Linked Questions

4
votes
3answers
2k views

sslstrip vs. privoxy redirect rule on clients

I watched this video: http://www.securitytube.net/video/193 Now I'm thinking about an example. Suppose I have a privoxy proxy on my PC: user.action file (just part of it): { +redirect{s@http://@...
6
votes
3answers
2k views

Cipher used for request data encryption used by browser

Please note that this is not about how SSL communication happens between browser (I researched and understood it) and client but other aspects. Using Digicert's SSL mechanism explanation I have ...
4
votes
2answers
280 views

Are the GET values also encrypted/secured by SSL?

For example we submit a form on the following site: https://example.com (SSL Encrypted) Then the form is submitted as GET method, so it becomes like this: https://example.com/form_action.php?user=...
3
votes
1answer
2k views

Dangers of passing Oauth 2.0 client id and client secret in the request uri

I was reading here that when passing a client_id and client_secret to an authorization server, The parameters can only be transmitted in the request-body and MUST NOT be included in the ...
-1
votes
1answer
1k views

Can SNI faking be useful for confusing Deep Packet Inspection (web filters etc.)?

There are several countries in our progressive world that apply filtering rules defined by the state — implementing censorship. As I can suppose, ISPs are blocking websites by their IPs. Just because ...
5
votes
1answer
486 views

Can wildcard certificates hide/obscure the hostname in a TLS connection?

I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...

15 30 50 per page
1
2