A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.
51
votes
8answers
6k views
Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
DuckDuckGo is a search engine that claims it will not share your results with others. Many of my skeptical coworkers think it may be a scam.
Is there any proof that any web search engine will ...
38
votes
4answers
5k views
How much can I trust Tor?
Greetings.
How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress.
I am a political activist from India and I do not enjoy the ...
23
votes
9answers
1k views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
21
votes
4answers
635 views
Security seals and the “perception of safety”?
I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...
19
votes
11answers
2k views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
19
votes
11answers
924 views
Is it safe to use a weak password as long as I have two-factor authentication?
I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
15
votes
12answers
761 views
Is this much distrust really necessary?
In IT Security and computer power users there seems to be an excessive amount of distrust. They don't do anything or use anything because of this distrust, or use what seems like an excessive amount ...
11
votes
9answers
1k views
What are some good website security scanning solutions?
What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally.
Generally, I'm looking for something we ...
11
votes
3answers
711 views
What are the risks of a Certificate Authority hack for 'the average user'?
Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
10
votes
4answers
467 views
Why do browsers warn about mixed content for images?
I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website.
However, they want to preserve the traditional forum ...
9
votes
1answer
583 views
Is there a standard for printing a public key as a barcode?
Is there a standard for storing a public key printed on paper?
Say, I want to hand out business cards with my public key pre-printed on them
at a key signing party to help build the web of trust.
My ...
7
votes
2answers
258 views
In Linux, when I consider trusting a new software source, what do I need to evaluate?
When I'm using the Linux software PackageKit, I get confused about what specific items of information I will need in order to decide whether to authorize software installation from a new software ...
6
votes
7answers
335 views
How do I choose whether to trust a particular website?
From @GrahamLee's comment over on this question, this is a very good point:
How do I choose whether to trust a particular website when the only information I have relevant to my trust decision is the ...
6
votes
3answers
1k views
Is it possible to get all the data I send through wifi?
Is it possible, that the network administrator (wpa2 wifi network) can log all the data the users send and then get password out of it?
I know it is not possible to get the password if I'm surfing ...
6
votes
2answers
163 views
TPM and storage of keys
A TPM hardware device has very limited non-volatile protected memory just sufficient to store the EK (Endorsement Key) and SRK (Storage Root Key). How does a TPM allow nearly unlimited number of ...
6
votes
4answers
416 views
Alternative to “web of trust”
Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
5
votes
3answers
484 views
Are online hash calculators dangerous?
I was about to use an online MD5 checksum calculator when I realized that my result could be added to a database. This is significant because the string I was going to type in was my bank password. ...
5
votes
3answers
300 views
How to verify crypto engine?
If I understand this correctly, when I use a cryptographic (hardware) engine, I have to trust it. Are there any cryptographic algorithms with properties that allow me to verify the correctness of an ...
5
votes
1answer
129 views
How can a new website create trust with users?
Earlier I asked a question on how to authenticate business identities, now I am wondering on the other side (the user side).
There is also How do I choose whether to trust a particular website?
How ...
5
votes
3answers
180 views
Is it safe to generate passwords online?
I usually generate strong passwords using various online tools. Some time ago I mentioned it to friend of mine and he looked at me as if my life was one big fail. Is it really so unsafe to generate ...
5
votes
1answer
44 views
'Trusted CA Certificates' and 'Trusted remote Certificates'
What is the difference between Trusted CA Certificates and Trusted remote Certificates?
5
votes
1answer
105 views
Trusted Timestamping Scope and Real-World Uses
What security assurances does Trusted Timestamping based on Cryotography provide?
What are the real-world uses of Trusted Timestamping?
5
votes
2answers
110 views
How can a certificate be valid in the Hybrid Model but not in the Chain Model?
All dates in European format!
I am learning about validity models, but the solution for this assignment confuses me.
Translation:
The relevant data for the applicable certificates are shown ...
4
votes
4answers
241 views
How to determine whether site is secure from common user's point of view?
What should be done (or at least declared) so end-users, visitors will start trusting your website?
Some thoughts:
secured login (via https)
privacy policy (hidden email and other private ...
4
votes
3answers
1k views
Is client side encryption really better than server side?
Web application may encrypt all user data at client side to convince users that it can't decrypt them.
When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
3
votes
1answer
159 views
Is there a way to store user files without being able to decrypt them?
I'd want to build a secure file storage web application.
Currently ordinary password authentication is used for login. After login this password is used for encryption and decryption of user files at ...
3
votes
1answer
96 views
How safe is “trust this computer” option for websites?
Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
3
votes
1answer
77 views
What is the current status of trust management?
It is almost 30 years now since Ken Thompson presented his widely known ACM Turing Award Lecture "Reflections on Trusting Trust". What is the current status of practice and research on trust ...
3
votes
1answer
80 views
How does an end user differentiate between OV and DV certificates?
This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
2
votes
3answers
227 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
2
votes
1answer
100 views
Trust linux images burned from untrusted systems
For securitys sake I'm assuming my system is successfully compromised after a targeted and/or non-targeted attack.
I've downloaded some linux images and burned them to do a re-install.
Since I can't ...
2
votes
2answers
196 views
Trust and signing: full public key or thumbprint?
Imagine a B2B service where two parties need to set up a two-way trust relationship: Alice will only accept requests from Bob, and Bob wants to know his requests are only going to Alice.
When ...
2
votes
2answers
316 views
HTTPS verification failed - get certificate information iPad/iPhone
I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
1
vote
3answers
238 views
What is the best way to get a third party audit done of website security?
I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
1
vote
1answer
62 views
Are there negative influences in the Web of Trust? If not, are there theoretical alternatives?
Suppose I encounter a trusted PGP key that isn't really who they say they are. I don't want to sign their key and promote that entity.
Can I somehow show my dissidence from the trust that everyone ...
0
votes
1answer
392 views
How do I deploy AD in a hostile location? What are the security implications between Domains, Forests vs RODC's in Active Directory?
Short version
What are the risks/ benefits / drawbacks of RODC's vs Child Domains vs Forest Trusts in AD
Background
I'm working with a company that has various business agreements between many ...
-6
votes
4answers
200 views
Is TLS-in-TLS supported in any software? Does it make sense? [closed]
I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
