Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
2
votes
3answers
818 views

What security protocols provide point-to-point confidentiality?

Am I right in thinking that VPN doesn't protect until you're out onto the external network (assuming you're connecting from within an internal network)? Or does VPN provide confidentiality from the ...
0
votes
2answers
2k views

Protecting yourself against DNS spoofing?

Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot ...
2
votes
3answers
402 views

Help with SSL teaching material

I am taking a course on security next month. As the concepts of SSL/TSL are bit hard. I am looking for a nice way of presenting it to my students. They are Compsci undergrads. It would be nice to ...
5
votes
1answer
4k views

When will the webbrowsers have TLS 1.2 support? [closed]

https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.2_.28SSL_3.3.29 and http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ when will the webbrowsers have TLS 1.2 support?? ...
14
votes
5answers
6k views

Does HTTPS Everywhere defend me against sslsniff-like attacks?

http://www.thoughtcrime.org/software/sslsniff/ If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
13
votes
6answers
5k views

Is accessing bank account on the internet really secure?

Before I ask my question, I would like to make sure that I understand the settings correctly. So, the given: A client, using some web browser (firefox, for instance) - the Client The bank server - ...
5
votes
3answers
260 views

Proper way to obtain CA certs for verification

I want to securely connect to an API, but I'm not sure how I should obtain the CA cert for the verification step. I've seen some people get the certs using e.g.: openssl s_client -connect graph....
8
votes
1answer
6k views

Should I regenerate new SSL private key yearly? [duplicate]

Im' renewing my certificate every year. Since I have to make a CSR, should I also renew my key pair at the same time, or is it ok to get a new cert with the same key ? Please supply any security ...
4
votes
2answers
2k views

Secure Mobile Payments using HTTPS Web App

I'm hoping an expert with PCI compliance knowledge can help answer this question. We're looking at integrating mobile payments with our application which is HTML5-based for cross-platform reasons. ...
4
votes
6answers
298 views

Archive encrypted traffic, for later decryption attempts?

I am concerned about sending long-term sensitive information over SSL. Someone who does not have the private key could record SSL traffic (with WireShark, Fiddler or some such) and store it for ...
6
votes
1answer
1k views

How has TLS renegotiation been fixed?

I've read RFC 5746 on the TLS secure renegotiation extension. However, I don't understand how it fixes the problem. Client and server are required to include the verify_data from the previous ...
5
votes
2answers
874 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
3
votes
3answers
286 views

Best approach for making an app that connects to sensitive information

I'm gonna be writing an app that connects to a server with sensitive information and one of the main requirements is that only my app will be able to make the connection. There is no user supplied ...
8
votes
1answer
333 views

Why are website certificates secure?

I understand how HTTPS connections work, and I also understand they they require a certificate to know that the secure connection you have is with the right server (and not someone pretending to be ...
4
votes
1answer
604 views

Security for a low latency online multiplayer game

I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
7
votes
4answers
3k views

How to roll my own security mechanism - avoid SSL

I'm looking at implementing my own security mechanism rather than using SSL due to SSL being 'hopelessly broken' and also because it is an interesting exercise :) This is for a client-server internet ...
5
votes
2answers
769 views

System for Mutual authenticaion and confidentiality

I am looking for a protocol where there needs to be mutual authentication between client and server. For example server should connect to a particular client only. That is client should authenticate ...
3
votes
3answers
2k views

HTTPS Apache2 Information Leakage

Hello IT Security! I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com. I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com. ...
2
votes
2answers
3k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
62
votes
7answers
60k views

Trying to make a Django-based site use HTTPS-only, not sure if it's secure?

The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
10
votes
2answers
12k views

openssl verify signature

For S/MIME, I now know I can verify PKCS#7 detached signatures with: openssl smime -verify -in detachedsign.pem -content content.txt But what about non-MIME messages? So if I sign the message Hello, ...
7
votes
9answers
9k views

What is the best way of securing a website logon without SSL or preshared keys?

Today I sniffed some unencrypted wlan traffic during class and I found quite a few passwords by a simple search for "pass" and "user" in wireshark. Turns out about half the sites we use for school don'...
14
votes
5answers
21k views

Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP

The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well. In addition there are a ...
1
vote
3answers
8k views

Facebook login on HTTP? [duplicate]

Possible Duplicate: Is the Facebook login form using SSL without https in the URL? If you access http://www.facebook.com/, in the top right side there is the login section. You can enter your ...
20
votes
7answers
14k views

How do I check if a gmail/gtalk SSL certificate is valid?

Pidgin started prompting me to accept/reject new gtalk SSL certificate a few days ago and I am not able at the moment to tunnel the traffic to check if it would continue to happen or if it wouldn't (...
9
votes
2answers
491 views

Why is there no Domain CA?

I was asked to deliver a signed SSL certificate for an IIS server for a client. I have previously done this for the same client/domain before, so it start to seem like an unnecessary expense to hold ...
104
votes
9answers
56k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
2
votes
7answers
762 views

How can http data be compromised on a secure network?

I understand that it is bad to send passwords in plain text over the wire because somebody can look at it and clearly steal your information, and that the solution is to use HTTPS because the ...
32
votes
4answers
21k views

Which SSL/TLS ciphers can be considered secure?

The OpenSSL website provides a long list of different ciphers available for SSL and TLS. My question is, which of those ciphers can be considered secure nowadays. I am especially interested in HTTPS, ...
1
vote
2answers
928 views

Are there any strange things with google.com over HTTPS?

So I'm always browsing the web through Privoxy using minimum these rules: vi /etc/privoxy/user.action { +redirect{s@http://@https://@} } .chrome.google.com .code.google.com .docs.google.com ....
4
votes
1answer
10k views

SSL certificate fails to adhere to basic constraints and PCI compliance

We have an SSL cert from GoDaddy and tried to run a PCI compliance check using McAfee's scan. The one problem they found was that the basic constraints / path length is not configured. Here's what ...
8
votes
1answer
788 views

Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?

I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages. ...
9
votes
2answers
4k views

How to defend against SSL-Exhaustion attacks?

The problem of SSL-Exhaustion attacks is well known for years, but nobody really cared until THC released their exploit-tool recently. THC talks about counter measurements in their release: No real ...
36
votes
4answers
58k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
7
votes
1answer
421 views

What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see the July 2010 draft

I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status Where can I find the most current guidance on STS in DNS? If ...
6
votes
3answers
480 views

Are SSL certificates from a CA necessary for secure communication?

Am I right in thinking that SSL certificates from a CA are purely for identification purposes and serve no purpose in the actual encryption of data? In other words if I were to create a self signed ...
29
votes
1answer
40k views

What key exchange mechanism should be used in TLS?

There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
15
votes
3answers
2k views

Can I expect my e-mail to be routed securely?

If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
44
votes
4answers
32k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
6
votes
3answers
4k views

How and when should I use OpenSSL for IT Security? How do I understand the output?

I'm discovering OpenSSL, and already used it to diagnose a faulty SMTP TLS connection, but I'd like to get a better / full understanding of the tool and how to use it. What resources should I use ...
26
votes
3answers
2k views

Why was the BEAST attack previously considered implausible?

Can someone explain why the BEAST attack wasn't considered plausible? I saw an article quoting the creator as saying 'It is worth noting that the vulnerability that BEAST exploits has been presented ...
182
votes
7answers
162k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
56
votes
2answers
48k views

What are the risks of self signing a certificate for SSL

Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
3
votes
2answers
1k views

Using AES with a hex key/iv, what mode of operation is the “most secure”

I realize that is a loaded question, but it is not an unreasonable one. given a hex key/iv, what mode of operation is most secure from offline attacks. I defaulted to aes-128-cbc. Partly because of ...
8
votes
4answers
2k views

Good resources for learning cryptography and OpenSSL? [closed]

I'm a programmer and I'm working on a Single Sign-on project using SAML. I want to do all I can to make this as secure as possible. Since making a secure Single Sign-on/SAML solution requires signing ...
16
votes
3answers
8k views

Is the Facebook login form using SSL without https in the URL?

If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
6
votes
2answers
9k views

Is it possible to decrypt a SSL/TLS session without doing a MITM-attack?

I'm not talking about decrypting the connection while the SSL/TLS is happening (MITM) but after the connection is closed and I have a pcap file of the entire negotiation/data transfer process. How ...
9
votes
2answers
7k views

How is tunnelling SSH through Proxytunnel/HTTPS different from doing it through SSL with Stunnel?

In an answer to What is the difference between SSL, TLS, and HTTPS, it's said that HTTPS is HTTP over SSL/TLS. That is, an SSL/TLS connection is established first, and then normal HTTP data is ...
20
votes
3answers
6k views

What are the risks of using a CDN to speed up my website? How do I avoid them? [duplicate]

Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN. What ...
9
votes
1answer
4k views

Email SSL security?

I use IMAP and I only access my email through SSL. However, the settings for encrypted email access seem a bit more complicated that https. Can someone explain the security implications of the ...