In the era of Apple vs FBI and large-scale hacking on a regular basis, many people are beginning to realize that our data are not so well protected as they should be. Google, Amazon, Facebook, Microsoft and many other technological…
Blog Archives
Google, Microsoft and Yahoo want to make email resistant to MITM attacks
Posted in Vulnerabilities Tagged with: email certificate, email ssl certificate, encrypted email, mitm, smtp strict transport security, TLS
Revoked TLS certificates can still be compromised
Security researchers working for the company Sucuri, have decided to revise the report, written back in 2012, dedicated to the API-call security. API calls must verify the integrity of such libraries as JSSE, OpenSSL and of GnuTLS, or transport libraries…
Posted in Validation, Vulnerabilities Tagged with: mitm, owasp, revoke ssl, revoked certificate, ssl library, TLS, tls certificate, vulnerability ssl
Why it is essential to use a Certificate pinning
Not so long ago the Netcraft, a company that scans the network, has released its “rebuke” for system administrators because they ignore HTTP Public Key Pinning (HPKP). Pinning enables you to protect users from attack, when the attacker deceives the…
Posted in Vulnerabilities, What is an SSL-Certificate Tagged with: certificate pinning, HPKP, netcraft
Google has made the list of untrusted providers of digital certificates
In an effort to improve trust in the web, Google released a new tool for tracking fraud CAs. Google has decided to implement a set of tools to monitor the digital certificate providers that can deal with fraud. This set…
Posted in Cancellation, Vulnerabilities Tagged with: certificate transparency, digital certificate, untrusted certificate
Attackers can exploit the vulnerability in StartSSL for issuing SSL certificates
Recently, security experts have found a serious hole in the domain verification, which was discovered in the StartSSL. The detected vulnerability allows anyone to issue SSL-certificates for any domain without confirming ownership. StartSSL – a web-based service that allows webmasters…
DROWN-attack able to cut down a third of the network websites
Recently a new vulnerability hole was discovered and it was named Heartbleed, and now we are facing a new exploit. DROWN, new vulnerability in the OpenSSL, affects servers that use SSLv2. This vulnerability was discovered quite recently. Attackers are able to decipher…
This site is dedicated to SSL-certificates. You will learn what is an SSL certificate, how to issue and reissue it. FAQ SSL will be useful for both novices and pros. SSL Knowledgebase contains sections on validation, trust logo, vulnerabilities, SSL-certificates differences by type (Wildcard, EV, DV, etc.), as well as many other things.
Comments