Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

0
votes
0answers
11 views

JA3 and its usefulness

JA3 was created by people at Salesforce and it is a way of creating TLS/SSL fingerprints due to the fact that negotiation is done in the clear. According to JA3, these fingerprints give someone the ...
1
vote
0answers
40 views

Decrypting DH traffic in DMZ

We have various servers in our DMZ's. Some of them are behind load balancers (but only few). We also have BlueCoat SSL Visibility Appliances currently deployed in passive-tap mode (we get the inbound ...
0
votes
2answers
22 views

Is it necessary to encrypt messages client side if using HTTPS?

I am creating a messaging service for an app I'm developing and right now the data flow is as follows: Send: message sent to server => message encrypted based on user's public key and signed using ...
0
votes
0answers
20 views

How to run Metasploit WMAP on site that requires SNI

Apologies if this an obvious question, documentation seems to be a bit thin on the ground. I'm attempting to scan (with permission) a site that redirects to its https version, and requires SNI to ...
0
votes
0answers
41 views

Are plaintext POST payloads over HTTPS safe? [duplicate]

My knowledge on information security is limited. I argued with a colleague more specialized in that area that, for the purposes of calling a login Web service, POST plaintext payloads sent over HTTPS ...
0
votes
0answers
35 views

How is danger / badidea / thisisunsafe justified?

The HSTS standard states the following: 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")...
1
vote
0answers
32 views

How can a 802.11 client verify the authenticity of an AP it is trying to connect to?

With the onset of hardware like the WiFi pineapple, it has become somewhat harder to protect the privacy of your WiFi network. WPA2 Enterprise with Radius authentication could come to rescue here, but ...
1
vote
1answer
38 views

Dangers of Sending Onetime Pin numbers over http

Are there any dangers of sending a one time pin number from customer to my server over HTTP? Somebody is arguing that its okay since it will only be used once. So there's no chance of an attacker ...
0
votes
0answers
25 views

HTTP/HTTPS request on the same site for same webpage [closed]

I'm using the following code to handle both the request at server. But still no success. RewriteEngine On RewriteBase / RewriteCond %{ENV:HTTPS} !on [NC] RewriteCond %{REQUEST_URI} !^/.*$ [NC] ...
1
vote
1answer
42 views

Can my VPN provider see my browsing activities on SSL sites? [duplicate]

I gather they can probably see everything if they want to on non-SSL sites but how about on SSL sites, can they do it?
0
votes
0answers
87 views

Why are banks largely absent from the HSTS preload list?

There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
1
vote
1answer
24 views

Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?

We are using SAML Web Browser SSO Profile (SAML 2.0) We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs. If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
0
votes
1answer
63 views

Can smartphone app be hacked by wifi?

We all know that it is possible to spy on other people in the same wifi network, even if it is difficult. What about apps, like Facebook app for Android? Is it similar to an https website so it is ...
1
vote
1answer
45 views

Where exactly in the OSI model does TLS/SSL belong [duplicate]

I am trying to understand where exactly SSL/TLS sits in OSI model. If I look at this answer on StackExchange, While all network models are imperfect, this question can only be answered by looking ...
1
vote
1answer
46 views

Must the CN of a certificate (self-signed or otherwise) be DNS resolvable?

I'm trying to get Bareos working with TLS encryption using a self-signed certificate. I have used the name of the server for the self-signed certificate CN. The server does NOT have a domain set. ...
2
votes
1answer
32 views

When I enable ssl3-methods but disable ssl3 in OpenSSL

I need to compile a tls scanning tool and I want to use OpenSSL1.1.0g. The tool uses the library and compiles it in the build file. Unfortunately the tool does not successfully build when my OpenSSL ...
0
votes
1answer
22 views

What does enable-static-engine do in Openssl ./config

I am using a command to compile OpenSSL from source. I need to remove un-needed parameters that enable settings I do not need. One of the settings: enable-static-engine What does this parameter do? ...
0
votes
1answer
31 views

How can I know the protocol versions supported at OpenSSL1.1.0g

How can I identify the versions (TLSv1.2, TLSv1.1, TLSv1.0, SSLv3, etc.) supported in OpenSSL1.1.0g when I manually compile it from its source (NOT the one shipped with the OS like ubuntu) without ...
0
votes
1answer
75 views

How to check if TLS 1.0 is disabled [duplicate]

I want to disable TLS 1.0 on my server while only keeping TLS 1.1 and TLS 1.2 enabled. I've made the necessary adjustments (I think). How can I check that TLS 1.0 is indeed disabled?
-1
votes
1answer
72 views

Which encryption methods are used in online banking?

How does the connection get established in online banking? Just with SSL? I searched the internet for that, but there are just 'user guides' if you want to use online banking but not how it works on ...
3
votes
2answers
106 views

Are Let’s Encrypt wrapper services secure?

There are a number of web based portals that purport to make installation of free SSL certificates user friendly for non-technical users (ZeroSsl, SSLforFree). For lack of a better term I am calling ...
0
votes
0answers
9 views

How to verify and generate encrypted handshake message [migrated]

I am implementing a simple TLS 1.2 library upon wolfssl crypto library base. This just supports the DHE RSA AES128 SHA cipher suite. I verified with openssl that the Master secret is well negotiated. ...
2
votes
1answer
92 views

How does server use session key after tls handshake?

After TLS handshake both server and client agreed about session key to use as symmetric key. So server must store several session keys which each one belongs to a specific client. How server ...
3
votes
1answer
82 views

Invalid certificate name on go,microsoft.com

About 1 times out of 20, going to go.microsoft.com displays this page: The certificate is for www.holidaycheck.de which doesn't make sense. (Note: I'm Canadian, not Deutsch.) The other 19 times, I ...
4
votes
3answers
110 views

client/server trust after authenticating over HTTPS then dropping to plaintext?

Disclaimer If this question is ridiculous it's because secure public key exchange sounds impossible before you learn about it. So I'm asking about things that may be impossible. Question Is it ...
1
vote
2answers
42 views

openssl certificate chain output

I was reading the "Security with HTTPS and SSL" guide for android developers and reading this paragraph. The paragraph discusses the fact that servers do not always return the entire certificate ...
2
votes
2answers
62 views

Is it okay to have your SSL cert showing when server is reached by IP?

I've been doing some research into SSL for a paper for school, so please forgive my ignorance and lack of experience in this subject. While doing my research I have noticed that some websites when you ...
2
votes
0answers
46 views

Delegating SSL certificate requests to a third party

I'm wondering what best practices are regarding delegating the authority to approve SSL certificate issuance. One of our vendors (www.vendordomain.com) will soon host a Web application for us (www....
0
votes
2answers
127 views

Does HTTPS protect against active attackers?

I know that HTTPS protects against passive attackers, due to encryption. Which of course provides confidentiality. So does it protect data(passwords, emails, etc) during traffic, against active ...
0
votes
0answers
17 views

PMK on Authenticator and Supplicant

Will it work, if the PMK is different between the Authenticator and the Supplicant. PMK is generated using EAP-TLS authentication. Initially Radius Server provides PMK to the Authenticator using a ...
0
votes
0answers
19 views

How do I disable TLS Session Tickets in Chrome?

According to ssllabs SSL Session tickets are enabled by default. These are the weakest link in TLS, how do I disable them? I'm using the latest stable.
1
vote
2answers
96 views

Does a public key stay the same when a certificate is renewed? [duplicate]

So I'm implementing certificate pinning on iOS and it was recommended that we check the certificate chain using public key hash values. The rationale for this lay in the fact that we were told that ...
2
votes
1answer
134 views

What are the benefits to HTTPS between two servers I control?

The current setup we have is two servers that are held internally in my building. One of these is only accessible internally, the other is public facing. The internal server communicates with the ...
0
votes
4answers
76 views

Why are CRLs used instead of “valid certificates lists” and inner workings of CRLs

I don't really understand why the approach towards checking the validity of certificates is "valid until proven otherwise" (aka revocation lists). In my opinion this is kind of weird. A CA has to ...
0
votes
0answers
44 views

DNS/CA/MITM Attack proof web hosting by relying on a public blockchain

I'm working on an interesting project, related to blockchain, smart contract and security in internet communications / web content serving. The main goal is to reduce risks of HTTP man in the middle ...
33
votes
8answers
12k views

Why should browser security be prioritized?

From this answer about browser security: time to update if you really care about security So if every other software and functions I need can work on a 32-bit OS, I guess the only reason for ...
1
vote
0answers
71 views

signature with Bleichenbacher’s attack [migrated]

I understood Bleichenbacher & ROBOTO attack, however I have some trouble understanding Section 3.5 of ROBOT attack which discusses retrieving private keys. https://www.usenix.org/system/files/...
1
vote
0answers
42 views

FTP over TLS, with multiple sites hosted on the same server [migrated]

Is it possible to have FTP over TLS on a server that hosts multiple websites (domains) ? I can get certificates for any of the domains, but the problem is that I have no way of knowing to which ...
0
votes
1answer
39 views

arp spoofing and https reading doubts in bettercap tool

using the popular bettercap tool and observing responses I had two doubts that also concerns some theoretical questions: Bettercap allows you to arp spoof entire ranges of ip-s (e.g. an entire /24 ...
0
votes
0answers
23 views

Can EAP/PEAP protocols be re-used for wired AP authentication

If i require a java application software to connect to multiple access points (in various organization) can i re-use the current EAP protocols in access points to connect to them? For example, today ...
-2
votes
0answers
43 views

Android SSL Packet Capture - MITM

I would like to create an Android application which decrypts SSL packets from an application which gets data in JSON format. The application will then edit the JSON to remove certain information so ...
1
vote
1answer
60 views

Why would TLSv1.0 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA still be used?

First, I may be asking a dumb question. I am trying to learn, so please, take it easy on me. Second, if this is not the right place for this question, or you can link me elsewhere, please tell me/ ...
1
vote
1answer
55 views

What is the safest method to send authentication data to API?

I use Vue.js on frontend and GoLang on backend. With Vue I'm sending AJAX request with credentials for sign in/sign up. Should I use HTTP Basic Auth, or just send them in request body? In case you are ...
0
votes
1answer
38 views

Signing webhooks with JWT — overkill with TLS?

I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it ...
0
votes
0answers
13 views

perl SSL mysql configuration [migrated]

We have an application written in Perl and I need to configure it to "talk SSL" with MySQL. mysq_ssl mysql_ssl_ca_file The path to a file in PEM format that contains a list of trusted SSL ...
0
votes
0answers
39 views

SSLstrip and SSLsniff and how to protect against it [duplicate]

I'm trying to understand how you could compromise someone on an HTTPS connection. I've had a friend who travels and claim to have lost bank/credit card information while using public wifi. i set them ...
2
votes
0answers
22 views

Saving and verifying an HTTPS request [duplicate]

I want to save a web request and prove that it was signed by a specific certificate. What I want is the TLS equivalent of: -----BEGIN PGP SIGNED MESSAGE----- <!doctype html> <head> .... -...
0
votes
1answer
101 views

How to check if my PC's HTTPS/TLS connection is monitored or a key-logger is installed? [duplicate]

A few days ago, in the office, we were asked by our bosses to install a program. This was supposed to be an Antivirus program. But after installing this program many of our colleagues have been ...
2
votes
1answer
82 views

Aren't browser extensions a critical security risk?

Lately, there was a lot of publicity given to such exotic security risks as Spectre and Meltdown, with immediate Pavlov reactions from Microsoft, Mozilla etc. However recently I came upon the (...
2
votes
0answers
27 views

mbedtls mutual authentication [closed]

I have a server CA cert, device cert and the device private key. I am using mbedtls and want to be able to create a mutual authentication connection between the device and the server. I also have to ...