Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

TLS client does not drop connection even when there are no suitable ciphersuites in the server ciphersuite list during handshake

I have two Windows systems, and I want to establish an encrypted TCP/IP communication between them. Specifically TLS 1.2 or TLS 1.3. I have configured in both systems the list of allowed ciphersuites: ...
0
votes
1answer
26 views

How to generate a MSK from IEEE 802.1X-2010

IEEE 802.1X-2010 states: "Generate an MSK of at least 64 octets, as required by IETF RFC 3748 [B14] Section 7.10, of which the first 16 or 32 octets are used by this standard as described in 6.2....
0
votes
0answers
49 views

Server to Server HTTP Authentication

I'm designing an API, and had some quick questions about HTTP authentication and security. The API will involve two web servers, one of which I am the developer of (let's call it Server 1). The server ...
18
votes
6answers
4k views

Is there a protocol that provides data integrity, but not encryption for HTTP?

HTTP I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed. HTTPS On the other hand, HTTPS sends encrypted text over the network that can ...
0
votes
1answer
45 views

What is the difference between HTTPS and EAP-TLS? [closed]

As far as I understand they do pretty much the same.
0
votes
0answers
42 views

Is there any way I can have an out of band certification of a site's self signed certs?

Sometimes given the laws and the circumstances one is subjected to, obtaining an official SSL Certificate for a webservice might be extraordinarily difficult if not illegal. For those who are stuck ...
1
vote
1answer
57 views

Any disadvantages to long-lived self-signed certificates for personal use?

I run my own IMAP server on my own machine, and am the only user of it. The server uses a self-signed certificate that I generated with OpenSSL. I don't use the certificate for any other purpose. I ...
2
votes
1answer
131 views

Why does Tor browser use POST method for DuckDuckGo?

I noticed that the default behavior of Tor browser is to use POST method for all DuckDuckGo searches even when that's not the default DuckDuckGo setting. At first I thought it'd be to protect the ...
6
votes
2answers
2k views

How to block requests in web app when certificate is insecure?

I am developing a web app and wanted it to be secure from attacks from the application layer. Currently, my website is allowing interception from Burpsuite like certificate proxy software. Is there a ...
1
vote
1answer
51 views

Is using only secp384r1 and up named groups considered okay?

I found that secp384r1 is supported in almost all web browsers and it is considered secure. My question is: Is it okay if i use only secp384r1 and up named groups? Are there any disadvantages ...
0
votes
1answer
130 views

need an Alternative to ssl pinning for web applications

I am developing a web app and while testing it on burpsuite I found that it is vulnerable to the proxy SSL certificate. I did some research and found that it was handled by a technique called SSL ...
0
votes
0answers
42 views

How do you implement an SSL certificate for a private intranet site? [duplicate]

We have a private intranet site, created in vb.net running on Windows Server 2019. I want to use https, so a padlock displays in the browser rather than, "Not secured". I can't figure out ...
0
votes
1answer
41 views

Is it possible to view the cipher suites offered on my behalf by a MITM proxy?

I'm trying to discover what cipher suites are being offered by my corporate proxy. It's set up as a man in the middle so my "secure" connections are to it, and it attempts to create a ...
30
votes
1answer
6k views

“google.com” is not HSTS protected?

Issue: Oftentimes people enter google.com directly in the browser's address bar without including either the http:// or https:// prefixes. Using Chrome DevTools on a fresh incognito session, I ran the ...
0
votes
0answers
40 views

How to pin public keys in current browsers

Public key pinning is deprecated. Is there still some way to pin keys on browsers like chrome, edge, firefox? For chrome I can add sites to a hsts or expect-ct list. But there is no way to pin keys or ...
0
votes
0answers
46 views

Is it possible to use new and old SSL at the same? [duplicate]

We are in the process of porting our servers from one cloud provider to another. Our SSL certificate is also about to expire. If I generate a new SSL certificate and put it on the new servers, will ...
0
votes
0answers
53 views

How does the EAP-TLS handshake work, exactly?

I'm trying to understand EAP-TLS authentication, but I'm struggling to understand a few bits: Before the supplicant sends any certificates to the server, it usually verifies the server's identity. ...
0
votes
0answers
52 views

Why is there no DNS mechanism for requiring HTTPS on a domain?

Typically, HTTPS redirection happens like this: The user clicks or types an HTTP link, e.g. http://example.com/url. If the browser has seen a Permanent (301) redirect to HTTPS for that exact URL, it ...
0
votes
2answers
69 views

Worst case scenario for compromised private key in server certificate?

Assume that someone gains access to the password used for my key store containing my server certificate and it’s private key. I guess without direct access to the server running my application the ...
0
votes
2answers
60 views

Is it safer to send cookies in headers than the URL?

I have a browser extension. I would like to use this browser extension to send the cookie from site A to site B. I’m doing this because I want to scrape site A from site B, but this is obviously a use ...
0
votes
3answers
99 views

Https - why isn’t the initial connection encrypted / how to avoid initial suspicion?

So with https, someone can still see what website I visited, but not which pages within that website I visited, correct? why isn’t the whole process of connecting to a website - from when I start ...
0
votes
0answers
40 views

Is my password database encryption flow secure?

I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it Here are the diagrams of getting/setting the password file from and to the ...
0
votes
0answers
51 views

Is it a good idea to send integers instead of strings over SSL to save bandwidth? [migrated]

I am creating an app with client-server design. The client and server communicate with each other by sending data as binary message (CBOR array) via WebSocket. Instead of sending strings, I have ...
0
votes
1answer
36 views

How to implement TLS in a product with complex distributed architecture?

We have a distributed product where one server acts as a 'Scheduler' of jobs and there are hundreds if not thousands of 'Agents' which receive commands from the 'Scheduler' and execute the jobs. The ...
1
vote
0answers
68 views

Attack while using a VPN? [closed]

While I was using a VPN, suddenly all websites refused to connect in HTTPS, and Firefox warned me since I enabled HTTPS-only mode. Is there a chance that this was an HTTPS downgrade attack? Should I ...
0
votes
2answers
86 views

Why is the x509 standard for certificates called “x509”? What is meaning behind “x” and/or “509”?

X509 is the name of the standard which defines Public Key Infrastructure and the format of SSL/TLS Certificates. My question is: What does x509 mean?
0
votes
2answers
95 views

Prevent users from easily changing the backend API URL of a desktop application

Is it considered a good security practice to prevent users from easily changing the backend URL of a desktop application that connects to a backend server with an SSL protected HTTP API? One concern ...
0
votes
0answers
18 views

What MAC did SSLv3.0 use? How did it compare to HMAC in TLS 1.0 and above? [migrated]

According to Wikipedia: TLS has a variety of security measures: Using a message digest enhanced with a key (so only a key-holder can check the MAC). The HMAC construction used by most TLS cipher ...
0
votes
1answer
48 views

Performing a simpler ssl handshake [duplicate]

Consider the following scenario: client sends hello server send a hello and its certificate client generates a key and encrypts that with server's public key server decrypts the key with its private ...
0
votes
1answer
54 views

How many keys do you use for signing and encrypting emails? [closed]

Situation I have a university Gmail email address. I'm trying to migrate away from sending emails with the Gmail web client to one I have more control over like Thunderbird. It's also because Gmail ...
-3
votes
1answer
97 views

Can TLS create PKI for you? [closed]

Suppose A and B want to create TLS secure channel. But they do not have pre-shared secret, or mutually trust Certificate, How do they do?
0
votes
1answer
59 views

Vulnerabilities and potential scale for sensitive data transferred in plaintext, involving credit card payment information

Regarding the insecure transmission of data over a network. When it comes to plaintext credit card information and payment details being transferred in this manner over HTTPS. What are the possible ...
0
votes
2answers
78 views

Do certain SSL certificates / certificate authorities load faster than others?

I've been trying to optimize my site's speed and noticed that many websites have low "Initial connection" and "SSL" times while mine are generally double of most sites that I've ...
8
votes
1answer
1k views

What does using Cloudflares WARP app offer that HTTPS (websites) alongside DNS over HTTPS / TLS doesn't?

Intoduction to Cloudflare WARP I’ve been looking at Cloudflares WARP app for mobile. It claims to be a VPN but without some of the IP hiding anonymity features normal VPNS have: “Under the covers, ...
2
votes
1answer
56 views

Should the Secure cookie flag also be set on HTTPS only websites?

Should the cookie secure flag be set on websites which are served only through HTTPS? The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel ...
0
votes
2answers
58 views

How CAs verify they are issuing the certificate to the correct party?

Say youtube.com wants to generate their new certificate. How certification authority verify that the request came from youtube.com, not from a party pretending to be youtube.com?
2
votes
2answers
140 views

Security implications of Cloudflare's SSL Full mode (not Strict)

Cloudflare enables several options regarding the communication between its servers and our own. "SSL Full" means Cloudflare encrypts the traffic but doesn't check the validity of our servers'...
1
vote
3answers
66 views

Should all the headers reported by securityheaders.io be considered as findings?

A lot of websites scanned with securityheaders.io are missing different headers. Should all of these headers be reported as findings or just few of them which are more critical?
0
votes
1answer
65 views

Internal HTTPS recommended security practices

So I'm by no means a security expert. I'm just a recently graduated software developer who is working on a contract project and I want to ensure I'm taking appropriate security measures for my client. ...
2
votes
1answer
33 views

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection?

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection? Can they agree on a cipher suite? Why?
0
votes
2answers
73 views

WPA2-EAP-TLS with global client certificate

Is security compromised if every client uses the same client certificate to authenticate with WPA2-EAP-TLS? In essence, we want to provide an open wifi network, but want to ensure users cannot see ...
0
votes
2answers
125 views

What is the privacy benefit of VPNs?

I'm learning about networking. And I feel a donkey. Background We connect to the internet by first connecting to a Wifi Access Point, or a switch. Then when we open up a browser, or use any transfer ...
1
vote
3answers
161 views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
2
votes
1answer
208 views

Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?

I have developed my DRF back-end API locally, deployed it on an AWS Lightsail instance (with a public static IP) and I now want to secure it with HTTPS. I understand that in order to use Let's Encrypt ...
0
votes
1answer
40 views

How to use another SSL certificate for DHE-RSA while I already have one with domain?

I'm working in IOT team to build a web based IOT system. I'm using Dataplicity's Wormhole to host my nodeJS app on raspberry pi. I want to use DHE-RSA symmetric key encryption channel for sending/...
-2
votes
1answer
192 views

When will TLS 1.2 be deprecated?

Just wondering where I can track TLS 1.2, specifically, when will it be deprecated? A link would be appreciated - thanks!
0
votes
1answer
120 views

TLS 1.2 and HTTPS [duplicate]

This question may be silly but I've a hard time understanding TLS 1.2 and accessing a website via HTTPS. I've received a report from a web security tool that my website is not HTTPS and I have to ...
1
vote
1answer
91 views

Is SSH using TLS?

I have an odd case where a vulnerability scan is reporting that sshd is vulnerable because of TLS. I didn't think SSH used TLS, so can someone help me explain why "openssl s_client -connect ...
0
votes
0answers
42 views

Private key vs encryption session keys: For what is the private key used when there are session keys for encryption? [duplicate]

I have read that the private key that the certificate owner/web server has (which is the corresponding private key of the public key presented on the certificate) is used to decrypt the data that the ...
0
votes
2answers
108 views

How to securely get a key from a key server?

In the installation procedure of Gentoo, there is a step to check signature of the downloaded iso file. To do so, we first need to download the set of keys from a key server: $ gpg --keyserver hkps://...

1
2 3 4 5
103