Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1
vote
1answer
106 views

Man in the middle using HTTPs downgrade to HTTP

In general browsers attempt to establish a HTTPs-Connection if possible. How would you force a browser to fallback to HTTP when somebody enters asdf.xyz in the search bar of his/her browser without ...
-1
votes
0answers
26 views

unsupported protocol ssl.c:1124 [closed]

eze@kali:~$ sudo msfconsole [sudo] password for eze: Sorry, try again. [sudo] password for eze: ######## # ################# # ...
0
votes
0answers
44 views

Why does the OCSP need a pair of keys?

I am reading a tutorial about OpenSSl CA installation and after setting up the CA, they say that we now generate a pair for the OCSP because it needs to sign its responses. I am confused at this point....
2
votes
0answers
64 views

What will be the key size for rsa, ecdhe and ecdsa from the cipher suite given?

From the cipher suites tls_rsa_with_aes_128_cbc_sha256 and tls_ecdhe_ecdsa_with_aes_128_cbc_sha256 how do I know what will be the RSA , ECDHE, and ECDSA key support in IBM cloud Watson? here is the ...
0
votes
1answer
28 views

Can lower level intermediate cert declare SAN that broader than higher level cert?

Suppose 1st level intermediate cert specifies DNS=www.dev.com Can 2nd level intermediate cert which is signed by the 1st level specify DNS=*.dev.com or maybe DNS=*.dev2.com? Does certificate level ...
0
votes
0answers
32 views

TLS version actually used between 1.2 and 1.3 [duplicate]

While understanding the basic parameters and differences (encryption/handshake) between 1.2 and 1.3, my (probably naïve) question is which version is actually used when communications are between ...
0
votes
0answers
32 views

TLS client does not drop connection even when there are no suitable ciphersuites in the server ciphersuite list during handshake

I have two Windows systems, and I want to establish an encrypted TCP/IP communication between them. Specifically TLS 1.2 or TLS 1.3. I have configured in both systems the list of allowed ciphersuites: ...
0
votes
1answer
44 views

How to generate a MSK from IEEE 802.1X-2010

IEEE 802.1X-2010 states: "Generate an MSK of at least 64 octets, as required by IETF RFC 3748 [B14] Section 7.10, of which the first 16 or 32 octets are used by this standard as described in 6.2....
0
votes
0answers
50 views

Server to Server HTTP Authentication

I'm designing an API, and had some quick questions about HTTP authentication and security. The API will involve two web servers, one of which I am the developer of (let's call it Server 1). The server ...
19
votes
6answers
4k views

Is there a protocol that provides data integrity, but not encryption for HTTP?

HTTP I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed. HTTPS On the other hand, HTTPS sends encrypted text over the network that can ...
0
votes
1answer
46 views

What is the difference between HTTPS and EAP-TLS? [closed]

As far as I understand they do pretty much the same.
0
votes
0answers
42 views

Is there any way I can have an out of band certification of a site's self signed certs?

Sometimes given the laws and the circumstances one is subjected to, obtaining an official SSL Certificate for a webservice might be extraordinarily difficult if not illegal. For those who are stuck ...
1
vote
1answer
57 views

Any disadvantages to long-lived self-signed certificates for personal use?

I run my own IMAP server on my own machine, and am the only user of it. The server uses a self-signed certificate that I generated with OpenSSL. I don't use the certificate for any other purpose. I ...
2
votes
1answer
151 views

Why does Tor browser use POST method for DuckDuckGo?

I noticed that the default behavior of Tor browser is to use POST method for all DuckDuckGo searches even when that's not the default DuckDuckGo setting. At first I thought it'd be to protect the ...
6
votes
2answers
2k views

How to block requests in web app when certificate is insecure?

I am developing a web app and wanted it to be secure from attacks from the application layer. Currently, my website is allowing interception from Burpsuite like certificate proxy software. Is there a ...
1
vote
1answer
51 views

Is using only secp384r1 and up named groups considered okay?

I found that secp384r1 is supported in almost all web browsers and it is considered secure. My question is: Is it okay if i use only secp384r1 and up named groups? Are there any disadvantages ...
0
votes
1answer
132 views

need an Alternative to ssl pinning for web applications

I am developing a web app and while testing it on burpsuite I found that it is vulnerable to the proxy SSL certificate. I did some research and found that it was handled by a technique called SSL ...
0
votes
0answers
43 views

How do you implement an SSL certificate for a private intranet site? [duplicate]

We have a private intranet site, created in vb.net running on Windows Server 2019. I want to use https, so a padlock displays in the browser rather than, "Not secured". I can't figure out ...
0
votes
1answer
41 views

Is it possible to view the cipher suites offered on my behalf by a MITM proxy?

I'm trying to discover what cipher suites are being offered by my corporate proxy. It's set up as a man in the middle so my "secure" connections are to it, and it attempts to create a ...
30
votes
1answer
6k views

“google.com” is not HSTS protected?

Issue: Oftentimes people enter google.com directly in the browser's address bar without including either the http:// or https:// prefixes. Using Chrome DevTools on a fresh incognito session, I ran the ...
0
votes
0answers
41 views

How to pin public keys in current browsers

Public key pinning is deprecated. Is there still some way to pin keys on browsers like chrome, edge, firefox? For chrome I can add sites to a hsts or expect-ct list. But there is no way to pin keys or ...
0
votes
0answers
47 views

Is it possible to use new and old SSL at the same? [duplicate]

We are in the process of porting our servers from one cloud provider to another. Our SSL certificate is also about to expire. If I generate a new SSL certificate and put it on the new servers, will ...
0
votes
0answers
56 views

How does the EAP-TLS handshake work, exactly?

I'm trying to understand EAP-TLS authentication, but I'm struggling to understand a few bits: Before the supplicant sends any certificates to the server, it usually verifies the server's identity. ...
0
votes
0answers
52 views

Why is there no DNS mechanism for requiring HTTPS on a domain?

Typically, HTTPS redirection happens like this: The user clicks or types an HTTP link, e.g. http://example.com/url. If the browser has seen a Permanent (301) redirect to HTTPS for that exact URL, it ...
0
votes
2answers
69 views

Worst case scenario for compromised private key in server certificate?

Assume that someone gains access to the password used for my key store containing my server certificate and it’s private key. I guess without direct access to the server running my application the ...
0
votes
2answers
60 views

Is it safer to send cookies in headers than the URL?

I have a browser extension. I would like to use this browser extension to send the cookie from site A to site B. I’m doing this because I want to scrape site A from site B, but this is obviously a use ...
0
votes
3answers
101 views

Https - why isn’t the initial connection encrypted / how to avoid initial suspicion?

So with https, someone can still see what website I visited, but not which pages within that website I visited, correct? why isn’t the whole process of connecting to a website - from when I start ...
0
votes
0answers
40 views

Is my password database encryption flow secure?

I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it Here are the diagrams of getting/setting the password file from and to the ...
0
votes
0answers
51 views

Is it a good idea to send integers instead of strings over SSL to save bandwidth? [migrated]

I am creating an app with client-server design. The client and server communicate with each other by sending data as binary message (CBOR array) via WebSocket. Instead of sending strings, I have ...
0
votes
1answer
36 views

How to implement TLS in a product with complex distributed architecture?

We have a distributed product where one server acts as a 'Scheduler' of jobs and there are hundreds if not thousands of 'Agents' which receive commands from the 'Scheduler' and execute the jobs. The ...
1
vote
0answers
70 views

Attack while using a VPN? [closed]

While I was using a VPN, suddenly all websites refused to connect in HTTPS, and Firefox warned me since I enabled HTTPS-only mode. Is there a chance that this was an HTTPS downgrade attack? Should I ...
0
votes
2answers
87 views

Why is the x509 standard for certificates called “x509”? What is meaning behind “x” and/or “509”?

X509 is the name of the standard which defines Public Key Infrastructure and the format of SSL/TLS Certificates. My question is: What does x509 mean?
0
votes
2answers
95 views

Prevent users from easily changing the backend API URL of a desktop application

Is it considered a good security practice to prevent users from easily changing the backend URL of a desktop application that connects to a backend server with an SSL protected HTTP API? One concern ...
0
votes
1answer
48 views

Performing a simpler ssl handshake [duplicate]

Consider the following scenario: client sends hello server send a hello and its certificate client generates a key and encrypts that with server's public key server decrypts the key with its private ...
0
votes
1answer
55 views

How many keys do you use for signing and encrypting emails? [closed]

Situation I have a university Gmail email address. I'm trying to migrate away from sending emails with the Gmail web client to one I have more control over like Thunderbird. It's also because Gmail ...
-3
votes
1answer
97 views

Can TLS create PKI for you? [closed]

Suppose A and B want to create TLS secure channel. But they do not have pre-shared secret, or mutually trust Certificate, How do they do?
0
votes
1answer
59 views

Vulnerabilities and potential scale for sensitive data transferred in plaintext, involving credit card payment information

Regarding the insecure transmission of data over a network. When it comes to plaintext credit card information and payment details being transferred in this manner over HTTPS. What are the possible ...
0
votes
2answers
78 views

Do certain SSL certificates / certificate authorities load faster than others?

I've been trying to optimize my site's speed and noticed that many websites have low "Initial connection" and "SSL" times while mine are generally double of most sites that I've ...
8
votes
1answer
1k views

What does using Cloudflares WARP app offer that HTTPS (websites) alongside DNS over HTTPS / TLS doesn't?

Intoduction to Cloudflare WARP I’ve been looking at Cloudflares WARP app for mobile. It claims to be a VPN but without some of the IP hiding anonymity features normal VPNS have: “Under the covers, ...
2
votes
1answer
56 views

Should the Secure cookie flag also be set on HTTPS only websites?

Should the cookie secure flag be set on websites which are served only through HTTPS? The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel ...
0
votes
2answers
58 views

How CAs verify they are issuing the certificate to the correct party?

Say youtube.com wants to generate their new certificate. How certification authority verify that the request came from youtube.com, not from a party pretending to be youtube.com?
2
votes
2answers
140 views

Security implications of Cloudflare's SSL Full mode (not Strict)

Cloudflare enables several options regarding the communication between its servers and our own. "SSL Full" means Cloudflare encrypts the traffic but doesn't check the validity of our servers'...
1
vote
3answers
66 views

Should all the headers reported by securityheaders.io be considered as findings?

A lot of websites scanned with securityheaders.io are missing different headers. Should all of these headers be reported as findings or just few of them which are more critical?
0
votes
1answer
65 views

Internal HTTPS recommended security practices

So I'm by no means a security expert. I'm just a recently graduated software developer who is working on a contract project and I want to ensure I'm taking appropriate security measures for my client. ...
2
votes
1answer
35 views

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection?

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection? Can they agree on a cipher suite? Why?
0
votes
2answers
74 views

WPA2-EAP-TLS with global client certificate

Is security compromised if every client uses the same client certificate to authenticate with WPA2-EAP-TLS? In essence, we want to provide an open wifi network, but want to ensure users cannot see ...
0
votes
2answers
125 views

What is the privacy benefit of VPNs?

I'm learning about networking. And I feel a donkey. Background We connect to the internet by first connecting to a Wifi Access Point, or a switch. Then when we open up a browser, or use any transfer ...
1
vote
3answers
174 views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
2
votes
1answer
210 views

Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?

I have developed my DRF back-end API locally, deployed it on an AWS Lightsail instance (with a public static IP) and I now want to secure it with HTTPS. I understand that in order to use Let's Encrypt ...
0
votes
1answer
40 views

How to use another SSL certificate for DHE-RSA while I already have one with domain?

I'm working in IOT team to build a web based IOT system. I'm using Dataplicity's Wormhole to host my nodeJS app on raspberry pi. I want to use DHE-RSA symmetric key encryption channel for sending/...

1
2 3 4 5
103