Collaborate Disseminate
Right up front – I am aware of this question here.
But this is not about browsers, for now.
I checked the certificate with openssl, which tells me GTS Root R1 is the root ca.
Same result in Chrome and by utilizing openssl cli from my Windo… Continue reading Why can’t I find google’s Root CA in my trust store? [closed]
At 5:50 the video I Gave a Hacker 28 Days To Ruin My Life by Zac Alsop briefly describes a "pineapple" as a router masquerading as an AP of the office network. Once the victim devices are connected, they are serviced by a malicio… Continue reading Trying to understand an attack showcased in a viral YouTube video
Let say there is a client want to connect over https to a server. There is me, the attacker, in the middle between the client to the gateway.
The attacker (me) see that the client want to do TLS handshake (client hello) with some server.
N… Continue reading Stolen certificate attack in MITM attack [duplicate]
I’m writing my own networking layer for my video games startup and am using TCP for connection/authentication. I wanted to know how safe my authentication scheme was and what I could do to improve it.
Our apps aren’t web, and they run most… Continue reading What’s wrong with my app authentication scheme?
I would like to extract the session key, master key and premaster key in TLS connection. In my case nginx plays TLS termination. So I want to see those key in nginx side. Here is my nginx.conf
user nginx;
worker_processes 1;
env SSLKEYLO… Continue reading How to retrieve TLS shared key in SSLKEYLOGFILE?
I have a backend for a mobile application that has to serve large JSON responses from time to time, the transfer would be greatly helped by enabling compression, especially when the user has bad coverage.
Googling it seems like enabling co… Continue reading HTTPs compression, CSRF and mobile apps
Before any of you answer, "HTTPS is built on top of TLS and everything is encrypted"
I need to specify a very important note: I have FULL access to the client’s machine (Windows)
My requirement is that I need to capture HTTP(s) r… Continue reading How do I capture HTTPS requests with Python if I have full access to the user’s computer
when i check connection status with google services (gmail for instance) i see that connection is secure. Then I can check certificate details. Chrome shows that it uses 3 different certificates with different public keys.
Hierarchy:
GTS … Continue reading Why chrome shows several certificates for encryption?
I’m trying to figure out whether a website that is secured by a certificate can get hacked? This source:
https://blog.mozilla.org/en/products/firefox/https-protect/
Refer to 3rd last paragraph where it says:
"It provides integrity, so… Continue reading HTTPS Website Hacking
We are all used to reading web pages protected by HTTPS. It has, as far as I (as a user of a browser) can perceive, zero cost. Contrarily, encrypting an email is inconvenient to both sender and receiver.
When I attach a sensitive pdf encry… Continue reading Why is much harder to encrypt emails, compared to web pages?