Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
65
votes
4answers
372k views

How to determine if a browser is using an SSL or TLS connection?

I want to know whether my browser is using SSL or TLS connection if I see HTTPS. I want to know for IE, Firefox, Chrome and Safari. I want to know the protocol version.
3
votes
3answers
669 views

What is the actual security of this login page?

Please visit https://devforums.apple.com If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show. Does this ...
44
votes
5answers
21k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
8
votes
3answers
662 views

How secure is HTTPS with weak ciphersuites?

Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
58
votes
4answers
16k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
4
votes
1answer
207 views

How does my antivirus determine which CTL is used?

I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
140
votes
14answers
46k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
14
votes
4answers
11k views

HTTP Basic auth password storage more secure than Digest auth

If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
10
votes
2answers
10k views

Securing a REST API: is api_secret signing and ssl enough?

for securing a RESTful API I thought of the following authentication procedure for each call: All data is SSL-encrypted Every HTTP request made by the client will have a signature such as sha512(...
12
votes
2answers
9k views

Is BEAST really fixed in all modern browsers?

BEAST is said to be fixed in all modern browsers: Chrome and Firefox IE in Jan 2012 Opera in Dec 2011. It's also fixed in OpenSSL since 2002. Do these fixes mean that it's safe to use ciphers in ...
4
votes
1answer
614 views

Client-side cross-site access in SSL environment - when it's still possible to do?

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
3
votes
1answer
691 views

Are SSL Certificates (Private and Public key) generated by OpenSSL and makecert compatible?

Are RSA SSL Certificates (Private and Public key) generated by makecert compatible with OpenSSL decryption ie. can I decrypt them with the openssl_* methods? I am working on two-way SSL authentication ...
12
votes
2answers
2k views

What kind of certificate do I need to be able to sign my own subdomain certificates?

We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...). ...
1
vote
1answer
890 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
8
votes
3answers
514 views

Denial of Service on SSL services

When the SSL handshake takes place, is there a point where the computational work done by the client is significantly less than the computational work done by the server? Could such an imbalance be ...
7
votes
1answer
5k views

Any reason not to use same key for multiple SSL domains on one server?

Assume I've generated a server key for use by Apache for SSL. The server will be handling several different domains that use SSL via unique IPs (no SNI). I want to generate a CSR for each domain from ...
3
votes
2answers
3k views

Java Applet for mutual authentication with smart card

I need to develop a java applet, for a mutual authentication between Tomcat 6 (server) and a SmartCard "IDGo 300" (client). In order to do this I thought the following scheme: Tomcat (server) send ...
3
votes
8answers
2k views

Explain SSL advantages for e-commerce to layperson?

I need to explain why having a SSL certificate is a good investment for an e-commerce. How do I do this when the other person is a intelligent business owner but not that tech smart?
-1
votes
1answer
522 views

MITM Attacks over SSL [duplicate]

Possible Duplicate: How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption? If I have a server (call it server 1) set up to receive POST data ...
4
votes
4answers
1k views

Should i use SSL for local access?

I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip). Should i use SSL for the communications between the sites and the service, or would that ...
3
votes
1answer
510 views

Loginless Client/Server Architecture (iOS)

I'm currently in the phase of planing a project involving loginless service. Users would be identified by an unique device id created on the client (ios). What are the security concerns? sockets ...
26
votes
5answers
44k views

How are Chrome and Firefox validating SSL Certificates?

How are Chrome and Firefox validating SSL Certificates? Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?
14
votes
3answers
377 views

Domain name expiration and TLS

If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
1
vote
2answers
945 views

MITM session injection/invalidation

When sending a cookie back to the server, the browser does not send back the "secure" flag: the server cannot check whether the sent cookie really come from the "secure" origin (https://example.com). ...
21
votes
4answers
9k views

Can an intermediate CA be trusted like a self-signed root CA?

Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
3
votes
1answer
2k views

Citation Needed for FIPS Anecdote Regarding MD5 and RC4

I've heard it mentioned many times by colleagues and other information security professionals that it is a violation of Federal Information Processing Standards (FIPS) regulations for an internet-...
13
votes
5answers
5k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it pose a threat even if the person is using a secure application layer protocol? What I mean by ...
2
votes
4answers
352 views

What are some common misconceptions about SSL/TLS that members of the general public hold?

Particularly ones that are, to some extent, the result of advice given by companies who utilise it, e.g. banks, e-commerce sites etc.
1
vote
1answer
3k views

HTTPS and cache injection

I understand the downside of this attack and what wrong can be done. But I dont understand how is it done ? Well, I need to educate myself, any pointers would be useful.
28
votes
2answers
11k views

HSTS extra security over HTTPS

Is HSTS good to use even if my servers are configured to use HTTPS (when HTTP is used, the rewrite rules in Apache turns it into HTTPS)? Also should HSTS be used even on resources like CSS and images,...
5
votes
1answer
453 views

SSL CipherSuite Choices

In SSL/TLS, is the CipherSuite chosen by the server or the client? Also, can the certificate in any way dictate or modify the CipherSuite?
-5
votes
4answers
767 views

Is TLS-in-TLS supported in any software? Does it make sense? [closed]

I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
3
votes
0answers
565 views

How secure is HTTP basic authentication over SSL? [duplicate]

Possible Duplicate: Is BASIC-Auth secure if done over HTTPS? I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
18
votes
5answers
4k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
24
votes
3answers
18k views

Is there a way to mitigate BEAST without disabling AES completely?

It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like ...
3
votes
1answer
1k views

SSL Inspection - how should it be done?

I've seen several questions that deals with SSL Inspection, none of them really carried a detailed response on the secure way of doing so. The reason I'm asking is because of this: Cyberoam fixes ssl ...
-1
votes
2answers
118 views

What happens when and attacker changes the installed public keys in browser

I was reading about SSL. I understood that each browser comes with a predefined set of known public keys,which is then used to authenticate the messages. I was wondering what will happen when a virus ...
11
votes
2answers
2k views

How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?

http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data http://rt.com/news/uk-privacy-internet-freedom-186/ 'Black boxes' will be installed by internet services providers ...
1
vote
2answers
2k views

How to secure the connection between the proxy and application

I have designed a framework for my application where I have a proxy to communicate with the outside world. The connection between proxy and the application is encrypted using SSL. But the connection ...
0
votes
1answer
1k views

Why do we need to use HTTP CONNECT? [closed]

If we are writing a custom http client which connects with an https server. Should the custom client when deployed on machines which are behind web proxy need to send a HTTP CONNECT Request so as to ...
2
votes
1answer
5k views

SSL cert not turning green anymore

I'm running a Drupal site and have asked about this issue pertaining specifically to the Drupal aspect of it on Drupal Answers Stack Exchange. I know that the "Green" HTTPS URL doesn't show up because ...
11
votes
2answers
15k views

Internal SSL Certificates?

As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
2
votes
1answer
9k views

How do I use OpenSSL with the Java Keytool?

I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
0
votes
2answers
1k views

How to safely collect bank account from website?

I want to collect bank account information from my customers on my website. I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or ...
10
votes
1answer
705 views

Why can the validity of an SSL certificate exceed the registration period of a domain?

I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
3
votes
2answers
3k views

Do most browsers handle mixed encrypted and unencrypted content correctly?

In Google Chrome, when I go to an encrypted page that contains unencrypted content, I get the following pop-down, which allows me to either load or not load the insecure content, making a clear ...
19
votes
2answers
16k views

What can an attacker do with a stolen SSL private key? What should the web admin do?

What can an attacker do with a stolen website certificate and key? What should the website admin do upon learning this?
2
votes
1answer
77 views

Does SGC Support reduce HTTPS security?

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption. This article says SGC should never be ...
2
votes
1answer
3k views

What is the industry standard approach to disable weak ciphers to mitigate vulnerabilities?

Particularly this question is focused for Windows Server 2008 R2. I know the registry can be used to modify particular entries to disable weak ciphers if they are known. I saw this tool: http://www....
2
votes
1answer
5k views

What are the consequences of disabling ssl v2 and weak ciphers?

It is my understanding that IIS has ssl v2 enabled by default. Also, TLS 1.0, if enabled, allows for at least one known major vulnerability titled "beast attack". If the weak and vulnerable ciphers ...

1
90 91
92
93 94
99