SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

-1
votes
1answer
66 views

Is this company's claim to have solved MITM attacks true?

The Daily Mail reported in Dec 2014 about a company that claimed to have solved the MITM attack. Can someone explain how this is possible or what the difference is from TLS?
0
votes
0answers
18 views

InitializeSecurityContext takes 45 seconds to come out

For an expired certificate sent by a server, the InitializeSecurityContext function takes more than 45 seconds to come out with SEC_E_CERT_EXPIRED. Is there any configuration to avoid this much ...
0
votes
1answer
42 views

Strange symbols in Firefox address bar with https

Why are there dash marks through the https portion of this address? Is this a feature that's supposed to further accentuate that this is unsecured https? I just thought it was a graphical glitch ...
5
votes
0answers
35 views

SSL Certificate MITM Attack for Expired Domains

Let's say I have a domain name, like mysupercoolproduct.com. I buy a 2 year SSL certificate for it, and then I am negligent and the domain gets snatched up by someone else. I still have a valid SSL ...
4
votes
1answer
49 views

TLS/SSL Certificate - Key usage and encryption

So I'm looking at google.com's SSL certificate and do not understand a few things: I totally get that it ensures the identity of Google's webserver, but don't understand how it proves anything ...
0
votes
1answer
17 views

How can I determine the common cryptographic suites I need to enable on my browser for common websites?

How do I determine the common cryptographic suites I need to enable on my browsers (I use IE11, Firefox/Nightly 49, Chrome 51) running on Windows for common websites, for eg, www.google.com, ...
0
votes
1answer
35 views

Deploy intranet application with SSL certificate

My company has an intranet application build on the WAMP stack - Windows / Apache / MySQL / PHP. This application is installed on a server at each customer's site, and is accessed via LAN IP address. ...
1
vote
1answer
34 views

Password manager login with compromised certificates

This morning I booted my work laptop as usual and logged in to Windows, then my password manager (Dashlane, if it makes a difference) as usual. Opening up Chrome and browsing to a site with HTTPS ...
1
vote
2answers
78 views

Should HSTS be declared on all assets, or just on HTML files?

I am curious if the HSTS response header should be declared on every asset of a sitewide secure site, or just on the HTML pages? I imagine it should be included on all assets including all JS, CSS, ...
2
votes
1answer
52 views

Can a DNS “route” change cause an SSL certificate error?

What I mean by "route change": As a working example, mysite.example.net is set up as: mysite.example.net. 3600 IN CNAME some-other-site.elsewhere.com. ...
2
votes
2answers
39 views

How do I handle HTTPS certificates for a device with dynamic IP?

I'm fairly new to HTTPS and therefore risk this being a dumb question. I have a server hosted on my Raspberry Pi that allows me to configure it remotely, over a network and I'd like to convert to ...
5
votes
0answers
40 views

Share diffie hellman group between servers

I'm deploying several servers with TLS. The servers are different but related and each having their own certificate generated by letsencrypt. And to up the security I'm generating my own diffie ...
-3
votes
1answer
42 views

Intercepting Thick client applications over HTTPS [on hold]

is there a way to intercept and do pentest on thick client applications which are running over HTTPS?
4
votes
2answers
91 views

The client supports old ciphers, but the server not. Is it possible to exploit?

There is a client which supports really old SSL ciphers, including TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0014) TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x0011) ...
1
vote
2answers
100 views

Replacing images on HTTPS sites with MITMf?

I'm using MITMf for replacing images over HTTP, and everything works fine. But how can I replace images on sites like Google or Facebook that uses HTTPS? My actual command: sudo python mitmf.py -i ...
-1
votes
3answers
43 views

How can I extract the certificate from this pcap file?

I have a pcap file of 14 sniffed SSL packets. I uploaded it here: ssl.pcap I opened it with wireshark. I see the 14 packets. The largest of seems to contain a self signed certificate (as it is made ...
-4
votes
1answer
58 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
0
votes
4answers
90 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
0
votes
0answers
52 views

Can someone who owns the wire read my SSL? [duplicate]

This question is regarding internet telecoms when the companies themselves are not to be trusted / cooperating with censorship-oriented governments, etc. Question: Assuming that a telecom owns the ...
0
votes
0answers
37 views

Are the ciphers used in this OpenVPN session secure?

I think AES-256-CBC is generally seen as secure, but I'm a bit unsure about the TLS cipher used: Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key Data Channel Encrypt: Using ...
0
votes
1answer
42 views

X509 / SSL certificates in practise

After learning the theory behind cryptography I'm having quite some problems understanding how SSL or X509 certificates works in practise and I simply cannot find useful information in the internet. ...
0
votes
0answers
35 views

Is the QUIC protocol secure?

QUIC is a new protocol for video streaming, that can establish a secure connection in one round. It is used in Google's new Duo app for example. How does it work and is it secure (comparison with TCP ...
0
votes
0answers
22 views

Renewal of ssl client certificate on iOS app

I'm a bit confused on how ssl renewal would work on an iOS app. I've gotten a LetsEncrypt certificate for my domain name to secure data transfer between my iOS app and my web server. In the ...
1
vote
1answer
123 views

Wireshark SSL stripping

well this question could be asked in Wireshark forums or Stackoverflow forums but, I think the question invloves development and security factors as well so i find the Information Security forum is ...
-3
votes
0answers
62 views

How Cryptographic engine affect in cryptography? [closed]

I find everything on the cryptographic engine, but I did not get a proper Information related to it
2
votes
1answer
31 views

Can the server detect when a client has disabled certificate pinning?

Many mobile applications enforce certificate pinning in order to make a man-in-the-middle attack difficult to accomplish. However, with a jailbroken/rooted device, it's possible to disable the ...
1
vote
1answer
82 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
-2
votes
0answers
42 views

Two same https websites on two different IP's [migrated]

Can I have the same https website (for example https://www.example.com/) hosted on two different IPs?
-3
votes
1answer
80 views

is SSL/TLS certificate vulnerable

To my understanding, the client verifies the server certificate by checking whether the issuer DN (Distinguished Name) is equal to the subject DN in the root certificate ? If this is the case, anyone ...
1
vote
1answer
56 views

SSL/TLS handshake fail rate

I would like to know some numbers regarding to SSL/TLS handshake fail rate, i.e. what is the percentage of (failed SSL/TLS handshake)/(total SSL/TLS handshake) across the internet. By failure it means ...
-1
votes
1answer
94 views

Can VPN provider see my data?

I have a 2 questions: If I use a VPN and I go to any websites via HTTP - does VPN provider will be able to see the traffic? Those. logins, passwords, all the texts that pass through the channel (in ...
0
votes
0answers
3 views

Samba TLS Setup [migrated]

I'm reading this Samba Manpage and according to this, you can setup TLS. I've got 2 questions. On the Server-side, TLS options requires the path of the certificate and keys? How would that work on ...
0
votes
0answers
48 views

How can I STunnel/multiplex RDP and HTTPS over the same ServerIP:443? [migrated]

I need access to my own RDP running outside of a network with DPI-firewall. So SSL is the only option, but I have a SSL web server running. As I have as well only a single IP adress with dynamic IP I ...
1
vote
1answer
33 views

How to specifiy -CAPath using OpenSSL in windows to perform TLS handshake

I'm new to using OpenSSL and currently using it in Windows trying to troubleshoot for the party connecting to our server. openssl s_client -connect servername:443 CONNECTED(00000134) depth=0 CN = ...
4
votes
1answer
53 views

Why is the SHA-1 hash of certificate sent in TLS “Client Certificate URL” extension?

According to RFC6066, constrained clients can send certificate URLs instead of full certificates for TLS client authentication: After negotiation of the use of client certificate URLs has been ...
0
votes
2answers
42 views

What if internal certificate details like CN, Serial Number, validity, CA etc. are shared to external parties from my intranet site?

If by mistake I have shared the details like Common Name, Serial number, etc.. of the certificate of my intranet site/server that is not exposed to the internet will it help attackers exploit the ...
0
votes
1answer
54 views

Does WhatsApp use certificate pinning?

Does WhatsApp use certificate pinning? I found a post by Preatorian Security from February 2014 that points the lack of certificate pinning as a major security problem, and mentions: Update ...
0
votes
0answers
38 views

Create a TLS Application Data Message for AES-GCM

I was wondering if anyone could help me with structuring a TLS Application Data message for AES-GCM. I don't know how the IV, CipherText, Additional Data, and Tag fit together in a message. Thanks. ...
1
vote
2answers
152 views

Heartbleed POC: Is this sensitive information?

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced. Below is an excerpt from the subsequent ...
1
vote
1answer
48 views

LetsEncrypt / Exim4 / GnuTLS / cert chaining: “The provided X.509 certificate list is not sorted” error

From what I can determine, you generate a LetsEncrypt certificate that includes the full cert chain thus: # run lets-enc the usual way # then ..: wget -O intermediate.pem ...
0
votes
1answer
76 views

MySQL database (non-SSL) connections secured via origin/destination IPs, how unsafe are they?

I am testing an Amazon RDS MySQL solution: the database is provided by Amazon RDS but the application logic (php scripts) that accesses the data is hosted in another, different (non-amazon) server. ...
1
vote
1answer
56 views

Amazon RDS MySQL SSL connection, is the password sent in clear?

I am testing Amazon RDS MySQL and I want to connect to MySQL instance using SSL. It works pretty well, but there is something that is not clear to me: reading the FAQs ...
4
votes
0answers
89 views

Which block cipher should be used in TLS 1.2 (while keeping 1.3 in mind)?

I have been looking a bit at the various block ciphers for TLS. As everyone should (pipe dream) have migrated to TLS 1.2 by now it should be considered how to prepare for TLS 1.3, when it has been ...
2
votes
2answers
78 views

What information can my ISP see using squid proxy?

My ISP provides a transparent proxy to use and I can see that they are using the squid proxy for caching this. What I am wondering is what data can they see and what can they see further if they can ...
0
votes
0answers
7 views

How to actually disable SSL3 on a ubuntu 14.04 LTS [migrated]

I am running a server which has tomcat7 and apache2 on it. I issue the following command via another remote host: openssl s_client -connect my_site:443 -ssl3 This returns: CONNECTED(00000003) ...
0
votes
1answer
107 views

Why doesn't my manual RSA key exchange example work?

I'm trying to "manually" compute how the premaster_secret is computed using the RSA key exchange in TLS 1.2, but can't manage to make numbers meet. I am using Scapy SSL to generate a TLS session: I ...
4
votes
2answers
81 views

Why does SSL Labs say that POODLE is mitigated if a server chooses RC4?

I always thought that if a server supports SSLv3 and CBC ciphers, then it is vulnerable to POODLE. But it looks like that is not the case. For example, for Google.com, SSL Labs says that the SSL ...
3
votes
1answer
91 views

Can https with an invalid certificate automatically redirect to http?

Lately, I've had a problem. I have visited a website many times. Sometimes, when I use Charles proxy to detect the network flows, the ssl certificate is found to be invalid. At the time, I ...
0
votes
0answers
20 views

Clarification of RSA Key Exchange (TLS 1.2) and AES for On-Going Message Excahnge

I'm trying to understand the full flow of key exchanges for secure communications. As a potentially incorrect premise, I am under the impression that RSA is a good asymmetric technique for ...
2
votes
1answer
90 views

Viewing HTTPs Traffic - ZAP Proxy / MacOS / iOS App

I've noticed a curious oddity with some traffic sniffing from my Apps on my iPhone. I've installed the ZAP Proxy CA Cert on the device, but I've noticed I can sniff some App traffic, and others I ...