A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.

learn more… | top users | synonyms

4
votes
2answers
196 views

How to ensure that a person whose identity has been verified from an I.D. is the author of their exam answers?

Background We are designing a computer based test system where the examinees use their own computers to write their answers. The examinees' computers are booted to a custom Linux OS from USB drives ...
4
votes
2answers
99 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
2
votes
1answer
42 views

Is it possible to build completely verifiable hardware?

Reproducible builds like they are used for Bitcoin, Tor or the Debian package repository aim at making sure that the binaries you install exactly equate the source code that they are supposed to be ...
12
votes
3answers
10k views

Apparently PayPal-affiliated site with very suspect security

History I got an email this afternoon to my gmail from "paypal@e.paypal.com" with mailed-by: na.e.paypal.com and signed-by: e.paypal.com. Gmail did not report it as spam/phishing/suspicious and it ...
2
votes
1answer
41 views

How to securely install web applications on untrusted hosts?

In principle, storing data securely on an untrusted server seems to be easy. Just use a strong enough client side encryption. But how to deal with web applications? For example a forum software like ...
3
votes
2answers
238 views

Is there a trusted independent firewall review company?

I don't know how to write this without it sounding like a plug (lol), but it's not. So please don't close-vote it, even if you really want your editor badge. Here goes: There's this site called ...
1
vote
1answer
84 views

Why doesn't the OS authenticate itself to me?

Sometimes it occurs to me, when doing something like a brew install, or really anything on a CLI (though I suppose this is also true of GUIs to a marginally lesser extent) that prompts me for a ...
0
votes
2answers
56 views

Hierarchical PKI trust model

Suppose we have the hierarchical trust model as seen below. Alice will trust Doris' public key iff there is a Certifcation Path from her to Doris. Alice thus pocesses a valid certificate of A. ...
2
votes
1answer
213 views

In the context of security engineering, is trust an equivalence relation?

This is the definition of an equivalence relation according to Wikipedia: In mathematics, an equivalence relation is the relation that holds between two elements if and only if they are members of ...
30
votes
7answers
2k views

Is it safe to trust a Docker container?

When it comes to Docker, it is very convenient to use a third party container that already exist to do what we want. The problem that is those containers can be very complicated and have a large ...
2
votes
3answers
701 views

How secure is VirtualBox for privacy/anonymity? [closed]

Is it possible that Oracle places backdoors in VirtualBox that compromise a user's privacy/anonymity? For example, is running Whonix through VirtualBox a secure set up if your host OS is unencrypted? ...
78
votes
6answers
14k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
2
votes
0answers
106 views

Can Google tech be trusted? [closed]

With the Snowden leaks, Google has been implicated in the activities of the NSA. There really is no way for ordinary citizens to know with certainty what the exact reality of this involvement is. In ...
20
votes
7answers
4k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
9
votes
1answer
275 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
6
votes
1answer
898 views

Is Man-In-The-Middle necessary for a CA to read HTTP plaintext?

Although I understand the basic theory behind certificates and asymmetric cryptography, I'm not quite sure on the details of the X.509 protocol. I'm wondering what attacker model a given CA requires ...
6
votes
1answer
929 views

Dynamic vs Static root of trust

In TCG specification (for TPM devices) they specify how a static root of trust can be built up using secure boot and trusted boot. An alternative method appears to be Intel's Dynamic boot using their ...
9
votes
4answers
180 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
80
votes
8answers
20k views

Why would someone trust DuckDuckGo or other providers with a similar privacy policy?

DuckDuckGo is a search engine that claims it will not share your results with others. Many of my skeptical coworkers think it may be a scam. Is there any proof that any web search engine will ...
0
votes
2answers
73 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
80
votes
11answers
20k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
0
votes
2answers
177 views

Trust level of whole disk encryption software

For example, if we take this software into account: Symantec Endpoint Encryption Sophos Safeguard Encryption How can we trust suppliers of whole disk encryption software in the lights of the ...
2
votes
1answer
97 views

Are there negative influences in the Web of Trust? If not, are there theoretical alternatives?

Suppose I encounter a trusted PGP key that isn't really who they say they are. I don't want to sign their key and promote that entity. Can I somehow show my dissidence from the trust that everyone ...
8
votes
4answers
996 views

How bad it is to install another company's root certificate to your server?

Our company uses a web server with a couple of web sites on it (private and public, over HTTP and HTTPS, some low risk and some high risk including online payments or other sensitive data for ...
0
votes
0answers
41 views

wifi settings to the wifi that isn't mine [duplicate]

I am under someone's wifi and I don't feel comfortable with the knowledge that she can see everything I send and visit. How can I secure my devices and block out any funny buisness? I have the wifi ...
1
vote
3answers
81 views

How safe is it for an app to trust a click on a link in an email?

In my question and answer application, Joe signs up, logs in and adds a question. He then shares the question via email to his trusted friends. How safe is it to provide a link within that app ...
2
votes
1answer
160 views

Is it possible to design a system where the client doesn't have to trust the server?

When you are using services like chat, file sending, exchanging etc., you always have to trust server providing these services. The only way to use services without having to trust third party is to ...
3
votes
3answers
117 views

How can DH provide a known secret to two parties over an unencrypted connection without it being intercepted via MITM?

Without using Private and Public keypairs, i do not understand how Diffie-Hellman is able to generate a secret key between two parties on the internet without passing something between that could be ...
50
votes
12answers
6k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
3
votes
3answers
319 views

Trusting SSL and the Trust Chain

As we all know, when an SSL Certificate is assigned, there is a trust chain that is created for verify everyone from the Certificate Authority to the actual website's SSL Certificate. Thanks to a ...
1
vote
1answer
66 views

Trust on certificate authorities

If I as layman don't err, there are in banking controls, from both internal and national oversights, of the work done by the employees. These are apparently effective, since the details of ...
2
votes
2answers
228 views

OpenSSL SSL enabled client application, server verification?

I am writing an OpenSSL SSL enabled client application which connects to a Google server. I have the SSL working and I can monitor the traffic and see that it is definitely encrypted. I am using ...
4
votes
2answers
306 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
5
votes
2answers
542 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
6
votes
1answer
111 views

Why does a web site operator need to trust an openid provider?

I am working on a web site and am considering using OpenID for authentication. The site will have some low cost ($3-$5) premium services, but will not be protecting particularly sensitive user data, ...
8
votes
3answers
1k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to friend of mine and he looked at me as if my life was one big fail. Is it really so unsafe to generate ...
3
votes
2answers
190 views

Trust vs Reputation

There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these ...
8
votes
8answers
1k views

How do I choose whether to trust a particular website?

From @GrahamLee's comment over on this question, this is a very good point: How do I choose whether to trust a particular website when the only information I have relevant to my trust decision is the ...
0
votes
1answer
344 views

Can I rely on encrypted cloud services like Mega? [closed]

The Mega site claims that all submitted files are encrypted upon upload and decrypted upon download, and at no moment have they any knowledge of the decrypted contents. (I assume others sites do it ...
0
votes
1answer
237 views

One user ID of a trusted key has unknown trust

I observed today that Thunderbird/Enigmail (24.2.0/1.6) does not allow me to select a key for encrypting mails to one of the addresses associated with the key, even though others work. Help sites ...
-2
votes
2answers
112 views

How to use encryption on proprietary software

I wonder if it's possible to develop a secure point to point encryption application (a pgp message application for example) on a proprietary software. If such an application was developed, let say on ...
4
votes
2answers
190 views

GPG key trust after a signing party

I might be totally misunderstanding the concept of web-of-trust, but imagine the following scenario: I generate my key, then go to a key signing party, and after, I import all the keys which ...
1
vote
0answers
53 views

Is there a theorem that states “whatever can be done with trust can be done without”?

I remember hearing something like this when I first learned the protocols that removed the need of a trusted third party, but I can't find this theorem or "law" anywhere. Any pointers?
3
votes
1answer
87 views

Validating correctness amongst untrusted answers

I'm toying around a distributed computing project. The client application asks for a problem to solve. The server returns a problem description from a "problems pool". When the client finishes, it ...
3
votes
3answers
472 views

Backup personal email on VPS - privacy, security and trust risks

FastMail.fm hosts my personal email account. Now they claim to have reliable backup services, but I'd like to have my own copy of my email archives. What I'd like to do is back up to my VPS, which ...
1
vote
3answers
292 views

Should I trust my bank after this [closed]

I have just discovered that I can login to my bank with passwords that is not mine. Example: My password is "1234" but I am authorized with all possible post characters. For example "12345" or ...
6
votes
3answers
647 views

Are online hash calculators dangerous?

I was about to use an online MD5 checksum calculator when I realized that my result could be added to a database. This is significant because the string I was going to type in was my bank password. ...
3
votes
1answer
133 views

Who watches the watchmen? User empowerment over firewall behaviour on a personal computer

I've been exploring the gamut of free Windows firewall applications recently and have encountered the following problem: The better firewalls are excellent at stopping other apps from phoning home ...
3
votes
1answer
2k views

Hiding backdoors in Open Source code in other languages than C and C++?

I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
7
votes
1answer
3k views

What is the exact meaning of this gpg output regarding trust?

When I import signatures or receive a key with gpg, it outputs some cryptic lines like: gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 16 trust: ...