TechiE BoY 8080

TLS is the new name for SSL. Namely, SSL protocol got to version 3.0; TLS 1.0 is "SSL 3.1". TLS versions currently defined include TLS 1.1 and 1.2. Each new version adds a few features and modifies some internal details. We sometimes say "SSL/TLS". HTTPS is HTTP-within-SSL/TLS. SSL (TLS) establishes a secured, bidirectional tunnel for arbitrary binary data between two hosts. HTTP is a protocol for sending requests and receiving answers, each request and answer consisting of detailed headers and (possibly) some content. HTTP is meant to run over a bidirectional tunnel for arbitrary binary data; when that tunnel is an SSL/TLS connection, then the whole is called "HTTPS". To explain the acronyms: " SSL " means "Secure Sockets Layer". This was coined by the inventors of the first versions of the protocol, Netscape (the company was later bought by AOL). " TLS " means "Transport Layer Security". The name was change...

Before answering whether it does help or it does not help, it makes sense to look at specific scenarios. (That's often a good idea when dealing with security measurements.) In what situations does a forced-password-change mitigate impact? The attacker knows the password of a user but has no backdoor. He does not want to be discovered, so he does not change the password himself. Let's see if this scenario is likely: How might he have learned the password? The victim might have told him (e. g. a new intern who should start working before he gets his own account setup, another person who should level an account in an online game The attacker might have watched the keyboard The attacker might have had access to another password database in which the user used the same password A one time only login using a computer owned (prepared) by an attacker. What might have prevented him from setting up a backdoor? The service in question may not provide a way for backdoors...

The Theory We need to hash passwords as a second line of defence. A server which can authenticate users necessarily contains, somewhere in its entrails, some data which can be used to  validate  a password. A very simple system would just store the passwords themselves, and validation would be a simple comparison. But if a hostile outsider were to gain a simple glimpse at the contents of the file or database table which contains the passwords, then that attacker would learn a lot. Unfortunately, such partial, read-only breaches do occur in practice (a mislaid backup tape, a decommissioned but not wiped-out hard disk, an aftermath of a SQL injection attack -- the possibilities are numerous). See  this blog post  for a detailed discussion. Since the overall contents of a server that can validate passwords are necessarily sufficient to indeed validate passwords, an attacker who obtained a read-only snapshot of the server is in position to make an  offline dict...