Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Hot answers tagged

5

So who decides what CAs are trusted? The browser and OS vendors do. Why cant a regular users CA become trusted? He can apply to be a public CA, but it is unlikely that the user is able to match all the security guarantees required by the browser/OS vendors for a publicly trusted CA. Even several commercial CA failed these requirements. But nothing ...


3

I feel that a technical answer is not really possible here, or would really be accepted (as that is dealt with in the linked answer), but something more esoteric, if not the direct answer to your question, will at least provide interesting reading for some and food for thought for others. Moxie Marlinspike has long held the belief that the CA trust model is ...


2

Put simply, the risk is that you won't have TLS between your TLS proxy and the end webserver. This sort of design is fairly common: plenty of services terminate TLS connections at a load balancer and run plain HTTP from there to the webserver. If you segment your network appropriately you can mitigate the risk posed by having the remainder of this link ...


2

Theoretically speaking, the answer is, of course, "It depends." Practically speaking however, for the client side the answer is "probably not" and the answer for the server side is "yes, with caveats." Client-side: This is the situation you're describing. You visit a site with your browser, explicitly specifying the HTTPS protocol, and are immediately ...


1

1) Is there any way that I as a client can establish if there is a MITM/attacker which is denying/redirecting HTTPS connection? (this cause is suggested by the "HTTPS Everywhere" plugin) Totally depend on site configuration: the redirect may be set only to frontpage or for all ressources. There's no generic answer to this question. Nevertheless, since HTTPS ...


1

I am going to answer this to my best of abilities.But feel free to tell me if i miss something or to add anything If someone has access to my computer , can they easily get my session id by going to the browsers developer tools and taking a photo of the session id with a phone, if the session id is passed in a cookie. eg. in a java web app , the ...


1

Yes it is possible, but only in certain cases. There are two general classes of Header Injection attacks that I am aware of: One is a Man-in-the-Middle (MITM) attack where someone is intercepting your traffic to inject header info. HTTPS connections protect against these. The second is a Cross-Site Script (XSS) attack. These are attacks against an ...


Only top voted, non community-wiki answers of a minimum length are eligible