The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1152
votes
3answers
617k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
102
votes
9answers
55k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
390
votes
14answers
58k views

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
291
votes
6answers
229k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
179
votes
7answers
161k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
72
votes
3answers
61k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?

(Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
113
votes
18answers
19k views

Does an established HTTPS connection mean a line is really secure?

From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
81
votes
9answers
87k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as https://secure.example.com) they can't see what I'm doing on the site since all ...
80
votes
13answers
25k views

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
65
votes
3answers
7k views

Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?

For example, say the following are HTTPS URLs to two websites by one IP over 5 mins: "A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2". Would monitoring of packets reveal: nothing, reveal only ...
82
votes
12answers
14k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
44
votes
11answers
3k views

Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
287
votes
3answers
69k views

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
87
votes
5answers
127k views

How does SSLstrip work?

I've been reading up on SSLstrip and I'm not 100% sure on my understanding of how it works. A lot of documentation seems to indicate that it simply replaces occurrences of "https" with "http" in ...
33
votes
9answers
32k views

How does SSL/TLS PKI work?

We have lots of questions that address portions of SSL/TLS as it relates to PKI, but none of them seem to bring everything together. A canonical answer that we can point people to I think would be ...
68
votes
6answers
53k views

Does SSL/TLS (https) hide the urls being accessed [duplicate]

Suppose I type this in my browser https://www.mysite.com/getsecret?username=alice&password=mysecret and an attacker is watching all traffic from me to my ISP. What information is protected by ...
141
votes
11answers
87k views

Is visiting HTTPS websites on a public hotspot secure?

It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
38
votes
5answers
8k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
22
votes
2answers
26k views

Client-server encryption technique explanation (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 128 bit keys)

I opened a web page using https. When I looked at the page info provided by my browser (Firefox) I saw following: Connection encrypted: High-grade Encryption (...
47
votes
2answers
59k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
57
votes
3answers
7k views

Is it common practice for companies to MITM HTTPS traffic?

My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft. It would appear that this ...
38
votes
3answers
21k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
9
votes
4answers
2k views

If the public key can't be used for decrypting something encrypted by the private key, then how do digital signatures work?

I'm learning asymmetric encryption in the use case of ssl/tls protocol. I can understand that the public key (like a padlock) can encrypt (lock) something and only the private key can decrypt (open)...
244
votes
4answers
109k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What is the ...
31
votes
3answers
6k views

For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?

Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially: The problem: Attacker sets up a WiFi spot. User enters our site (...
40
votes
4answers
10k views

What to transfer? Password or its hash?

Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...
97
votes
5answers
29k views

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
72
votes
9answers
9k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
58
votes
4answers
16k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
16
votes
3answers
3k views

Are secret URLs secure over HTTPS? [duplicate]

Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread. What level of ...
7
votes
3answers
359 views

How to prove some server sent some file over HTTPS

I want to prove that some file I retrieved using HTTPS was indeed sent by the server. I tried searching online, but I didn't find what I want. How to easily prove that some HTTPS server sent some ...
545
votes
3answers
495k views

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
311
votes
9answers
180k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
139
votes
14answers
46k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
61
votes
1answer
35k views

Are SSL encrypted requests vulnerable to Replay Attacks?

Are SSL encrypted requests vulnerable to Replay Attacks? If so, what are good options to prevent this?
87
votes
5answers
37k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
103
votes
4answers
132k views

Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?

It has become quite difficult to configure an HTTPS service that maintains "the ideal transport layer". How should an HTTPS service be configured to permit some reasonable level of compatibility while ...
89
votes
5answers
95k views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
73
votes
4answers
34k views

What clients are proven to be vulnerable to Heartbleed?

On several pages, it is re-iterated that attackers can obtain up to 64K memory from the server or client that use an OpenSSL implementation vulnerable to Heartbleed (CVE-2014-0160). There are dozens ...
83
votes
4answers
51k views

What is Logjam and how do I prevent it?

I heard there is a "new" TLS vulnerability named Logjam, what does it do and how do I prevent it?
52
votes
2answers
30k views

I just send username and password over https. Is this ok?

When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
90
votes
10answers
34k views

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
71
votes
5answers
15k views

What makes Let's Encrypt secure?

Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every ...
12
votes
5answers
5k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it pose a threat even if the person is using a secure application layer protocol? What I mean by ...
16
votes
2answers
18k views

Why doesn't DNS spoofing work against HTTPS sites? [duplicate]

How does using SSL protect aginst dns spoof? since DNS is at a lower level and it is always work the same whether the user is visiting an HTTP or HTTPS site.
65
votes
3answers
25k views

symmetric encryption session keys in SSL/TLS

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
88
votes
4answers
112k views

What is ECDHE-RSA?

What is the difference between ECDHE-RSA and DHE-RSA? I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
56
votes
6answers
82k views

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET: www.mycoolsite.com/index?id=1&type=...
30
votes
6answers
62k views

Are there any reasons for using SSL over IPSec?

is it recommended to use both protocols together? In which situation?
30
votes
9answers
10k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...