Skip to main content

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1288 votes
3 answers

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
Polynomial's user avatar
  • 135k
170 votes
13 answers

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
johndodo's user avatar
  • 1,935
94 votes
4 answers

SSL Certificate framework 101: How does the browser verify the validity of a given server certificate?

(I have a basic understanding of public/private key, hashing, digital signatures... I have been searching online & stack forums last couple days but cannot seem to find a satisfactory answer.) ...
SecurityNoob's user avatar
  • 1,051
372 votes
6 answers

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
Son of the Wai-Pan's user avatar
420 votes
14 answers

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
Joshua Carmody's user avatar
219 votes
7 answers

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
jojo's user avatar
  • 2,301
105 votes
5 answers

How does SSLstrip work?

I've been reading up on SSLstrip and I'm not 100% sure on my understanding of how it works. A lot of documentation seems to indicate that it simply replaces occurrences of "https" with "http" in ...
Scott Helme's user avatar
  • 3,238
50 votes
11 answers

Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
Iszi's user avatar
  • 27.1k
79 votes
3 answers

Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?

For example, say the following are HTTPS URLs to two websites by one IP over 5 mins: "", "", "", "", "". Would monitoring of packets reveal: nothing, reveal only ...
blunders's user avatar
  • 5,072
116 votes
18 answers

Does an established HTTPS connection mean a line is really secure?

From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
Peter Smit's user avatar
  • 2,749
84 votes
6 answers

Does SSL/TLS (https) hide the urls being accessed [duplicate]

Suppose I type this in my browser and an attacker is watching all traffic from me to my ISP. What information is protected by ...
Jus12's user avatar
  • 1,375
97 votes
9 answers

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as they can't see what I'm doing on the site since all ...
IAmARegisteredUser's user avatar
82 votes
13 answers

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
Olivier Lalonde's user avatar
90 votes
12 answers

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
makerofthings7's user avatar
23 votes
4 answers

If the public key can't be used for decrypting something encrypted by the private key, then how do digital signatures work?

I'm learning asymmetric encryption in the use case of ssl/tls protocol. I can understand that the public key (like a padlock) can encrypt (lock) something and only the private key can decrypt (open)...
Aaron Shen's user avatar
310 votes
3 answers

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
Kyle Rosendo's user avatar
  • 4,035
172 votes
11 answers

Is visiting HTTPS websites on a public hotspot secure?

It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
Calmarius's user avatar
  • 1,975
40 votes
9 answers

How does SSL/TLS PKI work?

We have lots of questions that address portions of SSL/TLS as it relates to PKI, but none of them seem to bring everything together. A canonical answer that we can point people to I think would be ...
RoraΖ's user avatar
  • 12.5k
55 votes
2 answers

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
Kalai's user avatar
  • 801
39 votes
5 answers

Security of an initial redirection from to

Suppose that<foo> systematically redirects to<foo>. I enter in my browser's URL bar, and I see a page load and the URL bar now ...
Gilles 'SO- stop being evil''s user avatar
61 votes
3 answers

Is it common practice for companies to MITM HTTPS traffic?

My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft. It would appear that this ...
Andy Smith's user avatar
  • 2,772
23 votes
2 answers

Why doesn't DNS spoofing work against HTTPS sites? [duplicate]

How does using SSL protect aginst dns spoof? since DNS is at a lower level and it is always work the same whether the user is visiting an HTTP or HTTPS site.
Gray's user avatar
  • 401
23 votes
2 answers

Client-server encryption technique explanation (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 128 bit keys)

I opened a web page using HTTPS. When I looked at the page info provided by my Web browser (Firefox) I saw the following: Connection encrypted: High-grade Encryption (...
VL-80's user avatar
  • 1,254
166 votes
10 answers

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few:
alficles's user avatar
  • 1,761
81 votes
10 answers

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
blunders's user avatar
  • 5,072
38 votes
3 answers

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
Novice User's user avatar
  • 2,118
584 votes
3 answers

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
jrdioko's user avatar
  • 13.2k
76 votes
1 answer

Are SSL encrypted requests vulnerable to Replay Attacks?

Are SSL encrypted requests vulnerable to Replay Attacks? If so, what are good options to prevent this?
rreyes1979's user avatar
7 votes
3 answers

How to prove some server sent some file over HTTPS

I want to prove that some file I retrieved using HTTPS was indeed sent by the server. I tried searching online, but I didn't find what I want. How to easily prove that some HTTPS server sent some ...
v7d8dpo4's user avatar
  • 267
445 votes
9 answers

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
Morten's user avatar
  • 4,603
250 votes
4 answers

SSL3 "POODLE" Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What is the ...
tylerl's user avatar
  • 83.5k
101 votes
5 answers

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
Lernkurve's user avatar
  • 1,144
48 votes
4 answers

What to transfer? Password or its hash?

Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...
Konrad Garus's user avatar
33 votes
3 answers

For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?

Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially: The problem: Attacker sets up a WiFi spot. User enters our site (...
Kobi's user avatar
  • 645
65 votes
4 answers

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
Tom Marthenal's user avatar
65 votes
6 answers

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET:
TomJ's user avatar
  • 753
64 votes
2 answers

I just send username and password over https. Is this ok?

When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
Riley Lark's user avatar
  • 1,007
144 votes
14 answers

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
Luke Sheppard's user avatar
130 votes
5 answers

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
Matt Goforth's user avatar
  • 1,303
97 votes
10 answers

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
sharptooth's user avatar
  • 2,241
87 votes
5 answers

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
Kyle Rosendo's user avatar
  • 4,035
85 votes
4 answers

What is Logjam and how do I prevent it?

I heard there is a "new" TLS vulnerability named Logjam, what does it do and how do I prevent it?
Arperum's user avatar
  • 941
77 votes
7 answers

What makes Let's Encrypt secure?

Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every ...
Quitting Due To Antisemitism's user avatar
18 votes
3 answers

Are secret URLs secure over HTTPS? [duplicate]

Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread. What level of ...
RomanSt's user avatar
  • 1,220
16 votes
5 answers

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it pose a threat even if the person is using a secure application layer protocol? What I mean by ...
Celeritas's user avatar
  • 10.2k
107 votes
4 answers

Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?

It has become quite difficult to configure an HTTPS service that maintains "the ideal transport layer". How should an HTTPS service be configured to permit some reasonable level of compatibility while ...
rook's user avatar
  • 47.2k
103 votes
4 answers

What is ECDHE-RSA?

What is the difference between ECDHE-RSA and DHE-RSA? I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
Hubert Kario's user avatar
  • 3,808
73 votes
4 answers

What clients are proven to be vulnerable to Heartbleed?

On several pages, it is re-iterated that attackers can obtain up to 64K memory from the server or client that use an OpenSSL implementation vulnerable to Heartbleed (CVE-2014-0160). There are dozens ...
Lekensteyn's user avatar
  • 6,078
34 votes
9 answers

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...
LanceBaynes's user avatar
  • 6,279
22 votes
6 answers

Is it possible for corporation to intercept and decrypt SSL/TLS traffic? [duplicate]

I found there are some companies claim that they offer service that can eliminate SSL/TLS blind spot, such as Blue Coat and Gigamon. Are they talking about some way of decipher the https content (...
Peter Li's user avatar
  • 321

2 3 4 5