Confidentiality is the property of maintaining the secrecy of an asset. In other words, confidentiality means protecting against the threat of disclosure. It is one of the three key security properties of an asset, along with confidentiality and availability.
2
votes
1answer
91 views
Securely notify users about account changes
I am developing a web application (using PHP) and I am wondering what the best way is to notify users that someone updated their account information? The information that can be updated includes:
...
0
votes
2answers
109 views
How do I ensure that a VPS host will keep my information private?
Basically, I want to use OpenVPN on a VPS to browse confidentially. However, I don't know much about VPS hosters and to me, it seems to be a hard choice because there are so many.
However, I think ...
3
votes
2answers
138 views
Sharing encrypted data
I have a web app that is storing information related to a organization that I would like to encrypt but share amongst organization members. I would only like the members of the organization to be able ...
3
votes
2answers
127 views
Confidentiality and integrity for web session
When the client authenticates with our service, he is issued an opaque "token". This token includes the information, that identifies the client and some other information about the client ("payload"). ...
6
votes
4answers
193 views
Is it possible for a third party to sniff data off the line to an ISP and determine what the user is doing?
Can somebody hack the line between my router and service provider and monitor what I'm doing online and what sites I'm visiting?
1
vote
1answer
71 views
Ciphertext for email vs Ciphertext for database
Let's say Bob wants to send a message to Alice. This communication requires to achieve confidentiality, integrity, proof of origin, non-repudiation. Therefore we can use this cipher-text:
ciphertext ...
-1
votes
2answers
108 views
Secure risks of online chat for customer service
Some merchants provide the ability to chat over the web for customer service or help.
Are there any risks in using these online chat channels? If so, what are the primary risks? Can the chat ...
0
votes
2answers
82 views
Security in the breaking cloud? Storage Wars?
If access to a cloud server instance that stores personal/important information is lost or removed by the provider, is my data protected? Can the provider access my data and copy it, distribute, or ...
3
votes
2answers
670 views
How effectively can ISPs detect illegal file sharing?
Recently the USA passed a law requiring ISPs to spy on their customers' internet connections to check for illegal file sharing. I assume that they would do this by sniffing packets, but doesn't this ...
4
votes
3answers
152 views
Does GOOD Dynamics Proxy comply with EU data legislation?
My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. ...
6
votes
4answers
354 views
Keyboard sniffing through audio recorded typing patterns
I've been thinking about this for a while; I know people are aware of wireless wiretapping of keyboards. However, has there been research on how to wiretap keyboards based on typing patterns? I'm ...
3
votes
5answers
183 views
Is there any security value of creatively naming folders containing sensitive files?
A friend of mine asked me if he could sign his tax returns without printing them out. While helping him, he insisted on naming the folder containing images of his signature and initials a completely ...
7
votes
1answer
131 views
Can all the (other) recepients of a PGP encrypted message be identified?
Does an encrypted message contain any information about whom it is encrypted to, or at least to how many recipients? And if so, is it at least only obtainable for other recipients or for just anybody?
...
0
votes
2answers
99 views
API - How can I make sure data sent by the user is only sent to my application?
I have an API and a web application where users can login through another system and then post text messages to my application, for example.
How can I assure that when this data is only posted to my ...
9
votes
4answers
685 views
Why encrypt data in memory?
I saw that KeePass not only encrypts its password-database-file, it also can encrypt the passwords it holds in memory. This is just an example. I thinking of a new project dealing with sensitve / ...
6
votes
2answers
202 views
Where to put private files on a shared web server
I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
2
votes
2answers
520 views
How Is It Possible For Hackers To “Dig Up The Dirt” On People?
Like the title says, I was wondering how its possible for hackers to "dig up the dirt" and get peoples personal information such as address, credit cards, bank accounts, social insurance number, etc? ...
11
votes
3answers
329 views
Is passing sensitive data through the process environment secure?
Recently I have been looking for the possibility to pass sensitive information from one process to another (at process startup time) without passing it through the command line or without using a ...
9
votes
2answers
704 views
How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?
http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data
http://rt.com/news/uk-privacy-internet-freedom-186/
'Black boxes' will be installed by internet services providers ...
3
votes
3answers
113 views
In what situations are web services required to protect confidentiality of user information?
I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential.
Under what other situations ...
6
votes
6answers
557 views
Implications of securing data in RAM
Someone told me that his company is storing all application data (at least the sensitive data I guess) in RAM for security. Their application runs for long periods of time, so data stays in memory for ...
2
votes
2answers
286 views
Keeping valuable algorithms secret
Given a securities trading algorithm that is very effective and thereby very valuable, how do you keep it secret and protect it from theft or copying? What techniques or architecture is the best?
The ...
2
votes
5answers
145 views
Is DRM considered Confidentiality, Integrity, Availability, or some combination of the three?
I was discussing software trial time limit enforcement with a colleague and the idea of CIA came up. Do stricter enforcement techniques increase confidentiality at the expense of availability? (for ...
2
votes
4answers
3k views
Bank account number and account holder in check exposed?
I'm not sure if this is standard practice in all banking institutions but almost all banks where I've received checks the account number of the issuer is exposed (some even the account name). Isn't ...
2
votes
2answers
458 views
Is traffic sent by Mouse Without Borders encrypted?
Some of our users have installed Mouse Without Borders and I wanted to know if it is possible to intercept the traffic being sent between the two computers and read it in some meaningful manner. I was ...
6
votes
3answers
2k views
Storing Credit Card Numbers
I'll be making a website with a membership type of option for the website, and I'll be most likely using Authorize.Net to make the transactions, however, I need to know what kind of encryption I can ...
5
votes
2answers
204 views
System for Mutual authenticaion and confidentiality
I am looking for a protocol where there needs to be mutual authentication between client and server. For example server should connect to a particular client only. That is client should authenticate ...
8
votes
1answer
153 views
What practical uses are there for the AD feature of “Confidential Attributes”
Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes?
Would you store sensitive information here such as a private key, or a salt here?
I'm ...
6
votes
3answers
47 views
Patient Hashes for Compression and Security
Are there any front-running approaches to using server-generated hashes to encapsulate patient condition in a concise manner while maximizing security?
For example, a system to represent current med ...
11
votes
6answers
2k views
Does SSL/TLS (https) hide the urls being accessed [duplicate]
Suppose I type this in my browser
https://www.mysite.com/getsecret?username=alice&password=mysecret
and an attacker is watching all traffic from me to my ISP.
What information is protected by ...
3
votes
3answers
934 views
Google App Engine Security
I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is.
Does anyone know if there was ...
0
votes
0answers
99 views
Google App Engine Security [duplicate]
Possible Duplicate:
Google App Engine Security
I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine ...
3
votes
3answers
311 views
storing the third party credentials in the database/some secure place
This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user.
Our system connect to the third party system using ...
5
votes
2answers
650 views
How eavesdropping will be performed how can I prevent from eavesdropping
I believe that eavesdropping in a man in middle attack and the message is passing from the client to server the man sitting at ISP or network hackers can look at what message I am sending. Heard that ...
1
vote
1answer
441 views
Android application level encryption cracking
We come across Android applications which use the custom encryption. When we proxy the Android phone or emulator, the proxy captures traffic which is unreadable.
Is there a known technique to read ...
7
votes
6answers
537 views
when is it safe to click through an SSL warning message?
How does a user know if it's safe to click through scary browser warnings about SSL certificates?
Ideally, a user should never need to click through these warning messages, but sometimes honest ...
12
votes
7answers
1k views
Getting rid of a large quantity of paper
Say you were in charge of getting rid of a large quantity of paper - up to 1,000 in a row. It can't be used as scratch paper because it contains confidential information. It also can't be outsourced ...
6
votes
3answers
1k views
Is it possible to get all the data I send through wifi?
Is it possible, that the network administrator (wpa2 wifi network) can log all the data the users send and then get password out of it?
I know it is not possible to get the password if I'm surfing ...
5
votes
1answer
237 views
Oracle Internet Directory (OID) hardening
What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory?
note: OID is compatible with LDAP version 3.
12
votes
5answers
555 views
Is there a digital “safety deposit box” equivalent?
Digital safety deposit boxes: do they exist? if yes, are (any|they) trustworthy?
There are many bricks and mortar financial institutions where one can rent a locked box in a locked room and be ...
