We’re rewarding the question askers & reputations are being recalculated! Read more.
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 2568

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

3
votes
Without SSL, users' data is transmitted over the wire unencrypted. Is that an acceptable risk? Everyone here is using a discussion forum that does not use SSL (and SE is not unique in this regard; …
answered Mar 7 '13 by dr jimbob
3
votes
Will transport layer encryption (SSL/TLS/https) prevent you from Big Data Analytics? Depends. Does the server at the other end use your data for big data analytics? If they don't, you are … analytics on the information you gave them. TLS (and SSL is just an old version of that; and HTTPS is just HTTP + SSL/TLS) just limits network eavesdroppers to only know when, whom (IP address), and …
answered Sep 28 '12 by dr jimbob
6
votes
This is standard practice. Its been said that best practice is to not share certs between servers, so you'll see different certificates from servers in different locations. From Verisign: Can I s …
answered Sep 6 '11 by dr jimbob
1
vote
There's a trade-off between ease of use and security. You'll need to make appropriate choices based both on how your users interact with your site and your threat assessment of what would happen if a …
answered Jun 29 '17 by dr jimbob
35
votes
I didn't see this mentioned in the other responses, but you generally should not put secret information (passwords) in GET requests even with SSL, but use POST instead. Why? The URL with the sensiti …
answered Mar 8 '12 by dr jimbob
10
votes
In google chrome, go to the https web page (say https://mail.google.com), click on the lock next to the URL, then click on "certificate information", click on the "Details" tab, and then find "Subject …
answered Jun 15 '12 by dr jimbob
2
votes
. If you connect to https://example.com it will make a HTTPS request to port 443. If you are try connecting to a port not running SSL/TLS with the HTTPS protocol you'll get a SSL connection error …
answered Oct 28 '15 by dr jimbob
15
votes
It's a bad design and the entire page should use HTTPS, as this trains users to the unsafe practice of trusting and submitting private information over HTTP. It would be trivial for a man-in-the-midd …
answered Aug 16 '16 by dr jimbob
0
votes
I would use HTTPS with certificates signed by a CA you create, if you don't want the cost/hassle of using a trusted CA. Then merely verify your keys against your own CA. For example see this guide …
answered Aug 26 '15 by dr jimbob
2
votes
Yes. See the RFC for TLS 1.2 (RFC5246) and note the MUST. Implementation note: Canvel et al. [CBCTIME] have demonstrated a timing attack on CBC padding based on the time required to compute …
answered Aug 8 '17 by dr jimbob
2
votes
When you connect to a server there are two types of encryption in play. First, there's a public-private keypair associated with asymmetric encryption that is used to validate your identity. Typica …
answered Nov 29 '18 by dr jimbob
1
vote
the hash. It's quite possible that these non-standard constructions leak information to very powerful attackers. To quote this paper (Differences between SSLv2, SSLv3, and TLS (PDF)): Ad hoc use …
answered May 7 '14 by dr jimbob
8
votes
to your chained SSL certificate. There are plenty of guides and tutorials out there; e.g., here's one for nginx. You will want to find a good selection of ciphers and SSL/TLS to allow. Mozilla …
answered Aug 9 '14 by dr jimbob
2
votes
It does check the DNS name matches the certificate, however it also validates if the domain name is in the alternative name field. If you download the SSL certificate for www.seedprod.com, you'll fin …
answered Jun 18 '17 by dr jimbob
3
votes
Sure. Requiring more authentication methods (also known as 2-factor authentication -- though typically the one of the factors is a randomly generated code sent to your email/phone) in principle makes …
answered Feb 15 '13 by dr jimbob

15 30 50 per page