Questions tagged [confidentiality]
Confidentiality is the property of maintaining the secrecy of an asset. In other words, confidentiality means protecting against the threat of disclosure. It is one of the three key security properties of an asset, along with integrity and availability.
187
questions
1
vote
1
answer
96
views
Public client or Confidential client: should I generate a client secret?
I've read about this but I don't fully understand how to choose.
I have two options:
Public client
"A native, browser or mobile-device app. Cognito API requests are made from user systems that ...
- 113
0
votes
1
answer
122
views
Confidential Computing - SQL Server Always Encrypted w/ Secure Enclave - Customer Managed Keys or alternative
I am looking into ways to build a data warehouse that would house confidential data for 1+ clients. The requirement is that our organization can never obtain access to the decrypted data. There would ...
- 101
1
vote
0
answers
39
views
Can the data between Express.js middleware be manipulated/tampered in any way?
In the node.js express.js framework there is middleware support. Let's assume I have two middleware - the first one, which verifies whether the JWT token is legit and not tampered with and the second ...
- 244
1
vote
1
answer
897
views
Is there any danger in refreshing JWT tokens directly without a refresh token?
So I wrote the following logic for my web app:
When a user interacts with the website it initiates a Backend call. In the backend every endpoint has multiple middlewares, of which there is a JWT ...
- 244
1
vote
0
answers
252
views
MySQL encrypt fields and decrypt them with a password
I'm trying to figure out the best approach to store some information into a DB that will only be accessible by specific users through a password.
So let's say I've got user X that stores something ...
- 11
0
votes
1
answer
108
views
How do you trust two different cloud provider servers?
I've found a question with an answer here on Security StackExchange or on Unix StackExchange, but I can't find it anymore apparently :( If you find this answer already, help would be appreciated, I ...
- 1,554
1
vote
0
answers
9k
views
I received an email that someone created Snapchat with my e-mail - is this a known scam?
On July 31 and a second time after around twelve o'clock at night (August 1) I received two E-mails, which asked me to confirm my E-mail to create an Snapchat account and the second one was stating ...
1
vote
2
answers
65
views
Trustless Application Architecture for end-users with secure enclaves
I am working on a project where I want to store end-user private data, but immediately this brings up the trust question of why a user would trust me to hold their data. I don't actually want to hold ...
- 11
-1
votes
1
answer
50
views
Can I use the CIA triad as a sliding scale wrt complexity?
I am looking for a device to explain the compromises that we make for extra layers of security.
For example wrt extra layers: communication like JWT encryption/signing and other sorts of encapsulation ...
- 129
2
votes
1
answer
243
views
Can my ISP know that I have more than one Google Drive account?
So, I have 2 Google Drive accounts. Let's say Drive A and Drive B.
If one day I login/upload to Drive A then log out, then login/upload to Drive B, can they notice that I have 2 different accounts? Or ...
user276916
0
votes
1
answer
226
views
How to securely hash sensitive data and make the hash public, while preventing an attack by someone who know the structure or some part of the data?
In a nutshell, I need:
to hash a file and to make this hash public, to be able to prove data integrity when sharing the data privately with a trusted third party.
to choose the right hashing method ...
- 103
0
votes
0
answers
1k
views
Should I be worried about Ignoring query from non-local network in dnsmasq?
I am using a DNS forwarder, it's not open to the WWW (runs only in the LAN) and in the dnsmasq logs I noticed something off:
Ignoring query from non-local network
Has my network been breached?
...
- 1,554
3
votes
1
answer
378
views
Does "row-level security" actually serve a security purpose?
Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards.
It's supported by most major relational databases, including PostgreSQL, Microsoft ...
- 5,438
0
votes
0
answers
215
views
Are IDS/IPS already implemented on Google Cloud?
I have a partner that is asking "Do you use breach detection/prevention tools?".
I host my service on managed hosting (Heroku) and currently migrating to Google Cloud. Should I be using &...
- 101
-1
votes
2
answers
532
views
connecting to Windows Admin Center using port 443
I want to use Windows Admin Center, but I don't want to install a SSL certificate.
If I were to forward packets from 80 to 443 using firewall rules would they automatically be encrypted?
- 1
0
votes
1
answer
820
views
What hidden metadata might be embedded in a PDF that is not visible "to the naked eye"?
I have edited a PDF file in Acrobat, which left some metadata and I am wondering:
What metadata might be possible to discern from the end file if I were to send it to external parties?
What actions ...
- 101
0
votes
1
answer
292
views
Can this logic with regard to checking Reverse DNS records be flawed?
For my web app, I hardcode a reverse DNS detection for common web crawlers. And for detecting them I use their Reverse DNS, which I always check whether it includes i.e. google.com. My questions would ...
- 244
0
votes
1
answer
140
views
Why can't you give special security cookies to a specific crawler so that they could securely crawl the website?
In the current day and age we have the problem of malicious/spam crawlers and similar concerns.
My suggestion would be implementing cookie support for crawling and by that I mean giving specific ...
- 244
1
vote
0
answers
414
views
Do anti-cheat software actually "patch" the UEFI firmware on your motherboard?
I've recently read about the new game called Bloodhunt containing an Anti-Cheat, which had a bug, in which the anti-cheat service would stay installed even though the game is removed. The top Steam ...
- 1,554
0
votes
1
answer
581
views
ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?
Are files put into the Pages/Shared folder public to the whole WWW if the website is hosted publicly? I am asking since I want to implement a partial view load thru a controller and want to know ...
- 244
0
votes
1
answer
380
views
Is malware a threat vector for REST APIs?
Let's assume we have REST API in which you accept GET and POST HTTP requests without the ability to execute files.
Is it possible to execute malware in this scenario?
Would there be any justifiable ...
- 159
9
votes
9
answers
4k
views
Can proprietary protocols be considered as secured?
I am new to the info-sec industry and was recently tasked with evaluating the communication protocols used by my various subsystems.
So it was stated in the requirements that the systems have to ...
- 99
-1
votes
1
answer
143
views
Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]
I believe it would violate all the three aspects due to following reasons:
Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
- 3
0
votes
2
answers
551
views
How do I do asymmetric/hybrid encryption in practice?
Question
I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated.
What do ...
- 175
1
vote
1
answer
205
views
Are hosted bare-metal servers more secure than VPS against unauthorized disclosure?
Our small company needs to store sensitive data in the cloud. We are debating VPS's or rented bare-metal servers due to cost. Our threat model includes malicious sysadmins working at the hosting ...
0
votes
0
answers
91
views
Confidentially seperating web content under single IP address
I am interested in exposing web content to strangers on the internet (Reddit, Discord, ..).
This content I wish to reside on the same web server under which personal web content resides.
(None of this ...
- 101
1
vote
2
answers
2k
views
Is it OK to hash sensitive data, given hashes provide no confidentiality?
Confidentiality is the property of a message whereby no one but the person who knows a secret (let's calle it K) can read the message.
Hashes do not provide confidentiality (data is destroyed, you can'...
- 113
0
votes
0
answers
22
views
Will Internet provider know what sub-page I visited on a site? [duplicate]
Let's say in my address bar I see such link:
Privatebin URL/key interception?
Can somebody besides server and me know that I'm visiting not just security.stackexchangec.com but excactly ../questions/...
- 225
2
votes
1
answer
327
views
how message authentication code share keys?
How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
- 23
7
votes
1
answer
1k
views
Can Google access data in their Confidential Computing VMs?
A cloud operator such as Google can take a snapshot of a normal VM. This includes CPU state, RAM and disk. This can then be copied to another physical and resumed there. Or it can be analyzed off-line,...
- 342
2
votes
1
answer
831
views
Is there any point in using PGP or S/MIME when your receipients mostly don't use it?
For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
- 244
1
vote
0
answers
300
views
Keeping data confidential from the system administrator
Problem
How do I ensure that I cannot access confidential data manually through the database? Practically speaking, this is a firestore database on google cloud, and I have access to the administrator ...
- 111
0
votes
0
answers
957
views
Passing confidential data to an IFrame
There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to ...
- 198
0
votes
1
answer
151
views
Is using full TLS suite in all communication scenarios a defacto standard?
Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad.
...
- 173
2
votes
1
answer
117
views
Alternative approaches to letting users identify themselves while maintaining privacy
This is kind of a weird question maybe, so let me explain a little background first that I hope is relevant.
I work as a Developer/Analyst for an organization that operates in a federated model with ...
- 123
0
votes
0
answers
427
views
What are the main differences between a covert timing channel and a covert storage channel?
I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages.
Is ...
- 13
24
votes
4
answers
11k
views
Why define CIA in security like this?
As we know CIA of the demand for security means:
Confidentiality
Integrity
Availability
I don't understand why define the "Integrity" and "Availability`,
If we make a plaintext Confidentiality, the ...
- 935
0
votes
1
answer
1k
views
Forced to install certificate on my laptop when using company WiFi. Risk? [duplicate]
My company has a 'bring your own device' policy. You connect your device to the WiFi, and then open a citrix environment through a web portal. Basically, everything inside the citrix env is company-...
- 103
6
votes
1
answer
11k
views
How do you securely delete httpOnly cookies previously used for login?
I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the ...
- 244
2
votes
0
answers
110
views
Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?
Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
- 963
3
votes
3
answers
400
views
How to Prove you created Intellectual Property (IP) using a Notary
Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
- 618
1
vote
1
answer
134
views
What's the safest way to store data on a server abroad? [closed]
A very good friend of mine is a journalist in a country where the state is becoming more and more despotic.
She would like to store critical data on a server abroad. Is there any service that would ...
- 113
2
votes
2
answers
117
views
MongoIDs and confidentiality
Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually ...
0
votes
3
answers
4k
views
Can importing an .ics file be dangerous?
Can there theoretically be any possible malicious code hidden in .ics files, which would steal your calendar data or something similar? For an example case, we'd be importing the .ics file into Google ...
- 1,554
1
vote
2
answers
1k
views
What is the difference between concealment and secrecy in context of confidentiality?
I just started studying up for the CISSP and am having trouble understanding few concepts.
This is regarding confidentiality, Below are some of the aspects of confidentiality
Sensitivity
Discretion
...
- 159
3
votes
2
answers
214
views
How do ERP systems track classified business activity?
One of the selling points of Enterprise Resource Planning systems like SAP or Oracle E-Business Suite is their claim to give management visibility across the business, by aggregating (or at least ...
- 133
0
votes
3
answers
358
views
I found a website that lists all the email addresses of Facebook users in UK. What do I do? [closed]
I came across this very peculiar website that supposedly lists the email addresses of Facebook users in the UK. I will not be posting the URL for obvious reasons.
I entered a couple of emails to see ...
0
votes
0
answers
202
views
When sharing confidential information, which is more secure share via Outlook vs store on Sharepoint then provide access?
I'm trying to figure out what is good practice and what is more secure for my small team.
I wanted to set a standard or governance on how to share confidential information within our team. One person ...
- 101
1
vote
1
answer
665
views
Why do I see bridged devices when monitoring Wi-Fi activity?
I'm trying to figure out what information about my infrastructure can leak through Wi-Fi.
I ran Kismet and was surprised to see that a few minutes later, Kismet displayed not only the MAC addresses ...
- 4,734
2
votes
2
answers
203
views
Can the System Admin (the main guy with all the permissions) decrypt confidential data from the server?
We have a company Foo, we have user data all encrypted that are stored in some kind of a database.
Correct me if I am wrong, the encryption keys have to be saved in the system.
Now say the admin ...
- 135