Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

How to Spoof JA3 Signature?

I am using python requests library to make HTTP calls. However website bot detection is using JA3 fingerprint verification and blocking me. Is there any way I can spoof the JA3 signature.
0
votes
2answers
51 views

What's the deal with X25519 Support in Chrome/Firefox?

RFC8446/TLSv1.3 Section 9.1 says that "implementations SHOULD support X25519". An online list of software supporting Curve25519 list both Firefox and /Chrome as supporting it for TLS. I did ...
0
votes
1answer
39 views

Verifying client certificate by passing client cert in the header

I'm implementing client certificate authentication. My server is behind a proxy to which I have no control of. And also I don't have any control over the client side communication. During every ...
0
votes
0answers
49 views

the difference between SSL pinning and using just HTTPS connection

I know that if i used HTTPS the connection will established after the handshake so (the user will ping the the link then the server will give him public key so the client can provide him with ...
0
votes
0answers
3 views

RSASSA-PSS with certificates in TLS 1.2 [migrated]

I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3. But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2? Is it possible to use ...
3
votes
2answers
2k views

Need help in creating a .PFX file for SSL Certificate Installation

I am trying to install an SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I downloaded and ...
0
votes
3answers
948 views

TLS1.2 vs TLS1.3

I have seen that most companies use the TLS1.2 protocol, why not use the TLS1.3? My question here is, what are these pros and cons of both, and currently what is a better option?
0
votes
2answers
99 views

Passwords via unsecure network [duplicate]

Can the password that one type be compromised if mobile is connected to a compromised router since everything has to go through the router?
3
votes
2answers
114 views

Why would a certificate authority have multiple root certificates?

When I look at the trusted certificates in my browser, I see that many certificate authorities have multiple root certificates associated with them. For example, org-Amazon has Amazon Root CA 1, ...
0
votes
2answers
68 views

Can SSL certificate (domain verification) process be eliminated?

Noob question alert. I understand SSL certificates help mitigate MITM attacks, but I see the process to be so badly designed. Basically the client needs to verify that it is talking to the particular ...
24
votes
5answers
5k views

Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?

I've heard the argument against DNS-over-HTTPS that it is supposed to be a security nightmare for network defenders because it enables encrypted DNS over port 443, compared to DNS-over-TLS which goes ...
0
votes
1answer
59 views

Force public key collision to break certificate pinning

I'm trying to intercept a SSLv3 connection between a PlayStation 3 client and an authentication server of and outdated game to reverse engineer its protocol. I already tried to set up a simple MITM ...
1
vote
1answer
30 views

How to protect certificates and keys in peer to peer application

I'm making a peer-to-peer cross-platform application (in Java & Kotlin), and I want to encrypt conversations between tens of users, concurrently. However, due to lack of knowledge in security good ...
1
vote
1answer
508 views

Android application interception issue

I'm a newbie to android pen testing and started off with an application. The app uses HTTPS and works fine without configuring any proxy. When a proxy like a burp suite is configured, the app ...
1
vote
0answers
15 views

Tor and MITM SSL [duplicate]

In my company they have MITM/SSL in following way. There is a proxy to whom all PCs connect. Now the company installed some trusted certificate authority (e.g. ISSUER-COMPANY-NAME) on our computers. ...
0
votes
0answers
28 views

Self signed SSL certificate usage for private site [duplicate]

I have a website that is not supposed to be open to the public and the URL is hidden. Currently, I use Comodo certs to do the SSL, but I'm wondering since only approved devices should be accessing it, ...
-2
votes
1answer
82 views

HTTP/3 No more TLS or TCP [closed]

I was reading documentation about HTTP/3, and in the article, they sed that they are no longer TLS or TCP. So it's mean that a web site with no SSL 80 will be changed to what port and 443 will be ...
17
votes
2answers
3k views

Do browsers know domains that are supposed to be encrypted?

Do browsers have a list with sites that are supposed to be encrypted? Could a man in the middle attack be performed by presenting a user a http site instead of an https site? That way the server would ...
1
vote
2answers
3k views

Sign SSL certificate with root certificate using openssl

I have created a root certificate, My Root Certificate, with a private key, RSA Private Key 1, using the openssl terminal command. I would like to make a certificate chain such as the following: My ...
0
votes
2answers
55 views

Tools that check TLS client side

There are so many tools such as testssl, sslyze to test the TLS configurations on webservers. I wanted to know, why aren't there any tool that checks the TLS client side? What makes it difficult?
1
vote
1answer
36 views

Is it important that every TLS1.2 encrypted message have padding?

what if data we are sending is such that size(data) + size(mac) =multiple of block size If this case if possible how the receiver will determine that no padding is present ???
2
votes
2answers
68 views

Does content-type header having a blank value in the response body, cause any security problem?

I have one HTTP request which is responding with no content value (No response body). Is it necessary to have a content-type header specified for these kinds of responses?
1
vote
1answer
68 views

Does it matter that my browser shows an out-of-date certificate when a website uses service workers?

A website I frequent (a Discourse forum) uses Let's Encrypt TLS certificates which are updated every two months with a valid period of three months. But the certificate information shown by Chrome ...
1
vote
1answer
44 views

Is it allowed to store billing address for merchants SAQ A merchants? (PCI DSS)

I know there are many limitations for data storing and processing by PCI DSS. Some of them are explained here. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf But I can't find any ...
1
vote
0answers
90 views

Different certificate issuers on same site based on browser

When I try to access some web site on firefox I get this: The cut out rectangle is COMPANY-NAME-ROOT-CA and that issuer (COMPANY-NAME-ROOT-CA) was also added as trusted on some peoples PC. But when I ...
0
votes
2answers
137 views

certificate used in SSL and keys used in SSH

To do SSH to any server we should create private key pair through which we encrypt the connection. Now in SSH we are just doing encryption and here we don't need to verify the server, that's why we ...
4
votes
2answers
20k views

How to specifiy -CAPath using OpenSSL in windows to perform TLS handshake

I'm new to using OpenSSL and currently using it in Windows trying to troubleshoot for the party connecting to our server. openssl s_client -connect servername:443 CONNECTED(00000134) depth=0 CN = ...
0
votes
0answers
55 views

Client application that will only talk to an authenticated server using tls

I use Transport Layer Security (TLS) and I am building a prototype for a client application that will only talk to an authenticated server.Even if I wind up using certificates to authenticate the ...
0
votes
2answers
68 views

Do we need to disable the SSL verification while developing a web scrapping application in Java?

I am writing a web scrapping application using core Java. However when the application tried to access some https enabled URLs I am getting error. Below are the details. Code: url = new URL(...
8
votes
2answers
4k views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
0answers
130 views

BURP SSL connection failing on Genymotion Virtual Device - Android 8.0 API 26

Everything earlier used to work fine. However, recently I downloaded a newer virtual device on Genymotion, which is an Android 8.0 API 26. I have been struggling to get HTTPS traffic intercepted on ...
6
votes
3answers
1k views

Why would I use MAC over digital signature?

As far as I've read, there is no benefit of a MAC over a digital signature - except the fact that it is faster to generate and process. Is this true? Digital signatures (asymmetric encryption) seem ...
24
votes
6answers
6k views

Why did TLS 1.3 drop AES-CBC?

I was watching this video about TLS 1.3: "Deploying TLS 1.3: the great, the good and the bad (33c3)" and was somewhat surprised to see that in their effort to provide "fewer, better choices" they ...
1
vote
1answer
66 views

Are FaceID/passcode logins secure over public WiFi/hotspots?

Unfortunately, I find myself serving a 14d COVID-19 self-isolation period in a hotel which only offers unsecured public WiFi. This has me wondering if all the financial apps on my iPhone with FaceID-...
0
votes
0answers
46 views

2 VPNs at the same time? Split tunneling? [migrated]

I work from home over a VPN using a Ubuntu 20.04 laptop. That work regularly includes both HTTPS & ssh sessions over the office VPN. Sometimes from the same laptop, I also need to use a second ...
4
votes
2answers
2k views

Can firewalls decrypt SSL packets?

I was wondering if the firewall has the ability to decrypt the SSL traffic. If so, the network admin is able to read the data in clear text at transit.
0
votes
1answer
61 views

Arp poisoning doesn’t work with HTTPS navigation

I’m trying to do an ARP poisoning attack in my LAN. I use Ettercap and I place my attacker computer between my routers and target Windows computer. Despite the target ARP table changing, when I use ...
5
votes
2answers
10k views

What are the risks of using TLS 1.0 for web applications?

I work with a company that has several web applications available to its customers via HTTPS. Recently, client browsers will not access these web applications due to the HTTPS connection being made ...
37
votes
8answers
12k views

Why should browser security be prioritized?

From this answer about browser security: time to update if you really care about security So if every other software and functions I need can work on a 32-bit OS, I guess the only reason for ...
27
votes
3answers
10k views

What is the purpose of frequently rotating TLS certificates without changing underlying keys?

I read in the OWASP cheat sheet regarding certificate / public-key pinning that “Google rotates its certificates … about once a month … [but] the underlying public keys … ...
0
votes
0answers
37 views

Is it safe to embed a google form on a website without an SSL Certificate?

I designed a Google Form for a website which does not have an SSL Certificate. I have planned to embed it onto a page using an iframe tag. I am currently testing it and have published a test page with ...
3
votes
1answer
190 views

Is there a security vulnerability in setting a public DNS entry to a private IP Address?

I recently set up a wireguard server-network configuration with a home server and client devices. I have one main domain that I hope to route everything through via subdomains (in this example, abc....
0
votes
0answers
55 views

How should I sign a CSR using a signature created in HSM, in C# .NET Core? [migrated]

I'm exhausted after looking for an answer for 3 days. I don't know if my suggested flow is wrong or my Google skills have really deteriorated. My API needs to create a valid certificate from a CSR it ...
0
votes
2answers
96 views

Command to check a website is vulnerable to Logjam

I am referring this post https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/ and trying to see a website is vulnerable to Logjam or not. I try with www.google.com:443 but I am ...
9
votes
1answer
1k views

New TLS encryption-busting attack also impacts the newer TLS 1.3, is ECDHE_RSA also affected?

February 9, 2019: Source: New TLS encryption-busting attack also impacts the newer TLS 1.3 "Seven researchers from all over the world found --yet again-- another way to break RSA PKCS#1 v1.5, the ...
0
votes
2answers
117 views

What are the risks of using non-ssl connection between server and (externally hosted) database?

I am building an application using AWS Lambda and using a MongoDB database hosted directly with MongoDB (Atlas). For some reason, I get an error when trying to connect via SSL and I've been working on ...
-1
votes
1answer
55 views

CDN end to end encryption?

I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did. Now I'm able to ...
0
votes
3answers
86 views

Is http to https port forwarding a vulnerability? [duplicate]

I work in an organisation where a TMG server with port forwarding has been used successfully for a number of years to forward all http traffic to https for a particular web application. This meant ...
1
vote
0answers
64 views

Detecting a web based MITM attack?

I've been looking into ways to detect a Man In the Middle attack, when the client has "duped" into trusting third party CA. Examples of this are, anti-virus applications and corporate ...

1
2 3 4 5
102