You can ask, a good response isn't guaranteed

hey @this.josh i'm about learning how to plug-in pyreshark to wireshark using linux.

I know a bit about wireshark, but nothing about pyreshark.

pyreshark is useful for automating dissectors.

it's easy with windows since everything is executable.

but linux ....

Haven't heard of pyreshark either

@RoryAlsop there's a reverting suggested edit in the queue on this question (security.stackexchange.com/posts/177054/revisions)

@tom did you add the link automatically? I wonder why this went to be [1].

uh I added it via the add link-buton

didnt check the markup afterwards

ok. So it's done automatically. Good to know.

It changes all the other refs by 1

which is ... weird-ish

ah okay, so everything else is intact?

Yeah sure

1 became 2, 2 became 3

oh okay

hm it's possible to VTC as a duplicate of ... a duplicate?

Hey guys

I have a question for you, why do we need an SSL certificate to establish a TLS connection if the TLS protocol already has authentication using for example ECDSA or RSA during the handshake?

Thanks

The certificate is a medium used to authenticate the public key. It's signed by a Trusted Third Party and embeds the public key. The owner is authenticated by the TTP before it issues the certificate.

@M'vy thank you so much, very clear! So to summarize everything it works like this: the certificate ensure that both client's and server's pubblic keys used in RSA or ECDSA to authenticate single messages for example, belongs to the correct owner so you know that the encryped messages exchanged between client and server are coming from known parties and you can avoid MiTM attacks, correct?

If you want to authenticate client and server you need a certificate for each

When you get the cert, and validate its origin and the signature is correct, you can then use the public key being sure that only the true recipient can read what you send

In the TLS protocol, client don't usually need to be authenticated by certificate, so you just accept whatever public key they provide to answer back. Then you agree on a symmetrical key for the session.

There's a very good question here : security.stackexchange.com/questions/20803/…

(it gets technical)

Could we please encourage people here to not call other users "stupid"?

security.stackexchange.com/review/suggested-edits/112987

@M'vy thanks again. I am reading the question... However I don't want to abuse of your kindness but just to give you a little bit more context, I am creating a simple Java application. It is composed of an Android client and a desktop PC server. The Android client connects to the server on a randomly generated port and sends sensitive data to the server. This all happens on the local LAN network by using Java SSL Sockets.

All the articles I've found tells you to create a certificate using the Java "keytool" command line utility. Type "BKS" for Android client and "JKS" for desktop server.

In this way there is no Trusted Third Party involved so it's already a bit strange, then I am also required to set passwords to access these certificates but since I can't force the user to remember this passwords I have to write them in the code itself in plain text. When you explained it was very clear but this Android/Java version it's way more puzzling...

Is this an internal app?

Yes it's a standard Android application running on smartphones and its server counterpart it's simple Java server running on a computer inside the LAN.

if this is, then you have full control over the certificates you are using, and you can act as your own TTP. Create a root self-signed certificate and issue a server and one (or many) client certificate (depending if you need to authenticate the 'application' or the users themselves). Then you should be able to add these to the keystore.

it might be possible to generate the client certificate on-the-fly if there's no client authentication necessary.

but usually the server should have one who's fixed so the app can know it's the right one, either by validating the certificate, or having it 'pinned' (aka store as is on the device)

So I found a question on here from 2011 about services where they seem to know characters from your password. security.stackexchange.com/questions/4830/…

I was on the phone earlier and got asked this & told the operator my password couldn't be secure if he could see some of it. Is that still valid? How common is this?

@MattThrower never heard of it until now

@D.W. hello fellow hs player

@MattThrower there are some services I have seen that require the helpdesk person to type in the characters that you provide for e.g. 2nd, 4th and 6th. They can be stored and accessed securely... but they could also be stored insecurely. Not easy for you to tell, as a customer.

...people do get notifications when they're not here, right?