?

After reading this awesome explanation of how SSL works, I now have a confusion. The answer states that the first messages of SSL are ClientHello and ServerHello(in response to ClientHello). Both of ...
ng.newbie's user avatar
  • 275
3 votes
1 answer
2k views

Security of OpenVPN against sophisticated DPI solution

I'm planing to build a device (prototype) that act as a portable security gateway. To make this, I choosed OpenWRT running on Raspberry Pi with OpenVPN for VPN connection. My main purpose of this ...
sameera's user avatar
  • 227
3 votes
2 answers
304 views

How can a connection be secure, if somebody observes it from the beginning? [duplicate]

If somebody observes a connention between client, and the server, then he can see the keys, by the following data encrypted is. As far as I know, if I connect to a server, then it sends me some keys, ...
Iter Ator's user avatar
  • 193
-4 votes
1 answer
902 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
T. Webster's user avatar
  • 2,379
5 votes
2 answers
343 views

If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?

What are the vulnerable areas when two endpoint connect via TLS? Does the physical layer or data link layer a factor of security concern between the two endpoints? Does it matter in terms of security, ...
Drew Lex's user avatar
  • 2,023
2 votes
1 answer
417 views

TLS working and the symmetric key exchange

Is this TLS working correct? Using facebook as e.g. here - fb.com The CA has it's own pub and pvt key. CA gives fb a pub and pvt key All browsers have the CA pub key already - the root cert. When ...
allwynmasc's user avatar
-1 votes
1 answer
280 views

Who can view my https browsing habbits? [closed]

I was wondering about HTTPS security and how easily is compromised. I have already read the similar threads in here, but I have some more questions: Let's say I am searching something at Google. ...
py_script's user avatar
  • 781