Linked Questions

2
votes
1answer
1k views

Why doesn't outlook 2013 meet modern security standards?

It is required to turn on the allow less secure apps setting in order to be able to use a gmail account with outlook 2013, despite it is using the IMAP and SMTP services with SSL protocol enabled. ...
6
votes
2answers
8k views

What are the risks of using TLS 1.0 for web applications?

I work with a company that has several web applications available to its customers via HTTPS. Recently, client browsers will not access these web applications due to the HTTPS connection being made ...
5
votes
2answers
1k views

Questions about TLS handshaking process

I am trying to understand how TLS works. Assuming the I have a java client that uses TLSv1 to communicate to the server which supports TLSv1.2, can the client talk to the server successfully? When a ...
70
votes
5answers
5k views

Strange Payment Gateway

I have a freelance client that wants me to integrate a payment gateway into their Woocommerce site but I am being increasingly concerned about their choice of provider and the project as a whole. The ...
1
vote
2answers
1k views

Is the (SSL3-based) SSTP VPN protocol vulnerable to the POODLE attack?

The Secure Socket Tunneling Protocol is a VPN protocol developed by Microsoft. It sends traffic over an SSL version 3 connection. Since SSlv3 is vulnerable to the POODLE attack, does this mean that ...
2
votes
1answer
54k views

TLS handshake encrypted alert on client certificate

I'm trying to debug a TLS handshake between a client and a server Client sends Hello Server sends Hello, Certificate, Certificate request, Server hello done. client sends Encrypted alert - content ...
1
vote
1answer
149 views

Should I use SSL only on my admin subdomain?

I have a site at mydomain.com. Users can sign up there to create a simple little site of their own that gets automatically created and can then be found at mydomain.com/name-user-chose There is an ...
2
votes
3answers
893 views

Public key in resources for avoiding man in the middle attack

I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK ...
1
vote
1answer
253 views

SSLV3.0 Poodle Man-in-the-Middle scenario

I have gone through the answers in this thread SSL3 "POODLE" Vulnerability. In the first answer,the following has been mentioned. ""The last ciphertext block thus gets decrypted, which ...
0
votes
1answer
98 views

Client authentication [closed]

Assume a server which offers some information which must not be exposed publicly. A client of this which may be e.g. a windows service (or at least something executing headless) needs to access the ...
4
votes
4answers
605 views

Bank login in foreign country

I have friends andfamily that travel/live in foreign countries and compromised unsecure wireless networks and credit card scanners have always been a problem. I was recently asked a question about ...
2
votes
2answers
1k views

Disable SSLv3 system-wide for all clients?

After reading about Poodle secutrity bug, I have disabled SSLv3 on my servers and browsers. But there are several clients that do not expose settings detailed enough via their own means of ...
111
votes
5answers
473k views

How do I use “openssl s_client” to test for (absence of) SSLv3 support?

In order to mitigate the "Poodle" vulnerability, I'd like to disable SSLv3 support in my (in this case, TLS, rather than HTTPS) server. How can I use openssl s_client to verify that I've done this?
1
vote
0answers
58 views

What's the impact of POODLE to the Internet? [duplicate]

POODLE can be exploited on SSL 3.0 and TLS 1.0, as the latter falls back to SSL 3 after multiple connection errors. I wonder how many use these protocols for encrypted data transfer, will it be a ...
39
votes
1answer
10k views

TLS: RC4 or not RC4?

I was reading another interesting article by Matthew Green today, saying that if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop As far as I'm aware RC4 ...

15 30 50 per page