Linked Questions

65
votes
4answers
149k views

Google Chrome “Your connection to website is encrypted with obsolete cryptography”

Google Chrome is showing new information in the certificate section. Is this a big deal? If so how can I fix it on the server end? EDIT: Thanks for the answers but I'm not skilled in cryptography so ...
8
votes
2answers
18k views

TLS 1.2 and enable only AEAD ciphers suite list

A company have made a vulnerability scan and give us a report that, recommends to use TLS 1.2 and enable only AEAD ciphers suite, but they aren't giving more information about what I need to achieve ...
11
votes
2answers
4k views

How to create dictionary to prevent weak passwords?

I've been tasked with adding a "dictionary check" against user's passwords to prevent weak passwords. Unfortunately, that is about as much guidance as I've been given and I need some help deciphering ...
9
votes
2answers
371 views

Is it possible to guess the length of a password by sniffing TLS packets?

In this answer, the author states that it is possible to tell the length of your password, by sniffing your TLS packets. Is this true, and how would this be done in practice?
3
votes
1answer
6k views

Disable support for static key cipher suites

I have a requirement to disable in the windows 7 computers of the company the support for static key cipher suites. I have searched and found that this registry key, holds the allowed cipher suites, ...
2
votes
1answer
1k views

Does FTPs (FTP over SSL using explicit TLS) support encryption of data channel?

I am exploring the ability of the FTPs(FTP over SSL using explicit TLS) to encrypt the data channel. I read online that the secure data channel can be entered by entering the PROT command. PROT P for ...
2
votes
2answers
246 views

Using Self sign certificate in internet

Basically the purpose of SSL cert is for trusting each other. If I have an application that only a few clients I know can use, is generating self sign certs enough? Or do I really need to sign with a ...
3
votes
1answer
255 views

Guidelines for TLS cipher suites?

Other than OWASP, are there any other guidelines for recommended TLS/SSL versions as well as their specific cipher suites?
3
votes
1answer
175 views

Automatic client executable updating

Scenario I am currently developing an application which should automatically update (if applicable) every time it is executed. The update would involve replacing the main.exe and any assets in an ...
1
vote
1answer
122 views

Remote VPN access and moving to the cloud

First of all, my question is related to Web Application security. Often when I want to suggest customers to move to the cloud for certain applications, I am being told that our customers are ...
2
votes
1answer
124 views

How to prevent hackers from accessing .htpasswd & ssl protected areas? [closed]

In spite of precautions, hackers got files of mine. I have a password protected area on my server. I am using AuthType Basic AuthName "Title" AuthUserFile /var/www/vhosts.../.htpasswd Require valid-...