Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

HTTPS (HTTP over SSL or HTTP Secure) is the use of Secure Socket Layer (SSL) or Transport Layer Security (TLS) as a sublayer under regular HTTP application layering. HTTPS encrypts and decrypts user page requests as well as the pages that are returned by the Web server.

HTTPS and SSL support the use of X.509 digital certificates from the server so that, if necessary, a user can authenticate the sender. Unless a different port is specified, HTTPS uses port 443 unlike HTTP which uses port 80 in its interactions with the lower layer, TCP/IP.

The effectiveness of HTTPS can be limited by poor implementation of browser or server software or a lack of support for some algorithms. Furthermore, although HTTPS secures data as it travels between the server and the client, once the data is decrypted at its destination, it is only as secure as the host computer.

HTTPS is not to be confused with S-HTTP, a security-enhanced version of HTTP developed and proposed as a standard by EIT.

5923 questions
1300
votes
3 answers

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. How the key exchange works. How authenticity,…
Polynomial
  • 136,575
  • 45
  • 316
  • 389
589
votes
3 answers

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
jrdioko
  • 13,301
  • 7
  • 33
  • 40
457
votes
9 answers

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
Morten
  • 4,723
  • 3
  • 18
  • 7
424
votes
14 answers

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little confused as to how this could be possible. Sure,…
Joshua Carmody
  • 4,555
  • 4
  • 19
  • 11
373
votes
6 answers

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate pinning?
Son of the Wai-Pan
  • 3,855
  • 3
  • 14
  • 5
313
votes
3 answers

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor , what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
Kyle Rosendo
  • 4,065
  • 4
  • 22
  • 18
250
votes
4 answers

SSL3 "POODLE" Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What is the POODLE vulnerability? I use [ product / browser…
tylerl
  • 84,075
  • 27
  • 158
  • 236
244
votes
5 answers

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com ) and the ordinary HTTPS Google search (at https://google.com )? In terms of security what were the benefits of browsing through encrypted Google search?…
BlueBerry - Vignesh4303
  • 5,165
  • 13
  • 41
  • 66
243
votes
14 answers

My college is forcing me to install their SSL certificate. How to protect my privacy?

My college administration is forcing us to install Cyberoam Firewall SSL certificate so that they can view all the encrypted traffic to "improve our security". If I don't install the certificate than I won't be able to use their network. What are…
svetaketu
  • 2,151
  • 2
  • 13
  • 5
240
votes
8 answers

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
Am1rr3zA
  • 3,153
  • 4
  • 21
  • 14
222
votes
7 answers

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the certificate which A previously got from W? If G can get the…
jojo
  • 2,331
  • 3
  • 14
  • 4
204
votes
7 answers

How do mobile carriers know video resolution over HTTPS connections?

Verizon is modifying their "unlimited" data plans. Customers in the USA can stream video at 480p -or- pay to unlock higher resolutions (both 720p and +1080p). They are not the only mobile carrier to implement rules like this . If I am on a site that…
raithyn
  • 1,853
  • 2
  • 11
  • 10
180
votes
10 answers

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few: https://superuser.com/questions/791015/https-over-private-network https://stackoverflow.com/questions/616055/https-certificate-for-internal-use…
alficles
  • 1,901
  • 2
  • 12
  • 4
176
votes
13 answers

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a password hash client-side (using JavaScript) and…
johndodo
  • 1,995
  • 2
  • 13
  • 9
174
votes
4 answers

Difference between .pfx and .cert certificates

What is the difference between .pfx and .cert certificate files? Do we distribute .pfx or .cert for client authentication?
Xsecure123
  • 1,863
  • 2
  • 12
  • 8
1
2 3
…
99 100