Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1
vote
0answers
14 views

Tor and MITM SSL [duplicate]

In my company they have MITM/SSL in following way. There is a proxy to whom all PCs connect. Now the company installed some trusted certificate authority (e.g. ISSUER-COMPANY-NAME) on our computers. ...
0
votes
0answers
27 views

Self signed SSL certificate usage for private site [duplicate]

I have a website that is not supposed to be open to the public and the URL is hidden. Currently, I use Comodo certs to do the SSL, but I'm wondering since only approved devices should be accessing it, ...
-2
votes
1answer
71 views

HTTP/3 No more TLS or TCP [closed]

I was reading documentation about HTTP/3, and in the article, they sed that they are no longer TLS or TCP. So it's mean that a web site with no SSL 80 will be changed to what port and 443 will be ...
0
votes
2answers
53 views

Tools that check TLS client side

There are so many tools such as testssl, sslyze to test the TLS configurations on webservers. I wanted to know, why aren't there any tool that checks the TLS client side? What makes it difficult?
17
votes
2answers
3k views

Do browsers know domains that are supposed to be encrypted?

Do browsers have a list with sites that are supposed to be encrypted? Could a man in the middle attack be performed by presenting a user a http site instead of an https site? That way the server would ...
1
vote
1answer
36 views

Is it important that every TLS1.2 encrypted message have padding?

what if data we are sending is such that size(data) + size(mac) =multiple of block size If this case if possible how the receiver will determine that no padding is present ???
2
votes
2answers
64 views

Does content-type header having a blank value in the response body, cause any security problem?

I have one HTTP request which is responding with no content value (No response body). Is it necessary to have a content-type header specified for these kinds of responses?
-1
votes
2answers
88 views

Passwords via unsecure network [duplicate]

If I use an up-to-date iPhone to access Gmail, can the password that I type be compromised if my iPhone is connected to a compromised router since everything has to go through the router? I checked ...
1
vote
1answer
44 views

Is it allowed to store billing address for merchants SAQ A merchants? (PCI DSS)

I know there are many limitations for data storing and processing by PCI DSS. Some of them are explained here. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf But I can't find any ...
0
votes
0answers
54 views

Client application that will only talk to an authenticated server using tls

I use Transport Layer Security (TLS) and I am building a prototype for a client application that will only talk to an authenticated server.Even if I wind up using certificates to authenticate the ...
1
vote
0answers
90 views

Different certificate issuers on same site based on browser

When I try to access some web site on firefox I get this: The cut out rectangle is COMPANY-NAME-ROOT-CA and that issuer (COMPANY-NAME-ROOT-CA) was also added as trusted on some peoples PC. But when I ...
1
vote
1answer
67 views

Does it matter that my browser shows an out-of-date certificate when a website uses service workers?

A website I frequent (a Discourse forum) uses Let's Encrypt TLS certificates which are updated every two months with a valid period of three months. But the certificate information shown by Chrome ...
0
votes
2answers
68 views

Do we need to disable the SSL verification while developing a web scrapping application in Java?

I am writing a web scrapping application using core Java. However when the application tried to access some https enabled URLs I am getting error. Below are the details. Code: url = new URL(...
0
votes
1answer
50 views

Connecting to a Postgres Database over SSL using Sockets in Python [closed]

I am trying to connect to a Postgres Database using sockets to enforce a particular TLS version from the client in order to verify that the Database does not accept connections from the client which ...
1
vote
1answer
65 views

Are FaceID/passcode logins secure over public WiFi/hotspots?

Unfortunately, I find myself serving a 14d COVID-19 self-isolation period in a hotel which only offers unsecured public WiFi. This has me wondering if all the financial apps on my iPhone with FaceID-...
0
votes
0answers
46 views

2 VPNs at the same time? Split tunneling? [migrated]

I work from home over a VPN using a Ubuntu 20.04 laptop. That work regularly includes both HTTPS & ssh sessions over the office VPN. Sometimes from the same laptop, I also need to use a second ...
0
votes
1answer
60 views

Arp poisoning doesn’t work with HTTPS navigation

I’m trying to do an ARP poisoning attack in my LAN. I use Ettercap and I place my attacker computer between my routers and target Windows computer. Despite the target ARP table changing, when I use ...
0
votes
0answers
37 views

Is it safe to embed a google form on a website without an SSL Certificate?

I designed a Google Form for a website which does not have an SSL Certificate. I have planned to embed it onto a page using an iframe tag. I am currently testing it and have published a test page with ...
3
votes
1answer
168 views

Is there a security vulnerability in setting a public DNS entry to a private IP Address?

I recently set up a wireguard server-network configuration with a home server and client devices. I have one main domain that I hope to route everything through via subdomains (in this example, abc....
0
votes
0answers
55 views

How should I sign a CSR using a signature created in HSM, in C# .NET Core? [migrated]

I'm exhausted after looking for an answer for 3 days. I don't know if my suggested flow is wrong or my Google skills have really deteriorated. My API needs to create a valid certificate from a CSR it ...
-1
votes
1answer
55 views

CDN end to end encryption?

I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did. Now I'm able to ...
0
votes
3answers
86 views

Is http to https port forwarding a vulnerability? [duplicate]

I work in an organisation where a TMG server with port forwarding has been used successfully for a number of years to forward all http traffic to https for a particular web application. This meant ...
1
vote
0answers
64 views

Detecting a web based MITM attack?

I've been looking into ways to detect a Man In the Middle attack, when the client has "duped" into trusting third party CA. Examples of this are, anti-virus applications and corporate ...
2
votes
0answers
106 views

Why don't CAs advertize public keys of verified entities on a central location instead of giving out signed certificates?

If CAs (Certification Authorities) start advertizing public keys of verified websites via some API, browsers can simply query them for each domain instead of asking websites to give them certificates ...
2
votes
1answer
85 views

How do clients extract the public key from a self-signed certificate?

I have gone over: Why do we need to sign the self-signed certificate? Basic self-signed certificate questions Is a self-signed SSL certificate much better than nothing? I am new to cryptography and ...
0
votes
0answers
21 views

authenication of client in one way ssl [duplicate]

In below ssl diagram : I have one doubt with 1-way ssl. If there is an interceptor in-between client and server who can alter in following way : In step 8, when client is sending his symetric key to ...
0
votes
0answers
23 views

IIS CMS access web service

We are creating a new web site and it’s using a CMS that will connect to a internal web service that will connect to a sql database. The cms will be in the DMZ and the web service will be in the ...
0
votes
1answer
63 views

LDAP StartTLS encryption - which TLS versions are supported?

I am looking to set a third party application to authenticate with our domain. The application supports LDAPv3 and we have opted to use the start StartTLS extension to encrypt the credentials from the ...
-2
votes
1answer
61 views

What happens if no CertificateVerify is sent in TLS?

I know in TLS, the client would send a CertificateVerify message for the server to confirm the client's identity through means such as CA but what if the client never sent this information? Is it ...
3
votes
2answers
227 views

Does the CA create the public key or is it created by the requesting server and sent to the CA?

This link says that the requesting server creates the public-private key pair and sends the public key to the CA inside the CSR. However, DigiCert says: The CSR is submitted to a Certificate ...
1
vote
0answers
44 views

Where does Shodan document fields that I can search by? [closed]

where do I find information on all the fields that I can use shodan to search by? For example I can find a specific ssl vendor's certificates with ssl.cert.issuer.CN=asdf but what other fields can I ...
2
votes
1answer
51 views

Why is my RADIUS Certificate not automatically signed with the root CA Certificate on my iPhone

I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method. I have used this old tutorial for setting up my own CA and generating the certificates and ...
1
vote
1answer
60 views

Can TLS defeat the manipulation of TCP sequence numbers?

Assuming there is a powerful adversary who can arbitrarily manipulate the sequence number of each tcp packet, then the following packet-reorder attack should be possible, right? Assuming the packet ...
1
vote
1answer
45 views

When does it make sense to deploy an embedded firewall on my IoT device?

I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
0
votes
1answer
52 views

How to guarantee only my client application can request a nonce?

I have a web site and a service in a server. I'm developing the "Register User" and "Login" components. I've searched on the internet and I've found two protocols to login user ...
-2
votes
2answers
91 views

SSL Cert for client side web application, is it needed?

For client-side web applications that run in your machine (that you download at first visit - Blazor WebAssembly to be specific): Do I need to enable SSL (HTTPS) for this application or web server ...
1
vote
2answers
80 views

Burp Proxy vs MITM

I have recently started using Burp as a proxy for hunting bugs on websites and I see many submissions where people have intercepted and modified requests/responses to exploit certain logic flaws in ...
0
votes
1answer
57 views

Error Loading extension 'copy_extensions' in Openssl

While running the following command on Ubuntu 19.10, with OpenSSl 1.1.1c 28 May 2019: openssl req -config ${CNF_FILE} -key ${PRIVATE_FILE} -new -x509 -days 10950 -sha384 -extensions v3_ca -out ${...
1
vote
2answers
41 views

Solution to User Initial HTTP Requests Unencrypted Despite HTTPS Redirection?

It is my understanding that requests from a client browser to a webserver will initially follow the specified protocol e.g, HTTPS, and default to HTTP if not specified (Firefox Tested). On the server ...
0
votes
1answer
54 views

Where are field names of decoded human readable X.509 certificates specified?

The ASN.1 module for X.509 certificates as specified in RFC 5912 - Section 14 is as follows: TBSCertificate ::= SEQUENCE { version [0] Version DEFAULT v1, serialNumber ...
10
votes
7answers
4k views

Are URL parameters of GET and POST requests over HTTPS secure?

It's well known that GET requests with ?xx=yy arguments embedded can be altered in transit, and therefore are insecure. If I change the request to POST, and use HTTPS, then the parameters are in the ...
3
votes
4answers
176 views

Passing plain text password over HTTPS

My login for POST is over HTTPS. Therefore, I don't do anything to the provided password before submitting. And I don't see an issue there unless someone is watching your browser's developer console. (...
0
votes
1answer
83 views

Is it possible to search HTTPS messages using homomorphic encryption?

We're trying to build a packet sniffer that can search and quarantine malware in encrypted transactions without decrypting said transactions. At present, we're exploring whether homomorphic encryption ...
0
votes
0answers
36 views

Bettercap TLS handshake phase information

I wanted to know if bettercap has a feature that allows to view TLS handshake phase information (as Wireshark does), for example the "Client Hello" ?
1
vote
2answers
76 views

Does HTTPS protect mobile internet connections against “network injection”?

The Star recently published an article describing an alleged attack against a Moroccan journalist. The article describes the attack as such: Forensic evidence gathered by Amnesty International on ...
2
votes
2answers
76 views

Why would one disable a new TLS version by default?

I saw today that TLS 1.1 and 1.2 are not enabled by default in Windows 7 and Windows Server 2008. They can be enabled after an optional update, and after setting a registry key. Why? Negotiating the ...
-1
votes
2answers
48 views

Can SSL certificate (domain verification) process be eliminated?

Noob question alert. I understand SSL certificates help mitigate MITM attacks, but I see the process to be so badly designed. Basically the client needs to verify that it is talking to the particular ...
0
votes
0answers
34 views

need to address a subset of CIA triad elements and not in entirety

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. ...
1
vote
2answers
261 views

How to interpret security impact of “Server Signature Algorithms” (sslscan)

I'm looking at the results of an sslscan of an internal web application, which reports the following: I'm not sure how to interpret these and couldn't find an elaboration of what exactly this ...
2
votes
2answers
70 views

Preventing HTTPS Replay Attacks

I've read here that HTTPS replay attacks aren't possible from MITM attacks but I want to be sure that it's not saying that HTTPS replay attacks aren't possible at all. I want to know if I have to ...

1
2 3 4 5
102