Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
4,799
questions
4
votes
3answers
205 views
Is using encryption the only viable option to thwart password sniffing?
I'm using HTTPS Everywhere on my browser to chose SSL versions of websites when available, but many sites don't offer a secure version. Is SSL the only viable option to thwart password/clear text ...
2
votes
2answers
2k views
'SSL Session Resumption using Cached Session IDs'
Is supporting 'SSL Session Resumption using Cached Session IDs' by SSL Servers secure ? Is Session Hijacking possible in any way if this feature used ?
3
votes
1answer
151 views
Spurious SSL Certificates when accessing sites through enterprise network
I've noticed recently when I log on to sites like Hotmail that IE has been telling me there is something wrong with my SSL certs. When I examine the certs, the Issuer appears as "Blue Coat" from "...
88
votes
4answers
113k views
What is ECDHE-RSA?
What is the difference between ECDHE-RSA and DHE-RSA?
I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
11
votes
3answers
16k views
How do I check that I have a direct SSL connection to a website?
I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (...
7
votes
1answer
263 views
Does dnssec protect against malicious registrars?
With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).
This is especially ...
7
votes
4answers
2k views
What's the safest way to access my US-based bank's website from within Mexico? VPN vs SSH vs HTTPS?
I will soon be moving to Mexico and living there for an extended period. During that time I will need to occasionally access my US-based bank's website. I'll always be connecting using my own laptop, ...
4
votes
3answers
313 views
How (if at all) can an attacker manipulate an already established SSL/TLS Connection?
First off, this is a purely academic question. My first answer would be that he cannot since he does not have the session key.
Could he at least kill the connection, such as by sending spoofed FIN ...
1
vote
2answers
511 views
Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?
From a security point of view, is it okay to read foreign (untrusted) cookies (from 3rd parties on the Internet) on your internal (trusted) network, or should you only read them within the DMZ areas ...
34
votes
2answers
50k views
Advantages of client certificates for client authentication?
I'm no security expert, so please just ask in a comment if I haven't made my question clear enough for an answer.
The Scenario
We have a server running WCF services, and a number of clients ...
1
vote
4answers
393 views
Is e-mail sent from a Gmail address to another Gmail address encrypted?
Gmail provides an SSL connection and also encrypts the entire session by default. But if you send a mail, once it leaves gmails servers, it can be read at any point on the internet. But what about ...
3
votes
1answer
3k views
openSSL Not Displaying all attributes
Here's a background of what I've done so far:
I've been able to add a CRL to a self signed certificate using OpenSSL (see attached). But I'm not sure how to create an X.509 certificate issued by this ...
19
votes
4answers
24k views
When is it appropriate to SSL Encrypt Database connections?
Let's say I have a web server I setup, and then a database server.
However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right?
The only time to use ...
33
votes
1answer
42k views
What is the actual value of a certificate fingerprint?
In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
31
votes
5answers
55k views
How to fix SSL 2.0 and BEAST on IIS
As you can see on this post TeamMentor.net vulnerable to BEAST and SSL 2.0, now what? the app I'm currently development got flagged for SSL 2.0 and BEAST by SSL Labs.
I'm using IIS 7.0 with the ...
2
votes
4answers
2k views
HTTPS Everywhere vs. NoScript
What does HTTPEverywhere gives compared to NoScript with Firefox (Options|Advanced|HTTPS|Behavior)?
Why use HTTPEverywhere, when NoScript also can strict websites to use only HTTPS?
4
votes
2answers
197 views
Does site need SSL to resend info to a site that does use SSL?
Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
7
votes
4answers
4k views
Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?
I am developing a web app, which makes HTTP calls as long as the user is not logged in.
Once the user clicks the login button, he is sent to a "login page" that is HTTPS.
The login makes an Ajax call ...
14
votes
6answers
13k views
Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was:
CA with RSA keys capable of signing RSA and EC CSRs
CA with ...
1
vote
3answers
901 views
Monitoring and filtering of arbitrary outgoing data
I would like to be able to not just centrally monitor but also filter any organizational data moving out our edge routers, regardless of the sender application and regardless of the protocol/port used ...
5
votes
3answers
2k views
TLS Renegotiation Indication Extension vulnerability
I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
6
votes
2answers
4k views
Do you require a special type of certificate for using Diffie Hellman as the key exchange protocol in SSL?
In Diffie Hellman key exchange technique both the parties agree on a common parameter g then they generate their private parameters a and b . Then they exchange g^a and g^b. now they can calculate the ...
0
votes
3answers
260 views
Is HTTPS necessary for password change if user has already logged in with HTTPS?
I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION.
Is this really necessary?
2
votes
3answers
1k views
Downside of allowing uncertified Certificates
I've seen Firefox poping up the message "Untrusted Connection" where self signed certificates are involved.
However, I could not understand what the following means (in bold) :
XXXX.XXXX.XXXX:8443 ...
5
votes
1answer
3k views
how do extended validation X.509 certs work?
https://www.forumatic.com/ uses an extended validation cert. wikipedia.org's entry on extended validation certs says that a cert is known to be an extended validation cert if the OID in the ...
7
votes
3answers
17k views
What does these warnings mean on an SSL connection by firefox (only)
I am connecting to a secure site and firefox mentions about identity:
Owner: This website does not supply ownership information
Verified by: Not specified
Technical Details:
Connection ...
3
votes
2answers
1k views
Is SSL session based only? Is there a (formal) definition of an SSL connection?
In various docs on SSL there is a mention of connection.
But from the context I am not sure if this means the underlying TCP connection or the SSL connection.
I am thinking that there is no SSL ...
2
votes
1answer
911 views
secret key compromise in SSL vs in Kerberos
Consider the consequences of compromise of a secret key in the Kerberos system vs. in SSL. For example, suppose your individual shared secret key (for your user account) becomes compromised (i.e. it ...
4
votes
1answer
4k views
URIs in the subjAltName X.509 extension
The subjAltTag extension for X.509 certificates can take in domain names, email addresses, URIs, etc. I was playing around with an X.509 whose subjAltTag had just a URI in it doesn't seem to work. ...
2
votes
3answers
5k views
Why different key exhange techniques for ssl key exchange?
During ssl key exchange, I have read that sending the symmetric key to the server encrypted with the server's public key is an old technique. Now for key echange Diffie hellman and other techniques ...
0
votes
2answers
934 views
SSL/TLS Protocol Description
It may seem crazy to you, but I wasn't able to find any detailed description of these security protocols on the web (except wikipedia).
Can you point me out some documentation of the protocols ...
2
votes
1answer
288 views
Browsers and export regs. Is SGC still valid?
I was reading a rather dated book on SSL/TLS, which mentions International Step Up certificates and Microsoft's Server Gated Certificates which were the way around the US export rules for economic ...
1
vote
1answer
664 views
How to use sslstrip with Internet Connection Sharing?
I'm trying to make sslstrip work with Internet Connection Sharing.ve shared internet connection to router and another pc connected to that router, all are Linux, so
Internet <-> pc1 <-> ...
5
votes
8answers
4k views
how can you view an HTTP request in transit?
In Google Chrome, sometimes you will see the https: protocol in the URL bar with a red strike through it. Clicking on the info button says that not all elements on the page are encrypted, and may be ...
27
votes
1answer
24k views
My understanding of how HTTPS works (gmail for example)
I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting.
I will use Gmail as an example:
My laptop tries to connect to the Gmail server ...
10
votes
7answers
13k views
What is the danger of hosting your SSL certificate yourself?
I have Active Directory Certificate Services on my server, which makes it possible for me to deliver an SSL certificate for the websites hosted on the same server.
I know that normally, I need to ...
10
votes
3answers
9k views
Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection?
What i want to know is whether it is possible to connect to a proxy with an ssl (or otherwise encrypted) connection? (I'm suspecting this is possible because TOR encrypts user connections to it's ...
4
votes
1answer
2k views
exponent value in certificates
I have seen that in gmail, there are 3 certificates in hierarchy. I noticed that all the certificates have the same exponent(65537 with 24bits). Why is the exponent value same for all certificates and ...
14
votes
5answers
88k views
How safe is the 256-bit encryption used in bank transactions?
Most of the banks use a 128-bit or 256-bit encryption. What does this mean? Does it mean that the keys used in SSL are 128-bit long or what?
If they are the SSL key lengths then 128 bit RSA keys are ...
2
votes
1answer
872 views
Is there a way to identify the client using SSL Handshake Messages?
I have an SSL Server and it can be connected by two types of Clients, one for which Client Authentication is needed and the other for which Client Authentication is not needed.
Is there any mechanism ...
1
vote
2answers
477 views
Really secure webmail
If I'm feeling paranoid about the CCDP (UK) - requiring ISPs to intercept communications across the internet - then what would be the most secure approach to a webmail system?
Obviously, there's some ...
87
votes
5answers
37k views
Are all SSL Certificates equal?
After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against.
Are all SSL ...
3
votes
3answers
2k views
How safe is RSA generated public-private key pair?
If one has been using the same set of public-private key pair for quite sometime now, given his public key(which is public), can't an attacker find the corresponding private key for that public key by ...
7
votes
5answers
13k views
How commonly are SSL/TLS or S/MIME used by e-mail providers?
I was reading through different posts here about email security. After reading these I still have some questions.
I understand that S/MIME can be used to transfer email securely between servers.
Is ...
7
votes
2answers
4k views
Is DIGEST-MD5 secure if done over HTTPS?
If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?:
Digest access authentication is intended as a security ...
15
votes
3answers
4k views
Difference between Certificate Authorities
I've been wondering for a long time about is. There are many certificate authorities having different types of certificates. But even certificates of the same security level cost a lot more with one ...
19
votes
5answers
1k views
Is it alright to tell everyone your encryption information?
I have an account in an online banking system and they have the FAQ with something like this:
How secure is the <Online Banking System Name>?
Each page you view and any information ...
3
votes
3answers
3k views
Reply to SSL Handshake Request with a 302 Response
Is it possible to respond to an SSL Handshake request by sending back a http 302 redirect without making the browser mad?
I would like to immediately redirect to a different site upon receiving the ...
4
votes
1answer
1k views
SSL protocol issues on OS X and iOS
I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message:
(...
2
votes
2answers
3k views
What if a browser does not understand the secure flag of a cookie?
I have two related questions:
As HttpOnly attribute is understood by a set of modern browsers, I was wondering if there is a list of all browsers which support the secure flag of the cookie?
What ...
