A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.

learn more… | top users | synonyms

0
votes
2answers
34 views

Guarantee one unique identity per node

I'm in the early stages of designing a decentralised systems protocol, based on a blockchain, for a thesis. For the protocol to remain secure, each node in the system must be capable of generating ...
7
votes
4answers
189 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
2
votes
2answers
368 views

Is there a trusted independent firewall review company?

I don't know how to write this without it sounding like a plug (lol), but it's not. So please don't close-vote it, even if you really want your editor badge. Here goes: There's this site called ...
0
votes
0answers
16 views

Should I trust on Airpush and give IMEI? [duplicate]

For opting-out from air-push adds on android I can request to Airpush. Visit the relevant post: Is this red star icon malware? How to get rid of it? Is there a reliable way to detect the app ...
2
votes
0answers
18 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep ...
2
votes
1answer
58 views

What, or who, exactly is a Certificate Authority (CA) for TPM attestation?

I'm learning about and researching the Trusted Platform Module (TPM) to incorporate into a solution involving remote machines. As I understand it: all attestation methods (AIK, DAA) still require ...
95
votes
13answers
25k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
10
votes
4answers
8k views

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them. When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
5
votes
1answer
120 views

Fido: trusting user-agent

As I went through Fido specifications: the server (providing web app/services) need to trust user agent for local fido authentication and if needed can enforce certain policies" I am not sure ...
0
votes
1answer
42 views

Basis for “trusting” third party code and services

I remember reading an article mentioning, that third party services and code should not be trusted, meaning blind trust. So, i was thinking, everyone uses third party code in software development ...
13
votes
3answers
2k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to a friend of mine and he was shocked that I do such dangerous thing. Is it really so unsafe to generate ...
0
votes
2answers
126 views

Why can you not trust a certificate directly?

If you want to set up a service that is signed using some Certificate Authority system (SSL/TLS, certain configurations of IKE, etc), if you want to use a self-signed certificate (e.g., for testing), ...
4
votes
1answer
2k views

Hiding backdoors in Open Source code in other languages than C and C++?

I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
2
votes
1answer
87 views

Why do Browsers warn about self-signed certificates but not about plain HTTP (which is not even encrypted)? [duplicate]

Let's keep it short: On HTTP everyone can listen easily. MITM attacks are no problem. On HTTPS (self-signed) everything is at least encrypted, it's much harder to MITM-attack and only private key ...
13
votes
4answers
1k views

How do certificate issuers become trusted?

From what I understand, the certificate scheme that TLS/SSL relies on works because your computer has trust for major CA issuers built into it. That is, your OS is installed with certificates for ...
0
votes
0answers
62 views

iOS Real Money Game Security [duplicate]

I am developing an iOS game that will be played with real money. The problem that I am facing is the security behind the game. First of all, the game is client-side. When the player buys into a game, ...
3
votes
5answers
2k views

When is it safe to use a web based FTP client?

Is it safe to use a web based FTP client? If so, when? What should I watch out for?
1
vote
3answers
39 views

Automatically ensure that a site's certificate (authority) has not changed

My Situation : I've setup my own certificate authority, and generated a certificate for a server used primarily internally. As I understand it, I can configure my browsers/computers to trust the ...
9
votes
2answers
351 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
2
votes
0answers
29 views

Is it a bad idea to provide a “testing” OAuth ID and secret?

I'm working on a web app, and I may eventually want to bring others onto the project. I have two sets of GitHub credentials: one called Foo that calls back to foo.com/endpoint, and one called Foo -- ...
0
votes
2answers
142 views

Encryption software trustworthy?

If you are downloading and using an encryption software, e. g. Veracrypt or Diskcryptor, how do you know if this software is not a fake one? Backdoored or other security holes? Assuming that such ...
2
votes
1answer
221 views

Is it possible to design a system where the client doesn't have to trust the server?

When you are using services like chat, file sending, exchanging etc., you always have to trust server providing these services. The only way to use services without having to trust third party is to ...
90
votes
6answers
16k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
0
votes
1answer
37 views

Can you give third-parties the power to supervise what code your server is running?

Web applications on servers often perform tasks in which users have to trust them, e.g. securely storing their passwords. Is there any way of letting the user convince himself that the server is ...
4
votes
2answers
88 views

Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised?

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company ...
34
votes
7answers
3k views

Is it safe to trust a Docker container?

When it comes to Docker, it is very convenient to use a third party container that already exist to do what we want. The problem is that those containers can be very complicated and have a large ...
2
votes
2answers
182 views

Why do popular sites like Google, Dropbox, etc. have a “trust this computer” checkbox when it weakens security?

Let's say someone is logging onto Dropbox in the library, but the computer has a keylogger on it that steals their password. Fortunately, they are using two factor authentication, which could have ...
5
votes
2answers
292 views

How to ensure that a person whose identity has been verified from an I.D. is the author of their exam answers?

Background We are designing a computer based test system where the examinees use their own computers to write their answers. The examinees' computers are booted to a custom Linux OS from USB drives ...
4
votes
2answers
192 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
2
votes
1answer
65 views

Is it possible to build completely verifiable hardware?

Reproducible builds like they are used for Bitcoin, Tor or the Debian package repository aim at making sure that the binaries you install exactly equate the source code that they are supposed to be ...
12
votes
3answers
16k views

Apparently PayPal-affiliated site with very suspect security

History I got an email this afternoon to my gmail from "paypal@e.paypal.com" with mailed-by: na.e.paypal.com and signed-by: e.paypal.com. Gmail did not report it as spam/phishing/suspicious and it ...
2
votes
1answer
53 views

How to securely install web applications on untrusted hosts?

In principle, storing data securely on an untrusted server seems to be easy. Just use a strong enough client side encryption. But how to deal with web applications? For example a forum software like ...
1
vote
1answer
93 views

Why doesn't the OS authenticate itself to me?

Sometimes it occurs to me, when doing something like a brew install, or really anything on a CLI (though I suppose this is also true of GUIs to a marginally lesser extent) that prompts me for a ...
0
votes
2answers
232 views

Hierarchical PKI trust model

Suppose we have the hierarchical trust model as seen below. Alice will trust Doris' public key iff there is a Certifcation Path from her to Doris. Alice thus pocesses a valid certificate of A. ...
2
votes
1answer
307 views

In the context of security engineering, is trust an equivalence relation?

This is the definition of an equivalence relation according to Wikipedia: In mathematics, an equivalence relation is the relation that holds between two elements if and only if they are members of ...
2
votes
3answers
2k views

How secure is VirtualBox for privacy/anonymity? [closed]

Is it possible that Oracle places backdoors in VirtualBox that compromise a user's privacy/anonymity? For example, is running Whonix through VirtualBox a secure set up if your host OS is unencrypted? ...
3
votes
0answers
129 views

Can Google tech be trusted? [closed]

With the Snowden leaks, Google has been implicated in the activities of the NSA. There really is no way for ordinary citizens to know with certainty what the exact reality of this involvement is. In ...
20
votes
7answers
7k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
6
votes
1answer
923 views

Is Man-In-The-Middle necessary for a CA to read HTTP plaintext?

Although I understand the basic theory behind certificates and asymmetric cryptography, I'm not quite sure on the details of the X.509 protocol. I'm wondering what attacker model a given CA requires ...
6
votes
1answer
1k views

Dynamic vs Static root of trust

In TCG specification (for TPM devices) they specify how a static root of trust can be built up using secure boot and trusted boot. An alternative method appears to be Intel's Dynamic boot using their ...
9
votes
4answers
195 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
88
votes
8answers
24k views

Why would someone trust DuckDuckGo or other providers with a similar privacy policy?

DuckDuckGo is a search engine that claims it will not share your results with others. Many of my skeptical coworkers think it may be a scam. Is there any proof that any web search engine will ...
0
votes
2answers
101 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
0
votes
2answers
191 views

Trust level of whole disk encryption software

For example, if we take this software into account: Symantec Endpoint Encryption Sophos Safeguard Encryption How can we trust suppliers of whole disk encryption software in the lights of the ...
2
votes
1answer
106 views

Are there negative influences in the Web of Trust? If not, are there theoretical alternatives?

Suppose I encounter a trusted PGP key that isn't really who they say they are. I don't want to sign their key and promote that entity. Can I somehow show my dissidence from the trust that everyone ...
8
votes
4answers
1k views

How bad it is to install another company's root certificate to your server?

Our company uses a web server with a couple of web sites on it (private and public, over HTTP and HTTPS, some low risk and some high risk including online payments or other sensitive data for ...
1
vote
3answers
89 views

How safe is it for an app to trust a click on a link in an email?

In my question and answer application, Joe signs up, logs in and adds a question. He then shares the question via email to his trusted friends. How safe is it to provide a link within that app ...
3
votes
3answers
123 views

How can DH provide a known secret to two parties over an unencrypted connection without it being intercepted via MITM?

Without using Private and Public keypairs, i do not understand how Diffie-Hellman is able to generate a secret key between two parties on the internet without passing something between that could be ...
60
votes
12answers
8k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
3
votes
3answers
568 views

Trusting SSL and the Trust Chain

As we all know, when an SSL Certificate is assigned, there is a trust chain that is created for verify everyone from the Certificate Authority to the actual website's SSL Certificate. Thanks to a ...