Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
5,128
questions
1
vote
1answer
106 views
Man in the middle using HTTPs downgrade to HTTP
In general browsers attempt to establish a HTTPs-Connection if possible. How would you force a browser to fallback to HTTP when somebody enters asdf.xyz in the search bar of his/her browser without ...
-1
votes
0answers
26 views
unsupported protocol ssl.c:1124 [closed]
eze@kali:~$ sudo msfconsole
[sudo] password for eze:
Sorry, try again.
[sudo] password for eze:
######## #
################# #
...
0
votes
0answers
44 views
Why does the OCSP need a pair of keys?
I am reading a tutorial about OpenSSl CA installation and after setting up the CA, they say that we now generate a pair for the OCSP because it needs to sign its responses.
I am confused at this point....
2
votes
0answers
64 views
What will be the key size for rsa, ecdhe and ecdsa from the cipher suite given?
From the cipher suites tls_rsa_with_aes_128_cbc_sha256 and tls_ecdhe_ecdsa_with_aes_128_cbc_sha256 how do I know what will be the RSA , ECDHE, and ECDSA key support in IBM cloud Watson?
here is the ...
0
votes
1answer
28 views
Can lower level intermediate cert declare SAN that broader than higher level cert?
Suppose 1st level intermediate cert specifies DNS=www.dev.com
Can 2nd level intermediate cert which is signed by the 1st level specify DNS=*.dev.com or maybe DNS=*.dev2.com?
Does certificate level ...
0
votes
0answers
32 views
TLS version actually used between 1.2 and 1.3 [duplicate]
While understanding the basic parameters and differences (encryption/handshake) between 1.2 and 1.3, my (probably naïve) question is which version is actually used when communications are between ...
0
votes
0answers
32 views
TLS client does not drop connection even when there are no suitable ciphersuites in the server ciphersuite list during handshake
I have two Windows systems, and I want to establish an encrypted TCP/IP communication between them. Specifically TLS 1.2 or TLS 1.3.
I have configured in both systems the list of allowed ciphersuites:
...
0
votes
1answer
44 views
How to generate a MSK from IEEE 802.1X-2010
IEEE 802.1X-2010 states:
"Generate an MSK of at least 64 octets, as required by IETF RFC 3748
[B14] Section 7.10, of which the first 16 or 32 octets are used by
this standard as described in 6.2....
0
votes
0answers
50 views
Server to Server HTTP Authentication
I'm designing an API, and had some quick questions about HTTP authentication and security.
The API will involve two web servers, one of which I am the developer of (let's call it Server 1). The server ...
19
votes
6answers
4k views
Is there a protocol that provides data integrity, but not encryption for HTTP?
HTTP
I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed.
HTTPS
On the other hand, HTTPS sends encrypted text over the network that can ...
0
votes
1answer
46 views
What is the difference between HTTPS and EAP-TLS? [closed]
As far as I understand they do pretty much the same.
0
votes
0answers
42 views
Is there any way I can have an out of band certification of a site's self signed certs?
Sometimes given the laws and the circumstances one is subjected to, obtaining an official SSL Certificate for a webservice might be extraordinarily difficult if not illegal.
For those who are stuck ...
1
vote
1answer
57 views
Any disadvantages to long-lived self-signed certificates for personal use?
I run my own IMAP server on my own machine, and am the only user of it. The server uses a self-signed certificate that I generated with OpenSSL. I don't use the certificate for any other purpose. I ...
2
votes
1answer
151 views
Why does Tor browser use POST method for DuckDuckGo?
I noticed that the default behavior of Tor browser is to use POST method for all DuckDuckGo searches even when that's not the default DuckDuckGo setting. At first I thought it'd be to protect the ...
6
votes
2answers
2k views
How to block requests in web app when certificate is insecure?
I am developing a web app and wanted it to be secure from attacks from the application layer.
Currently, my website is allowing interception from Burpsuite like certificate proxy software. Is there a ...
1
vote
1answer
51 views
Is using only secp384r1 and up named groups considered okay?
I found that secp384r1 is supported in almost all web browsers and it is considered secure.
My question is:
Is it okay if i use only secp384r1 and up named groups?
Are there any disadvantages ...
0
votes
1answer
132 views
need an Alternative to ssl pinning for web applications
I am developing a web app and while testing it on burpsuite I found that it is vulnerable to the proxy SSL certificate.
I did some research and found that it was handled by a technique called SSL ...
0
votes
0answers
43 views
How do you implement an SSL certificate for a private intranet site? [duplicate]
We have a private intranet site, created in vb.net running on Windows Server 2019. I want to use https, so a padlock displays in the browser rather than, "Not secured".
I can't figure out ...
0
votes
1answer
41 views
Is it possible to view the cipher suites offered on my behalf by a MITM proxy?
I'm trying to discover what cipher suites are being offered by my corporate proxy. It's set up as a man in the middle so my "secure" connections are to it, and it attempts to create a ...
30
votes
1answer
6k views
“google.com” is not HSTS protected?
Issue:
Oftentimes people enter google.com directly in the browser's address bar without including either the http:// or https:// prefixes.
Using Chrome DevTools on a fresh incognito session, I ran the ...
0
votes
0answers
41 views
How to pin public keys in current browsers
Public key pinning is deprecated. Is there still some way to pin keys on browsers like chrome, edge, firefox?
For chrome I can add sites to a hsts or expect-ct list. But there is no way to pin keys or ...
0
votes
0answers
47 views
Is it possible to use new and old SSL at the same? [duplicate]
We are in the process of porting our servers from one cloud provider to another. Our SSL certificate is also about to expire. If I generate a new SSL certificate and put it on the new servers, will ...
0
votes
0answers
56 views
How does the EAP-TLS handshake work, exactly?
I'm trying to understand EAP-TLS authentication, but I'm struggling to understand a few bits:
Before the supplicant sends any certificates to the server, it usually verifies the server's identity.
...
0
votes
0answers
52 views
Why is there no DNS mechanism for requiring HTTPS on a domain?
Typically, HTTPS redirection happens like this:
The user clicks or types an HTTP link, e.g. http://example.com/url.
If the browser has seen a Permanent (301) redirect to HTTPS for that exact URL, it ...
0
votes
2answers
69 views
Worst case scenario for compromised private key in server certificate?
Assume that someone gains access to the password used for my key store containing my server certificate and it’s private key.
I guess without direct access to the server running my application the ...
0
votes
2answers
60 views
Is it safer to send cookies in headers than the URL?
I have a browser extension. I would like to use this browser extension to send the cookie from site A to site B. I’m doing this because I want to scrape site A from site B, but this is obviously a use ...
0
votes
3answers
101 views
Https - why isn’t the initial connection encrypted / how to avoid initial suspicion?
So with https, someone can still see what website I visited, but not which pages within that website I visited, correct?
why isn’t the whole process of connecting to a website - from when I start ...
0
votes
0answers
40 views
Is my password database encryption flow secure?
I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it
Here are the diagrams of getting/setting the password file from and to the ...
0
votes
0answers
51 views
Is it a good idea to send integers instead of strings over SSL to save bandwidth? [migrated]
I am creating an app with client-server design. The client and server communicate with each other by sending data as binary message (CBOR array) via WebSocket. Instead of sending strings, I have ...
0
votes
1answer
36 views
How to implement TLS in a product with complex distributed architecture?
We have a distributed product where one server acts as a 'Scheduler' of jobs and there are hundreds if not thousands of 'Agents' which receive commands from the 'Scheduler' and execute the jobs. The ...
1
vote
0answers
70 views
Attack while using a VPN? [closed]
While I was using a VPN, suddenly all websites refused to connect in HTTPS, and Firefox warned me since I enabled HTTPS-only mode. Is there a chance that this was an HTTPS downgrade attack? Should I ...
0
votes
2answers
87 views
Why is the x509 standard for certificates called “x509”? What is meaning behind “x” and/or “509”?
X509 is the name of the standard which defines Public Key Infrastructure and the format of SSL/TLS Certificates. My question is: What does x509 mean?
0
votes
2answers
95 views
Prevent users from easily changing the backend API URL of a desktop application
Is it considered a good security practice to prevent users from easily changing the backend URL of a desktop application that connects to a backend server with an SSL protected HTTP API?
One concern ...
0
votes
1answer
48 views
Performing a simpler ssl handshake [duplicate]
Consider the following scenario:
client sends hello
server send a hello and its certificate
client generates a key and encrypts that with server's public key
server decrypts the key with its private ...
0
votes
1answer
55 views
How many keys do you use for signing and encrypting emails? [closed]
Situation
I have a university Gmail email address. I'm trying to migrate away from sending emails with the Gmail web client to one I have more control over like Thunderbird. It's also because Gmail ...
-3
votes
1answer
97 views
Can TLS create PKI for you? [closed]
Suppose A and B want to create TLS secure channel.
But they do not have pre-shared secret, or mutually trust Certificate, How do they do?
0
votes
1answer
59 views
Vulnerabilities and potential scale for sensitive data transferred in plaintext, involving credit card payment information
Regarding the insecure transmission of data over a network.
When it comes to plaintext credit card information and payment details being transferred in this manner over HTTPS. What are the possible ...
0
votes
2answers
78 views
Do certain SSL certificates / certificate authorities load faster than others?
I've been trying to optimize my site's speed and noticed that many websites have low "Initial connection" and "SSL" times while mine are generally double of most sites that I've ...
8
votes
1answer
1k views
What does using Cloudflares WARP app offer that HTTPS (websites) alongside DNS over HTTPS / TLS doesn't?
Intoduction to Cloudflare WARP
I’ve been looking at Cloudflares WARP app for mobile. It claims to be a VPN but without some of the IP hiding anonymity features normal VPNS have: “Under the covers, ...
2
votes
1answer
56 views
Should the Secure cookie flag also be set on HTTPS only websites?
Should the cookie secure flag be set on websites which are served only through HTTPS?
The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel ...
0
votes
2answers
58 views
How CAs verify they are issuing the certificate to the correct party?
Say youtube.com wants to generate their new certificate. How certification authority verify that the request came from youtube.com, not from a party pretending to be youtube.com?
2
votes
2answers
140 views
Security implications of Cloudflare's SSL Full mode (not Strict)
Cloudflare enables several options regarding the communication between its servers and our own.
"SSL Full" means Cloudflare encrypts the traffic but doesn't check the validity of our servers'...
1
vote
3answers
66 views
Should all the headers reported by securityheaders.io be considered as findings?
A lot of websites scanned with securityheaders.io are missing different headers.
Should all of these headers be reported as findings or just few of them which are more critical?
0
votes
1answer
65 views
Internal HTTPS recommended security practices
So I'm by no means a security expert. I'm just a recently graduated software developer who is working on a contract project and I want to ensure I'm taking appropriate security measures for my client.
...
2
votes
1answer
35 views
Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection?
Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection?
Can they agree on a cipher suite?
Why?
0
votes
2answers
74 views
WPA2-EAP-TLS with global client certificate
Is security compromised if every client uses the same client certificate to authenticate with WPA2-EAP-TLS?
In essence, we want to provide an open wifi network, but want to ensure users cannot see ...
0
votes
2answers
125 views
What is the privacy benefit of VPNs?
I'm learning about networking. And I feel a donkey.
Background
We connect to the internet by first connecting to a Wifi Access Point, or a switch.
Then when we open up a browser, or use any transfer ...
1
vote
3answers
174 views
Intercept HTTP Traffic of an android app?
I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
2
votes
1answer
210 views
Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?
I have developed my DRF back-end API locally, deployed it on an AWS Lightsail instance (with a public static IP) and I now want to secure it with HTTPS.
I understand that in order to use Let's Encrypt ...
0
votes
1answer
40 views
How to use another SSL certificate for DHE-RSA while I already have one with domain?
I'm working in IOT team to build a web based IOT system.
I'm using Dataplicity's Wormhole to host my nodeJS app on raspberry pi. I want to use DHE-RSA symmetric key encryption channel for sending/...
