A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.

learn more… | top users | synonyms

5
votes
1answer
286 views

Trusted Timestamping Scope and Real-World Uses

What security assurances does Trusted Timestamping based on Cryotography provide? What are the real-world uses of Trusted Timestamping?
2
votes
3answers
3k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
5
votes
2answers
183 views

How can a certificate be valid in the Hybrid Model but not in the Chain Model?

All dates in European format! I am learning about validity models, but the solution for this assignment confuses me. Translation: The relevant data for the applicable certificates are shown ...
27
votes
11answers
3k views

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
6
votes
2answers
865 views

TPM and storage of keys

A TPM hardware device has very limited non-volatile protected memory just sufficient to store the EK (Endorsement Key) and SRK (Storage Root Key). How does a TPM allow nearly unlimited number of ...
74
votes
11answers
19k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
8
votes
3answers
1k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to friend of mine and he looked at me as if my life was one big fail. Is it really so unsafe to generate ...
-6
votes
4answers
392 views

Is TLS-in-TLS supported in any software? Does it make sense? [closed]

I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
10
votes
4answers
2k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
9
votes
4answers
6k views

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them. When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
3
votes
1answer
414 views

Is there a way to store user files without being able to decrypt them?

I'd want to build a secure file storage web application. Currently ordinary password authentication is used for login. After login this password is used for encryption and decryption of user files at ...
6
votes
3answers
643 views

Are online hash calculators dangerous?

I was about to use an online MD5 checksum calculator when I realized that my result could be added to a database. This is significant because the string I was going to type in was my bank password. ...
7
votes
4answers
1k views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
22
votes
1answer
5k views

Is there a standard for printing a public key as a barcode?

Is there a standard for storing a public key printed on paper? Say, I want to hand out business cards with my public key pre-printed on them at a key signing party to help build the web of trust. My ...
2
votes
1answer
96 views

Are there negative influences in the Web of Trust? If not, are there theoretical alternatives?

Suppose I encounter a trusted PGP key that isn't really who they say they are. I don't want to sign their key and promote that entity. Can I somehow show my dissidence from the trust that everyone ...
5
votes
3answers
945 views

How to verify crypto engine?

If I understand this correctly, when I use a cryptographic (hardware) engine, I have to trust it. Are there any cryptographic algorithms with properties that allow me to verify the correctness of an ...
2
votes
2answers
408 views

Trust and signing: full public key or thumbprint?

Imagine a B2B service where two parties need to set up a two-way trust relationship: Alice will only accept requests from Bob, and Bob wants to know his requests are only going to Alice. When ...
1
vote
3answers
421 views

What is the best way to get a third party audit done of website security?

I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
5
votes
1answer
179 views

How can a new website create trust with users?

Earlier I asked a question on how to authenticate business identities, now I am wondering on the other side (the user side). There is also How do I choose whether to trust a particular website? How ...
79
votes
8answers
20k views

Why would someone trust DuckDuckGo or other providers with a similar privacy policy?

DuckDuckGo is a search engine that claims it will not share your results with others. Many of my skeptical coworkers think it may be a scam. Is there any proof that any web search engine will ...
7
votes
2answers
353 views

In Linux, when I consider trusting a new software source, what do I need to evaluate?

When I'm using the Linux software PackageKit, I get confused about what specific items of information I will need in order to decide whether to authorize software installation from a new software ...
8
votes
8answers
1k views

How do I choose whether to trust a particular website?

From @GrahamLee's comment over on this question, this is a very good point: How do I choose whether to trust a particular website when the only information I have relevant to my trust decision is the ...
0
votes
1answer
942 views

How do I deploy AD in a hostile location? What are the security implications between Domains, Forests vs RODC's in Active Directory?

Short version What are the risks/ benefits / drawbacks of RODC's vs Child Domains vs Forest Trusts in AD Background I'm working with a company that has various business agreements between many ...
15
votes
12answers
894 views

Is this much distrust really necessary?

In IT Security and computer power users there seems to be an excessive amount of distrust. They don't do anything or use anything because of this distrust, or use what seems like an excessive amount ...
11
votes
3answers
4k views

Is it possible to get all the data I send through wifi?

Is it possible, that the network administrator (wpa2 wifi network) can log all the data the users send and then get password out of it? I know it is not possible to get the password if I'm surfing ...
17
votes
3answers
2k views

What are the risks of a Certificate Authority hack for 'the average user'?

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
49
votes
12answers
6k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
77
votes
6answers
13k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
19
votes
7answers
3k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
7
votes
4answers
271 views

How to determine whether site is secure from common user's point of view?

What should be done (or at least declared) so end-users, visitors will start trusting your website? Some thoughts: secured login (via https) privacy policy (hidden email and other private ...