Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
0
votes
0answers
29 views

Self signed SSL certificate usage for private site [duplicate]

I have a website that is not supposed to be open to the public and the URL is hidden. Currently, I use Comodo certs to do the SSL, but I'm wondering since only approved devices should be accessing it, ...
-2
votes
1answer
96 views

HTTP/3 No more TLS or TCP [closed]

I was reading documentation about HTTP/3, and in the article, they sed that they are no longer TLS or TCP. So it's mean that a web site with no SSL 80 will be changed to what port and 443 will be ...
0
votes
2answers
59 views

Tools that check TLS client side

There are so many tools such as testssl, sslyze to test the TLS configurations on webservers. I wanted to know, why aren't there any tool that checks the TLS client side? What makes it difficult?
17
votes
2answers
3k views

Do browsers know domains that are supposed to be encrypted?

Do browsers have a list with sites that are supposed to be encrypted? Could a man in the middle attack be performed by presenting a user a http site instead of an https site? That way the server would ...
1
vote
1answer
38 views

Is it important that every TLS1.2 encrypted message have padding?

what if data we are sending is such that size(data) + size(mac) =multiple of block size If this case if possible how the receiver will determine that no padding is present ???
2
votes
2answers
74 views

Does content-type header having a blank value in the response body, cause any security problem?

I have one HTTP request which is responding with no content value (No response body). Is it necessary to have a content-type header specified for these kinds of responses?
0
votes
2answers
100 views

Passwords via unsecure network [duplicate]

Can the password that one type be compromised if mobile is connected to a compromised router since everything has to go through the router?
1
vote
1answer
44 views

Is it allowed to store billing address for merchants SAQ A merchants? (PCI DSS)

I know there are many limitations for data storing and processing by PCI DSS. Some of them are explained here. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf But I can't find any ...
0
votes
0answers
56 views

Client application that will only talk to an authenticated server using tls

I use Transport Layer Security (TLS) and I am building a prototype for a client application that will only talk to an authenticated server.Even if I wind up using certificates to authenticate the ...
1
vote
0answers
94 views

Different certificate issuers on same site based on browser

When I try to access some web site on firefox I get this: The cut out rectangle is COMPANY-NAME-ROOT-CA and that issuer (COMPANY-NAME-ROOT-CA) was also added as trusted on some peoples PC. But when I ...
1
vote
1answer
69 views

Does it matter that my browser shows an out-of-date certificate when a website uses service workers?

A website I frequent (a Discourse forum) uses Let's Encrypt TLS certificates which are updated every two months with a valid period of three months. But the certificate information shown by Chrome ...
0
votes
2answers
74 views

Do we need to disable the SSL verification while developing a web scrapping application in Java?

I am writing a web scrapping application using core Java. However when the application tried to access some https enabled URLs I am getting error. Below are the details. Code: url = new URL(...
1
vote
1answer
73 views

Are FaceID/passcode logins secure over public WiFi/hotspots?

Unfortunately, I find myself serving a 14d COVID-19 self-isolation period in a hotel which only offers unsecured public WiFi. This has me wondering if all the financial apps on my iPhone with FaceID-...
0
votes
1answer
63 views

Arp poisoning doesn’t work with HTTPS navigation

I’m trying to do an ARP poisoning attack in my LAN. I use Ettercap and I place my attacker computer between my routers and target Windows computer. Despite the target ARP table changing, when I use ...
0
votes
0answers
37 views

Is it safe to embed a google form on a website without an SSL Certificate?

I designed a Google Form for a website which does not have an SSL Certificate. I have planned to embed it onto a page using an iframe tag. I am currently testing it and have published a test page with ...
3
votes
1answer
201 views

Is there a security vulnerability in setting a public DNS entry to a private IP Address?

I recently set up a wireguard server-network configuration with a home server and client devices. I have one main domain that I hope to route everything through via subdomains (in this example, abc....
-1
votes
1answer
60 views

CDN end to end encryption?

I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did. Now I'm able to ...
0
votes
3answers
98 views

Is http to https port forwarding a vulnerability? [duplicate]

I work in an organisation where a TMG server with port forwarding has been used successfully for a number of years to forward all http traffic to https for a particular web application. This meant ...
1
vote
0answers
67 views

Detecting a web based MITM attack?

I've been looking into ways to detect a Man In the Middle attack, when the client has "duped" into trusting third party CA. Examples of this are, anti-virus applications and corporate ...
2
votes
0answers
107 views

Why don't CAs advertize public keys of verified entities on a central location instead of giving out signed certificates?

If CAs (Certification Authorities) start advertizing public keys of verified websites via some API, browsers can simply query them for each domain instead of asking websites to give them certificates ...
2
votes
1answer
102 views

How do clients extract the public key from a self-signed certificate?

I have gone over: Why do we need to sign the self-signed certificate? Basic self-signed certificate questions Is a self-signed SSL certificate much better than nothing? I am new to cryptography and ...
0
votes
0answers
21 views

authenication of client in one way ssl [duplicate]

In below ssl diagram : I have one doubt with 1-way ssl. If there is an interceptor in-between client and server who can alter in following way : In step 8, when client is sending his symetric key to ...
0
votes
0answers
24 views

IIS CMS access web service

We are creating a new web site and it’s using a CMS that will connect to a internal web service that will connect to a sql database. The cms will be in the DMZ and the web service will be in the ...
0
votes
1answer
65 views

LDAP StartTLS encryption - which TLS versions are supported?

I am looking to set a third party application to authenticate with our domain. The application supports LDAPv3 and we have opted to use the start StartTLS extension to encrypt the credentials from the ...
-2
votes
1answer
69 views

What happens if no CertificateVerify is sent in TLS?

I know in TLS, the client would send a CertificateVerify message for the server to confirm the client's identity through means such as CA but what if the client never sent this information? Is it ...
3
votes
2answers
230 views

Does the CA create the public key or is it created by the requesting server and sent to the CA?

This link says that the requesting server creates the public-private key pair and sends the public key to the CA inside the CSR. However, DigiCert says: The CSR is submitted to a Certificate ...
1
vote
0answers
46 views

Where does Shodan document fields that I can search by? [closed]

where do I find information on all the fields that I can use shodan to search by? For example I can find a specific ssl vendor's certificates with ssl.cert.issuer.CN=asdf but what other fields can I ...
2
votes
1answer
55 views

Why is my RADIUS Certificate not automatically signed with the root CA Certificate on my iPhone

I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method. I have used this old tutorial for setting up my own CA and generating the certificates and ...
1
vote
1answer
65 views

Can TLS defeat the manipulation of TCP sequence numbers?

Assuming there is a powerful adversary who can arbitrarily manipulate the sequence number of each tcp packet, then the following packet-reorder attack should be possible, right? Assuming the packet ...
1
vote
1answer
46 views

When does it make sense to deploy an embedded firewall on my IoT device?

I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
0
votes
1answer
54 views

How to guarantee only my client application can request a nonce?

I have a web site and a service in a server. I'm developing the "Register User" and "Login" components. I've searched on the internet and I've found two protocols to login user ...
-2
votes
2answers
91 views

SSL Cert for client side web application, is it needed?

For client-side web applications that run in your machine (that you download at first visit - Blazor WebAssembly to be specific): Do I need to enable SSL (HTTPS) for this application or web server ...
1
vote
2answers
94 views

Burp Proxy vs MITM

I have recently started using Burp as a proxy for hunting bugs on websites and I see many submissions where people have intercepted and modified requests/responses to exploit certain logic flaws in ...
0
votes
1answer
150 views

Error Loading extension 'copy_extensions' in Openssl

While running the following command on Ubuntu 19.10, with OpenSSl 1.1.1c 28 May 2019: openssl req -config ${CNF_FILE} -key ${PRIVATE_FILE} -new -x509 -days 10950 -sha384 -extensions v3_ca -out ${...
1
vote
2answers
41 views

Solution to User Initial HTTP Requests Unencrypted Despite HTTPS Redirection?

It is my understanding that requests from a client browser to a webserver will initially follow the specified protocol e.g, HTTPS, and default to HTTP if not specified (Firefox Tested). On the server ...
0
votes
1answer
57 views

Where are field names of decoded human readable X.509 certificates specified?

The ASN.1 module for X.509 certificates as specified in RFC 5912 - Section 14 is as follows: TBSCertificate ::= SEQUENCE { version [0] Version DEFAULT v1, serialNumber ...
10
votes
7answers
4k views

Are URL parameters of GET and POST requests over HTTPS secure?

It's well known that GET requests with ?xx=yy arguments embedded can be altered in transit, and therefore are insecure. If I change the request to POST, and use HTTPS, then the parameters are in the ...
3
votes
4answers
201 views

Passing plain text password over HTTPS

My login for POST is over HTTPS. Therefore, I don't do anything to the provided password before submitting. And I don't see an issue there unless someone is watching your browser's developer console. (...
0
votes
1answer
85 views

Is it possible to search HTTPS messages using homomorphic encryption?

We're trying to build a packet sniffer that can search and quarantine malware in encrypted transactions without decrypting said transactions. At present, we're exploring whether homomorphic encryption ...
0
votes
0answers
37 views

Bettercap TLS handshake phase information

I wanted to know if bettercap has a feature that allows to view TLS handshake phase information (as Wireshark does), for example the "Client Hello" ?
1
vote
2answers
79 views

Does HTTPS protect mobile internet connections against “network injection”?

The Star recently published an article describing an alleged attack against a Moroccan journalist. The article describes the attack as such: Forensic evidence gathered by Amnesty International on ...
2
votes
2answers
79 views

Why would one disable a new TLS version by default?

I saw today that TLS 1.1 and 1.2 are not enabled by default in Windows 7 and Windows Server 2008. They can be enabled after an optional update, and after setting a registry key. Why? Negotiating the ...
0
votes
2answers
77 views

Can SSL certificate (domain verification) process be eliminated?

Noob question alert. I understand SSL certificates help mitigate MITM attacks, but I see the process to be so badly designed. Basically the client needs to verify that it is talking to the particular ...
0
votes
0answers
39 views

need to address a subset of CIA triad elements and not in entirety

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. ...
1
vote
2answers
717 views

How to interpret security impact of “Server Signature Algorithms” (sslscan)

I'm looking at the results of an sslscan of an internal web application, which reports the following: I'm not sure how to interpret these and couldn't find an elaboration of what exactly this ...
2
votes
2answers
76 views

Preventing HTTPS Replay Attacks

I've read here that HTTPS replay attacks aren't possible from MITM attacks but I want to be sure that it's not saying that HTTPS replay attacks aren't possible at all. I want to know if I have to ...
0
votes
2answers
177 views

Where to put SAN

Where SAN means: Subject Alternative Name. I feel I have a basic misunderstanding in which certificate the SAN stuff shall go: ca or server or both or what? It might be 3 Years or more in the past, ...
1
vote
1answer
52 views

What are the logical steps taken to perform ssh key authentication?

I understand the logical steps of asymmetric key cryptography as it relates to TLS, however, I've started using Git and in a bid to avoid having to use a password for authentication, I've set up ssh ...
1
vote
2answers
160 views

When/why should the “mark this key as exportable” option be selected when importing a certificate?

When a certificate is being imported on Windows, at some point the following option is available: [] mark this key as exportable I understand that this is used in case the certificate needs to be ...
1
vote
1answer
47 views

Is it possible that a single handshake can have 2 TLS versions included?

I am seeing different TLS versions (1.3 and 1.2) in the handshake and intermittently it fails with this error: TLSv1.3 (OUT), TLS handshake, Client hello (1):. 2020-05-28T14:44:00Z.664 [thread-...