Questions tagged [confidentiality]
Confidentiality is the property of maintaining the secrecy of an asset. In other words, confidentiality means protecting against the threat of disclosure. It is one of the three key security properties of an asset, along with integrity and availability.
194 questions
1
vote
1
answer
69
views
Is form data as is being inputted always safe?
When filling out forms in the browser is the client side input secure against JS and other attack vectors?
- 1,675
1
vote
1
answer
61
views
Risks from sharing screen recording of mobile Australia licence
A Swiss Unicorn scanning software company is asking for a screen recording of my digital driving licence via UpWorks a freelance marketplace.
They're using Aphaia as outsourced DPO.
What are the risks ...
- 121
14
votes
2
answers
4k
views
Should mail addresses for logins be stored hashed to minimize impact of data loss?
I'm currently designing a user authentication system for a web application, and I am considering best practices for storing user login information. While it's common to hash and salt passwords (with ...
- 715
1
vote
1
answer
117
views
Why does IPsec has a "partial" replay protection? If we drop all packets outside the moving window, then where is the threat?
IPsec is said to have "partial" replay protection because if a packet arrives outside the window, we can't track it, so we have to make a choice: do we risk and accept it, or do we drop it?
...
- 197
15
votes
7
answers
5k
views
Preventing Javascript in a browser from connecting to servers
I have a webpage I would like to use locally (the JSON-LD Playground). It appears to be designed to operate without connecting to a server. I would like to have a strong confidentiality guarantee ...
- 9,436
0
votes
0
answers
52
views
What attacks can be performed by changing header of IP packet if I apply only ESPv2 of IPsec(so not providing intergrity for the IP header)
For ESPv2 I'm referring to this: https://datatracker.ietf.org/doc/html/rfc2406 so the version which supports of course confidentiality, but also authentication ONLY FOR THE PAYLOAD, NOT of the IP ...
- 197
1
vote
1
answer
164
views
What if in IPsec I have confidentiality BUT NOT integrity? What are the dangers?
ESP in IPsec v2 only provides integrity of the payload, not of the header. So my question is about that. The possible dangers in not having integrity of header, while having ESP active for payload.
...
- 137
0
votes
1
answer
208
views
Wireguard client configuration file - confidential values
Given a Wireguard client configuration file, I guess some of the fields shouldn't be shared with just anyone, like the private key, right?
Is there any other field that should be treated as a ...
- 101
2
votes
1
answer
972
views
Public client or Confidential client: should I generate a client secret?
I've read about this but I don't fully understand how to choose.
I have two options:
Public client
"A native, browser or mobile-device app. Cognito API requests are made from user systems that ...
- 123
0
votes
1
answer
222
views
Confidential Computing - SQL Server Always Encrypted w/ Secure Enclave - Customer Managed Keys or alternative
I am looking into ways to build a data warehouse that would house confidential data for 1+ clients. The requirement is that our organization can never obtain access to the decrypted data. There would ...
- 101
1
vote
0
answers
76
views
Can the data between Express.js middleware be manipulated/tampered in any way?
In the node.js express.js framework there is middleware support. Let's assume I have two middleware - the first one, which verifies whether the JWT token is legit and not tampered with and the second ...
- 264
1
vote
1
answer
1k
views
Is there any danger in refreshing JWT tokens directly without a refresh token?
So I wrote the following logic for my web app:
When a user interacts with the website it initiates a Backend call. In the backend every endpoint has multiple middlewares, of which there is a JWT ...
- 264
1
vote
0
answers
325
views
MySQL encrypt fields and decrypt them with a password
I'm trying to figure out the best approach to store some information into a DB that will only be accessible by specific users through a password.
So let's say I've got user X that stores something ...
- 11
0
votes
1
answer
156
views
How do you trust two different cloud provider servers?
I've found a question with an answer here on Security StackExchange or on Unix StackExchange, but I can't find it anymore apparently :( If you find this answer already, help would be appreciated, I ...
- 1,675
1
vote
2
answers
109
views
Trustless Application Architecture for end-users with secure enclaves
I am working on a project where I want to store end-user private data, but immediately this brings up the trust question of why a user would trust me to hold their data. I don't actually want to hold ...
- 11
-1
votes
1
answer
89
views
Can I use the CIA triad as a sliding scale wrt complexity?
I am looking for a device to explain the compromises that we make for extra layers of security.
For example wrt extra layers: communication like JWT encryption/signing and other sorts of encapsulation ...
- 129
2
votes
1
answer
293
views
Can my ISP know that I have more than one Google Drive account?
So, I have 2 Google Drive accounts. Let's say Drive A and Drive B.
If one day I login/upload to Drive A then log out, then login/upload to Drive B, can they notice that I have 2 different accounts? Or ...
user276916
0
votes
1
answer
405
views
How to securely hash sensitive data and make the hash public, while preventing an attack by someone who know the structure or some part of the data?
In a nutshell, I need:
to hash a file and to make this hash public, to be able to prove data integrity when sharing the data privately with a trusted third party.
to choose the right hashing method ...
- 103
0
votes
0
answers
2k
views
Should I be worried about Ignoring query from non-local network in dnsmasq?
I am using a DNS forwarder, it's not open to the WWW (runs only in the LAN) and in the dnsmasq logs I noticed something off:
Ignoring query from non-local network
Has my network been breached?
...
- 1,675
3
votes
1
answer
640
views
Does "row-level security" actually serve a security purpose?
Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards.
It's supported by most major relational databases, including PostgreSQL, Microsoft ...
- 5,468
0
votes
0
answers
607
views
Are IDS/IPS already implemented on Google Cloud?
I have a partner that is asking "Do you use breach detection/prevention tools?".
I host my service on managed hosting (Heroku) and currently migrating to Google Cloud. Should I be using &...
- 101
-1
votes
2
answers
789
views
connecting to Windows Admin Center using port 443
I want to use Windows Admin Center, but I don't want to install a SSL certificate.
If I were to forward packets from 80 to 443 using firewall rules would they automatically be encrypted?
- 1
0
votes
1
answer
3k
views
What hidden metadata might be embedded in a PDF that is not visible "to the naked eye"?
I have edited a PDF file in Acrobat, which left some metadata and I am wondering:
What metadata might be possible to discern from the end file if I were to send it to external parties?
What actions ...
- 101
0
votes
1
answer
526
views
Can this logic with regard to checking Reverse DNS records be flawed?
For my web app, I hardcode a reverse DNS detection for common web crawlers. And for detecting them I use their Reverse DNS, which I always check whether it includes i.e. google.com. My questions would ...
- 264
0
votes
1
answer
177
views
Why can't you give special security cookies to a specific crawler so that they could securely crawl the website?
In the current day and age we have the problem of malicious/spam crawlers and similar concerns.
My suggestion would be implementing cookie support for crawling and by that I mean giving specific ...
- 264
1
vote
0
answers
660
views
Do anti-cheat software actually "patch" the UEFI firmware on your motherboard?
I've recently read about the new game called Bloodhunt containing an Anti-Cheat, which had a bug, in which the anti-cheat service would stay installed even though the game is removed. The top Steam ...
- 1,675
0
votes
1
answer
741
views
ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?
Are files put into the Pages/Shared folder public to the whole WWW if the website is hosted publicly? I am asking since I want to implement a partial view load thru a controller and want to know ...
- 264
0
votes
1
answer
608
views
Is malware a threat vector for REST APIs?
Let's assume we have REST API in which you accept GET and POST HTTP requests without the ability to execute files.
Is it possible to execute malware in this scenario?
Would there be any justifiable ...
- 159
9
votes
9
answers
4k
views
Can proprietary protocols be considered as secured?
I am new to the info-sec industry and was recently tasked with evaluating the communication protocols used by my various subsystems.
So it was stated in the requirements that the systems have to ...
- 99
-1
votes
1
answer
223
views
Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]
I believe it would violate all the three aspects due to following reasons:
Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
- 3
1
vote
2
answers
859
views
How do I do asymmetric/hybrid encryption in practice?
Question
I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated.
What do ...
- 185
1
vote
1
answer
248
views
Are hosted bare-metal servers more secure than VPS against unauthorized disclosure?
Our small company needs to store sensitive data in the cloud. We are debating VPS's or rented bare-metal servers due to cost. Our threat model includes malicious sysadmins working at the hosting ...
0
votes
0
answers
118
views
Confidentially seperating web content under single IP address
I am interested in exposing web content to strangers on the internet (Reddit, Discord, ..).
This content I wish to reside on the same web server under which personal web content resides.
(None of this ...
- 101
1
vote
2
answers
2k
views
Is it OK to hash sensitive data, given hashes provide no confidentiality?
Confidentiality is the property of a message whereby no one but the person who knows a secret (let's calle it K) can read the message.
Hashes do not provide confidentiality (data is destroyed, you can'...
- 113
0
votes
0
answers
26
views
Will Internet provider know what sub-page I visited on a site? [duplicate]
Let's say in my address bar I see such link:
Privatebin URL/key interception?
Can somebody besides server and me know that I'm visiting not just security.stackexchangec.com but excactly ../questions/...
- 225
2
votes
1
answer
438
views
how message authentication code share keys?
How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
- 23
7
votes
1
answer
1k
views
Can Google access data in their Confidential Computing VMs?
A cloud operator such as Google can take a snapshot of a normal VM. This includes CPU state, RAM and disk. This can then be copied to another physical and resumed there. Or it can be analyzed off-line,...
- 372
2
votes
1
answer
1k
views
Is there any point in using PGP or S/MIME when your receipients mostly don't use it?
For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
- 264
1
vote
0
answers
399
views
Keeping data confidential from the system administrator
Problem
How do I ensure that I cannot access confidential data manually through the database? Practically speaking, this is a firestore database on google cloud, and I have access to the administrator ...
- 111
0
votes
0
answers
1k
views
Passing confidential data to an IFrame
There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to ...
- 198
0
votes
1
answer
185
views
Is using full TLS suite in all communication scenarios a defacto standard?
Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad.
...
- 183
2
votes
1
answer
151
views
Alternative approaches to letting users identify themselves while maintaining privacy
This is kind of a weird question maybe, so let me explain a little background first that I hope is relevant.
I work as a Developer/Analyst for an organization that operates in a federated model with ...
- 123
0
votes
0
answers
489
views
What are the main differences between a covert timing channel and a covert storage channel?
I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages.
Is ...
- 13
24
votes
4
answers
11k
views
Why define CIA in security like this?
As we know CIA of the demand for security means:
Confidentiality
Integrity
Availability
I don't understand why define the "Integrity" and "Availability`,
If we make a plaintext Confidentiality, the ...
- 935
0
votes
1
answer
2k
views
Forced to install certificate on my laptop when using company WiFi. Risk? [duplicate]
My company has a 'bring your own device' policy. You connect your device to the WiFi, and then open a citrix environment through a web portal. Basically, everything inside the citrix env is company-...
- 103
7
votes
1
answer
14k
views
How do you securely delete httpOnly cookies previously used for login?
I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the ...
- 264
2
votes
0
answers
144
views
Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?
Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
- 953
3
votes
3
answers
496
views
How to Prove you created Intellectual Property (IP) using a Notary
Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
- 694
1
vote
1
answer
163
views
What's the safest way to store data on a server abroad? [closed]
A very good friend of mine is a journalist in a country where the state is becoming more and more despotic.
She would like to store critical data on a server abroad. Is there any service that would ...
- 113
2
votes
2
answers
155
views
MongoIDs and confidentiality
Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually ...
