A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.

learn more… | top users | synonyms

3
votes
2answers
28 views

Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised?

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company ...
2
votes
2answers
156 views

Why do popular sites like Google, Dropbox, etc. have a “trust this computer” checkbox when it weakens security?

Let's say someone is logging onto Dropbox in the library, but the computer has a keylogger on it that steals their password. Fortunately, they are using two factor authentication, which could have ...
1
vote
0answers
71 views

Fido: trusting user-agent

As I went through Fido specifications: the server (providing web app/services) need to trust user agent for local fido authentication and if needed can enforce certain policies" I am not sure ...
5
votes
2answers
265 views

How to ensure that a person whose identity has been verified from an I.D. is the author of their exam answers?

Background We are designing a computer based test system where the examinees use their own computers to write their answers. The examinees' computers are booted to a custom Linux OS from USB drives ...
4
votes
2answers
113 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
2
votes
1answer
45 views

Is it possible to build completely verifiable hardware?

Reproducible builds like they are used for Bitcoin, Tor or the Debian package repository aim at making sure that the binaries you install exactly equate the source code that they are supposed to be ...
2
votes
1answer
42 views

How to securely install web applications on untrusted hosts?

In principle, storing data securely on an untrusted server seems to be easy. Just use a strong enough client side encryption. But how to deal with web applications? For example a forum software like ...
1
vote
1answer
85 views

Why doesn't the OS authenticate itself to me?

Sometimes it occurs to me, when doing something like a brew install, or really anything on a CLI (though I suppose this is also true of GUIs to a marginally lesser extent) that prompts me for a ...
0
votes
2answers
68 views

Hierarchical PKI trust model

Suppose we have the hierarchical trust model as seen below. Alice will trust Doris' public key iff there is a Certifcation Path from her to Doris. Alice thus pocesses a valid certificate of A. ...
32
votes
7answers
2k views

Is it safe to trust a Docker container?

When it comes to Docker, it is very convenient to use a third party container that already exist to do what we want. The problem is that those containers can be very complicated and have a large ...
2
votes
3answers
827 views

How secure is VirtualBox for privacy/anonymity? [closed]

Is it possible that Oracle places backdoors in VirtualBox that compromise a user's privacy/anonymity? For example, is running Whonix through VirtualBox a secure set up if your host OS is unencrypted? ...
2
votes
0answers
108 views

Can Google tech be trusted? [closed]

With the Snowden leaks, Google has been implicated in the activities of the NSA. There really is no way for ordinary citizens to know with certainty what the exact reality of this involvement is. In ...
6
votes
1answer
902 views

Is Man-In-The-Middle necessary for a CA to read HTTP plaintext?

Although I understand the basic theory behind certificates and asymmetric cryptography, I'm not quite sure on the details of the X.509 protocol. I'm wondering what attacker model a given CA requires ...
8
votes
1answer
288 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
2
votes
1answer
216 views

In the context of security engineering, is trust an equivalence relation?

This is the definition of an equivalence relation according to Wikipedia: In mathematics, an equivalence relation is the relation that holds between two elements if and only if they are members of ...
0
votes
2answers
74 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
0
votes
2answers
181 views

Trust level of whole disk encryption software

For example, if we take this software into account: Symantec Endpoint Encryption Sophos Safeguard Encryption How can we trust suppliers of whole disk encryption software in the lights of the ...
8
votes
4answers
1k views

How bad it is to install another company's root certificate to your server?

Our company uses a web server with a couple of web sites on it (private and public, over HTTP and HTTPS, some low risk and some high risk including online payments or other sensitive data for ...
0
votes
0answers
41 views

wifi settings to the wifi that isn't mine [duplicate]

I am under someone's wifi and I don't feel comfortable with the knowledge that she can see everything I send and visit. How can I secure my devices and block out any funny buisness? I have the wifi ...
3
votes
2answers
253 views

Is there a trusted independent firewall review company?

I don't know how to write this without it sounding like a plug (lol), but it's not. So please don't close-vote it, even if you really want your editor badge. Here goes: There's this site called ...
1
vote
3answers
82 views

How safe is it for an app to trust a click on a link in an email?

In my question and answer application, Joe signs up, logs in and adds a question. He then shares the question via email to his trusted friends. How safe is it to provide a link within that app ...
2
votes
1answer
160 views

Is it possible to design a system where the client doesn't have to trust the server?

When you are using services like chat, file sending, exchanging etc., you always have to trust server providing these services. The only way to use services without having to trust third party is to ...
3
votes
3answers
120 views

How can DH provide a known secret to two parties over an unencrypted connection without it being intercepted via MITM?

Without using Private and Public keypairs, i do not understand how Diffie-Hellman is able to generate a secret key between two parties on the internet without passing something between that could be ...
3
votes
3answers
357 views

Trusting SSL and the Trust Chain

As we all know, when an SSL Certificate is assigned, there is a trust chain that is created for verify everyone from the Certificate Authority to the actual website's SSL Certificate. Thanks to a ...
1
vote
1answer
66 views

Trust on certificate authorities

If I as layman don't err, there are in banking controls, from both internal and national oversights, of the work done by the employees. These are apparently effective, since the details of ...
2
votes
2answers
240 views

OpenSSL SSL enabled client application, server verification?

I am writing an OpenSSL SSL enabled client application which connects to a Google server. I have the SSL working and I can monitor the traffic and see that it is definitely encrypted. I am using ...
4
votes
2answers
314 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
6
votes
1answer
116 views

Why does a web site operator need to trust an openid provider?

I am working on a web site and am considering using OpenID for authentication. The site will have some low cost ($3-$5) premium services, but will not be protecting particularly sensitive user data, ...
0
votes
1answer
349 views

Can I rely on encrypted cloud services like Mega? [closed]

The Mega site claims that all submitted files are encrypted upon upload and decrypted upon download, and at no moment have they any knowledge of the decrypted contents. (I assume others sites do it ...
0
votes
1answer
261 views

One user ID of a trusted key has unknown trust

I observed today that Thunderbird/Enigmail (24.2.0/1.6) does not allow me to select a key for encrypting mails to one of the addresses associated with the key, even though others work. Help sites ...
6
votes
1answer
988 views

Dynamic vs Static root of trust

In TCG specification (for TPM devices) they specify how a static root of trust can be built up using secure boot and trusted boot. An alternative method appears to be Intel's Dynamic boot using their ...
-2
votes
2answers
113 views

How to use encryption on proprietary software

I wonder if it's possible to develop a secure point to point encryption application (a pgp message application for example) on a proprietary software. If such an application was developed, let say on ...
4
votes
2answers
193 views

GPG key trust after a signing party

I might be totally misunderstanding the concept of web-of-trust, but imagine the following scenario: I generate my key, then go to a key signing party, and after, I import all the keys which ...
1
vote
0answers
55 views

Is there a theorem that states “whatever can be done with trust can be done without”?

I remember hearing something like this when I first learned the protocols that removed the need of a trusted third party, but I can't find this theorem or "law" anywhere. Any pointers?
12
votes
3answers
11k views

Apparently PayPal-affiliated site with very suspect security

History I got an email this afternoon to my gmail from "paypal@e.paypal.com" with mailed-by: na.e.paypal.com and signed-by: e.paypal.com. Gmail did not report it as spam/phishing/suspicious and it ...
9
votes
4answers
184 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
5
votes
2answers
572 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
1
vote
3answers
292 views

Should I trust my bank after this [closed]

I have just discovered that I can login to my bank with passwords that is not mine. Example: My password is "1234" but I am authorized with all possible post characters. For example "12345" or ...
3
votes
3answers
479 views

Backup personal email on VPS - privacy, security and trust risks

FastMail.fm hosts my personal email account. Now they claim to have reliable backup services, but I'd like to have my own copy of my email archives. What I'd like to do is back up to my VPS, which ...
3
votes
1answer
87 views

Validating correctness amongst untrusted answers

I'm toying around a distributed computing project. The client application asks for a problem to solve. The server returns a problem description from a "problems pool". When the client finishes, it ...
3
votes
2answers
191 views

Trust vs Reputation

There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these ...
3
votes
1answer
135 views

Who watches the watchmen? User empowerment over firewall behaviour on a personal computer

I've been exploring the gamut of free Windows firewall applications recently and have encountered the following problem: The better firewalls are excellent at stopping other apps from phoning home ...
3
votes
1answer
2k views

Hiding backdoors in Open Source code in other languages than C and C++?

I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
7
votes
1answer
3k views

What is the exact meaning of this gpg output regarding trust?

When I import signatures or receive a key with gpg, it outputs some cryptic lines like: gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 16 trust: ...
0
votes
2answers
254 views

How can we trust the tools? [closed]

There is a lot of tools out there to do a lot of things with, like sniffing, scanning, and even backdoors. However, I have a really hard time trusting these tools. When I install them at home and ...
3
votes
1answer
288 views

Should I trust and play every embedded video on Facebook?

Regarding to trusted sites like YouTube, should I trust other videos when embedded to Facebook, usually, when user shares a link a thumbnail image will be created and previewed, then, we need only to ...
0
votes
1answer
273 views

Allow read-only access to server-side pages for security review?

This answer: http://security.stackexchange.com/a/37319/10574 Mentions the issue of host-based security. To the end user, the web server is an untrustable black box. Would it provide to needed ...
5
votes
1answer
416 views

'Trusted CA Certificates' and 'Trusted remote Certificates'

What is the difference between Trusted CA Certificates and Trusted remote Certificates?
7
votes
1answer
1k views

How does an end user differentiate between OV and DV certificates?

This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
23
votes
4answers
805 views

Security seals and the “perception of safety”?

I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...