ארכיון תג: ssl

Cryptosmith Video Collection #1 על ידי #15

על ידי | אוקטובר 28, 2017

I have posted thefifteenth video within the Cryptosmith Serieson sensible fundamental cryptography. The video assortment falls into three elements: the network crypto introduction, the DVD example, and the public-key certificates discussion. There are additionally updates to different collection movies. Theynow use the acronym SSL much more, since individuals acknowledge it extra usually than TLS. The… קרא עוד »

Tiptoeing By Means Of Vulnerabilities

על ידי | אוקטובר 28, 2017

I sympathize with builders who throw up their palms and say, I dont do safety stuff. It does not matter what you select, theres a commerce off that would go mistaken. Its particularly troublesome if one deploys a safety web site. Ive deployed safety schooling web sites in lots of environments over the previous 20… קרא עוד »

TLS יירוט חשבתי מסוכן – וידאו ושקופיות

על ידי | אוקטובר 9, 2017

על האחרונה כאוס תקשורת מחנה החזקתי צ ' אט המסכם את הבעיות עם TLS יירוט או Man-in-באמצע פרוקסי. זה היה בתחילה מונע על-ידי occurence של Superfish שלי מאוד משלו חקירות על Privdog, עם זאת גיליתי לפני עכשיו חודש, זה יכול להיות הרבה יותר חיסרון. I used to be stunned… קרא עוד »

Superfish 2.0: Harmful Certificates on Dell Laptops Breaks Encrypted HTTPS Connections

על ידי | אוקטובר 5, 2017

tl;dr Dell laptops come preinstalled with a root certificates and a corresponding personal key. That fully compromises the safety of encrypted HTTPS connections. I’ve supplied an online check, affected customers ought to delete the certificate. It appears that Dell hasn’t discovered something from the Superfish-scandal earlier this yr: Laptops from the corporate include a preinstalled… קרא עוד »

A Little POODLE Left in GnuTLS (old Versions)

על ידי | אוקטובר 5, 2017

tl;dr Older GnuTLS variations (2.x) fail to examine the primary byte of the padding in CBC modes. Numerous secure Linux distributions, together with Ubuntu LTS and Debian wheezy (oldstable) use this model. Present GnuTLS variations usually are not affected. A few days in the past an email on the ssllabs mailing list catched my consideration.… קרא עוד »

The Drawback with OCSP Stapling And Should Staple And Why Certificates Revocation Continues to Be Broken

על ידי | אוקטובר 5, 2017

Today the OCSP servers from Lets Encrypt have been offline for a while. This has precipitated way more hassle than it ought to have, as a outcome of in principle we’ve got all of the applied sciences out there to deal with such an incident. Nonetheless resulting from failures in how they’re carried out they… קרא עוד »

What Acquired Us Into the SHA1 Deprecation Mess?

על ידי | אוקטובר 5, 2017

Important notice: After I revealed this textual content Adam Langley pointed out that a main assumption is incorrect: Android 2.2 really has no issues with SHA256-signed certificates. I checked this myself and in an emulated Android 2.2 instance I used to be in a position to join with a website with a SHA256-signed certificates. I… קרא עוד »

How I Tricked Symantec with a Pretend Personal Key

על ידי | אוקטובר 5, 2017

Lately, some consideration was drawn to a widespread downside with TLS certificates. Many individuals are by accident publishing their personal keys. Typically they’re launched as a half of purposes, in Github repositories or with common filenames on net servers. If a personal key’s compromised, a certificates authority is obliged to revoke it. The Baseline Necessities… קרא עוד »