Tag Info

Hot answers tagged

76

Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is essentially a man-in-the-middle attack. It accomplishes this by decrypting and re-encrypting communications using Microsoft's own key. Such tampering, of course, does not go unnoticed. Firefox dutifully reports ...


50

This is only for websites that use Extended Validation SSL encryption. The name is the name the certificate is issued to. It is a security feature put in place to verify that the website is actually served by the company it claims to be from. Simply put, it works like this: Company X decides it wants to secure (e.g. by encryption) communications with the ...


46

From left to right: The schema https: is, obviously, interpreted by the browser. The domain name www.website.com is resolved to an IP address using DNS. Your ISP will see the DNS request for this domain, and the response. The path /data/abc.html is sent in the HTTP request. If you use HTTPS, it will be encrypted along with the rest of the HTTP request and ...


35

For local development testing a self-signed certificate is adequate. You can generate one with the OpenSSL kit like so: Generating the private key: openssl genrsa -des3 -out server.key 1024 output: Generating RSA private key, 1024 bit long modulus .........................................................++++++ ........++++++ e is 65537 (0x10001) Enter ...


29

Have you checked that the clock in your computer is set to the right date? Also, what sites? Maybe they actually are expired...


22

The entire URL will be encrypted. When the web browser connects to the server, it connects to the appropriate IP address, starts encryption, and then sends the request (hostname, URL, parameters, form contents, etc.). Note that the DNS lookup will not be encrypted, so anyone looking at your traffic can tell that you looked the domain up, even if they can't ...


20

You can avoid the message for trusted sites by installing the certificate. This can be done by clicking on the warning icon in the address bar, then click "Certificate Information" -> Details Tab -> Copy to file Save the certificate, then double click on the certificate file. On the certificate window that opens, click install certificate, then walk ...


17

That's a result of using an Extended Validation certificate - extended validation, or EV certificates require additional validation before the certificate is issued. The idea is that there is better proof that the company really is applying for the certificate, so you should be able to have some more confidence that you really are talking to who you think ...


16

The answear to your question(Can you get a reply from a HTTPS site using the Ping command?) is Yes, you can, as long as ICMP replies are enabled on the HTTPs site provider. However, it have nothing to do with HTTP or HTTPS: Ping will use ICMP protocol, it belongs to TCP/IP Internet Layer, which is a lower layer than HTTP or HTTPs(from Application Layer): ...


15

It's plain HTTP because all Microsoft software is digitally signed anyway; the signature is embedded in the .exe file and verified by Windows on launch. (I seem to remember that this is a requirement for all files posted in their Download Center.) Unlike HTTPS, signing the actual download also means you can check the signature everywhere (such as copied ...


14

For Chrome on OSX, here's a relatively easy way to add the self-signed certificate to the system's Keychain, which is used by Chrome: Google Chrome, Mac OS X and Self-Signed SSL Certificates. No more annoying red warning screen! (I do wish Chromium would simplify adding the exception though.)


13

Yes, it is a different level of certificate, as you say. It's green when it is an Extended Validation Certificate. See Extended Validation Certificate at Wikipedia: "[...] a special type of X.509 certificate which requires more extensive investigation of the requesting entity[2] by the Certificate Authority before being issued. [...]" The cheapest of ...


12

They're just being careful. If the server sets the correct headers to make sure nothing is cached client-side it should be fine. Since the bank can't control if the browser acts like it's supposed to they ask you to make sure. Note that the Cache-Control: no-cache header is not intended for what you think it is. It is designed to tell the browser to ...


12

Be sure that the date of your computer is accurate. A dead CMOS battery might reset the date to the early 2000 every time the computer boots which will prevent a certificate from being valid, since they have an expiration date and a validity date.


12

Export the certificate from Chrome, and then import the certificate into your trusted root certification authority store. Unfortunately Microsoft made this difficult to do. Go to Start | and run the command certmgr.msc. Expand the tree to get to Trusted Root Certification Authorities | Certificates. Go to All Tasks, choose Import and import the certificate ...


12

The ISP will only know you visited the IP address associated with www.website.com (and maybe the URL if you are using their DNS and they are specifically looking for the traffic – if the DNS query does not go through that they won't see that). (Bear with me a bit here – I do get to the answer.) The way the HTTP protocol works is by connecting to a port ...


11

You must inform the ciphers in hex based in RFC 2246 (http://www.ietf.org/rfc/rfc2246.txt). The correct command line is: chrome --cipher-suite-blacklist=0x0004,0x0005,0xc011 No spaces between comma.


10

Go to %programfiles%\Mozilla Firefox\searchplugins Open google.xml Replace any https://... By http://... Do not forget to log out your Google account. If you are logged in, you will be redirected to the SSL protocol.


10

Follow the instructions linked here: http://stackoverflow.com/questions/681695/what-do-i-need-to-do-to-get-internet-explorer-8-to-accept-a-self-signed-certifica It's pretty much the same for IE9, except you have to press the Alt key on your keyboard to get the menu bar to pop up.


10

Beware that regarding KB SSL Enforcer, HTTPS Everywhere looks rather cautious. The front page states There is a Chrome extension called KB SSL Enforcer which attempts to take that approach, but it does not appear to be implemented securely; when we tested it, it seemed to always use http before https, which means that your surfing habits and ...


9

Instructions for Linux (Chrome 12+): Certificate Information -> Details -> Export Save the certificate as a file of your choice. Preferences -> Under the hood -> Manage certificates -> Authorities Import the file and check all the boxes when it asks. You are done. It is very important to import under the Authorities tab, and not other!


9

It looks like you are missing an intermediate CA (Certificate Authority). Certificates are only trusted because they are signed by a trusted certificate authority (the issuer), which is in turn signed by another trusted CA, up to those listed as explicitly trusted by whatever is verifying them (a root CA). Browsers (and OSes) come with a list of root CAs. ...


8

Look in to KB SSL Enforcer http://goo.gl/8xeB and see if that will do what you are looking for. I have not tried it but it seems to do the same thing. Secure Login Helper http://goo.gl/5f8R also seems to do this but only to login sites, not everything.


8

The entire HTTP request is encrypted. This is why having more than one SSL site per IP address is troublesome.


8

Before answering: If a browser warns you a site is using poor encryption or supplying incorrect identity information, it's important to read the error, understand it, and think hard about whether you want to continue. Short Answer: Yes. Long Answer: If someone in monitoring your connection from another computer (somewhere between you and your bank) and ...


8

wget has a --post-file option which should work for you. Edit: Also, there's Ncat, which you would use in a similar fashion to Randolf Richardson's telnet suggestion, except that it also supports SSL/HTTPS: ncat -C --ssl www.example.com 443 < input.txt > output.txt


8

ping works at a much lower level than HTTP or HTTPS, and only accepts hostnames, not URLs. For example: ping www.google.com


8

However, to the best of my knowledge, when it comes to mail-server-to-mail-server communications, most emails are still transferred in plain text and not encrypted, making it possible to anybody on the network to read their content. Correct. SMTP, like HTTP, is plain-text by default. These days many mail servers support TLS (previously known as SSL) ...



Only top voted, non community-wiki answers of a minimum length are eligible