Linked Questions

4
votes
3answers
2k views

sslstrip vs. privoxy redirect rule on clients

I watched this video: http://www.securitytube.net/video/193 Now I'm thinking about an example. Suppose I have a privoxy proxy on my PC: user.action file (just part of it): { +redirect{s@http://@...
4
votes
2answers
583 views

When using HTTPS, which part of domain is revealed to ISP? [duplicate]

Let's say you are visiting https://57vdyr6tyuibgyoihp.blogspot.com. Does the ISP only see the blogspot.com part, or the entire 57vdyr6tyuibgyoihp.blogspot.com?
4
votes
2answers
280 views

Are the GET values also encrypted/secured by SSL?

For example we submit a form on the following site: https://example.com (SSL Encrypted) Then the form is submitted as GET method, so it becomes like this: https://example.com/form_action.php?user=...
2
votes
2answers
3k views

privacy - Which parts of URL is protected by HTTPS? [duplicate]

Assuming the website I visit uses HTTPS, which parts of the URL is protected from the eyes of my ISP? eg; https://subdomain.domain.com/path/file.php?param=value I know that domain.com (and probably ...
1
vote
2answers
571 views

Why does not Google switch to POST method for queries? [duplicate]

With ISPs getting license to record and sell customer's traffic data, why doesn't Google switch to POST method for search queries to provide better security to the users, while HTTPS is already used?
-1
votes
2answers
626 views

Does HTTPS encrypt visited URL? [duplicate]

Perhaps I am misunderstanding the way in which HTTP over SSL works, but I was interested in whether the addresses visited by a browser via HTTPS are themselves encrypted? This is not only in terms of ...
14
votes
1answer
2k views

What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol? [duplicate]

What parties have access to the full requested URL of a website accessed via the HTTPS protocol? Here are some possibilities I can think of, and there could be more: local device accessing the ...
5
votes
1answer
486 views

Can wildcard certificates hide/obscure the hostname in a TLS connection?

I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...
3
votes
1answer
2k views

Dangers of passing Oauth 2.0 client id and client secret in the request uri

I was reading here that when passing a client_id and client_secret to an authorization server, The parameters can only be transmitted in the request-body and MUST NOT be included in the ...
2
votes
1answer
1k views

Is a long, random string in a URL considered adequate protection from unauthorised access? [duplicate]

I have recently had to submit a number of confidential PDF documents to a website. These documents contain more than enough information to use in identity theft, and I can conceive how others using ...
0
votes
1answer
40 views

HTTP/HTTPS/GET/POST : in which cases can a malicious router between client and server find a secret information? [duplicate]

Let's say I connect a safe server example.com. In which case(s) can a malicious router in the middle of the route (or my ISP) see secret? 1) HTTP + GET, secret in URL query parameter : http://...
-1
votes
1answer
1k views

Can SNI faking be useful for confusing Deep Packet Inspection (web filters etc.)?

There are several countries in our progressive world that apply filtering rules defined by the state — implementing censorship. As I can suppose, ISPs are blocking websites by their IPs. Just because ...
0
votes
0answers
18 views

Will Internet provider know what sub-page I visited on a site? [duplicate]

Let's say in my address bar I see such link: Privatebin URL/key interception? Can somebody besides server and me know that I'm visiting not just security.stackexchangec.com but excactly ../questions/...
0
votes
0answers
14 views

Is password less login secure? [duplicate]

Recently I came across this password less login. For authentication, we need to enter an email address and click on a login button. We will receive a link in your email and when we click on that link ...
0
votes
0answers
94 views

Is it safe to use HTTPS websites over an unknown PPTP VPN? [duplicate]

I want to create e.g a Gmail account while connected to an unknown PPTP VPN. Is it safe, or can the owner of the PPTP VPN see my Gmail web page information, such as username or password, at all? Can ...

15 30 50 per page