Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [confidentiality]

Confidentiality is the property of maintaining the secrecy of an asset. In other words, confidentiality means protecting against the threat of disclosure. It is one of the three key security properties of an asset, along with integrity and availability.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
35 views

Bell-Lapadula model "Execute" permission

In all BLP model descriptions I've seen, the permissions set is defined to be {Read, Write, Append, Execute}. None of the three BLP security properties The Simple Security Property states that a ...
hegash's user avatar
  • 99
0 votes
0 answers
35 views

What attacks can be performed by changing header of IP packet if I apply only ESPv2 of IPsec(so not providing intergrity for the IP header)

For ESPv2 I'm referring to this: https://datatracker.ietf.org/doc/html/rfc2406 so the version which supports of course confidentiality, but also authentication ONLY FOR THE PAYLOAD, NOT of the IP ...
allexj's user avatar
  • 21
1 vote
1 answer
128 views

What if in IPsec I have confidentiality BUT NOT integrity? What are the dangers?

ESP in IPsec v2 only provides integrity of the payload, not of the header. So my question is about that. The possible dangers in not having integrity of header, while having ESP active for payload. ...
Allexj's user avatar
  • 137
0 votes
1 answer
108 views

Wireguard client configuration file - confidential values

Given a Wireguard client configuration file, I guess some of the fields shouldn't be shared with just anyone, like the private key, right? Is there any other field that should be treated as a ...
matteo-g's user avatar
  • 101
2 votes
1 answer
486 views

Public client or Confidential client: should I generate a client secret?

I've read about this but I don't fully understand how to choose. I have two options: Public client "A native, browser or mobile-device app. Cognito API requests are made from user systems that ...
BigMistake's user avatar
0 votes
1 answer
187 views

Confidential Computing - SQL Server Always Encrypted w/ Secure Enclave - Customer Managed Keys or alternative

I am looking into ways to build a data warehouse that would house confidential data for 1+ clients. The requirement is that our organization can never obtain access to the decrypted data. There would ...
jackie's user avatar
  • 101
1 vote
0 answers
72 views

Can the data between Express.js middleware be manipulated/tampered in any way?

In the node.js express.js framework there is middleware support. Let's assume I have two middleware - the first one, which verifies whether the JWT token is legit and not tampered with and the second ...
Munchkin's user avatar
  • 264
1 vote
1 answer
1k views

Is there any danger in refreshing JWT tokens directly without a refresh token?

So I wrote the following logic for my web app: When a user interacts with the website it initiates a Backend call. In the backend every endpoint has multiple middlewares, of which there is a JWT ...
Munchkin's user avatar
  • 264
1 vote
0 answers
311 views

MySQL encrypt fields and decrypt them with a password

I'm trying to figure out the best approach to store some information into a DB that will only be accessible by specific users through a password. So let's say I've got user X that stores something ...
Yamile's user avatar
  • 11
0 votes
1 answer
149 views

How do you trust two different cloud provider servers?

I've found a question with an answer here on Security StackExchange or on Unix StackExchange, but I can't find it anymore apparently :( If you find this answer already, help would be appreciated, I ...
Sir Muffington's user avatar
1 vote
2 answers
101 views

Trustless Application Architecture for end-users with secure enclaves

I am working on a project where I want to store end-user private data, but immediately this brings up the trust question of why a user would trust me to hold their data. I don't actually want to hold ...
vin42tau's user avatar
-1 votes
1 answer
80 views

Can I use the CIA triad as a sliding scale wrt complexity?

I am looking for a device to explain the compromises that we make for extra layers of security. For example wrt extra layers: communication like JWT encryption/signing and other sorts of encapsulation ...
hendry's user avatar
  • 129
2 votes
1 answer
280 views

Can my ISP know that I have more than one Google Drive account?

So, I have 2 Google Drive accounts. Let's say Drive A and Drive B. If one day I login/upload to Drive A then log out, then login/upload to Drive B, can they notice that I have 2 different accounts? Or ...
user avatar
0 votes
1 answer
293 views

How to securely hash sensitive data and make the hash public, while preventing an attack by someone who know the structure or some part of the data?

In a nutshell, I need: to hash a file and to make this hash public, to be able to prove data integrity when sharing the data privately with a trusted third party. to choose the right hashing method ...
J-J-J's user avatar
  • 103
0 votes
0 answers
1k views

Should I be worried about Ignoring query from non-local network in dnsmasq?

I am using a DNS forwarder, it's not open to the WWW (runs only in the LAN) and in the dnsmasq logs I noticed something off: Ignoring query from non-local network Has my network been breached? ...
Sir Muffington's user avatar
3 votes
1 answer
507 views

Does "row-level security" actually serve a security purpose?

Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards. It's supported by most major relational databases, including PostgreSQL, Microsoft ...
watchowl's user avatar
  • 5,458
0 votes
0 answers
434 views

Are IDS/IPS already implemented on Google Cloud?

I have a partner that is asking "Do you use breach detection/prevention tools?". I host my service on managed hosting (Heroku) and currently migrating to Google Cloud. Should I be using &...
Dev01's user avatar
  • 101
-1 votes
2 answers
679 views

connecting to Windows Admin Center using port 443

I want to use Windows Admin Center, but I don't want to install a SSL certificate. If I were to forward packets from 80 to 443 using firewall rules would they automatically be encrypted?
Keith's user avatar
  • 1
0 votes
1 answer
2k views

What hidden metadata might be embedded in a PDF that is not visible "to the naked eye"?

I have edited a PDF file in Acrobat, which left some metadata and I am wondering: What metadata might be possible to discern from the end file if I were to send it to external parties? What actions ...
Ohan's user avatar
  • 101
0 votes
1 answer
409 views

Can this logic with regard to checking Reverse DNS records be flawed?

For my web app, I hardcode a reverse DNS detection for common web crawlers. And for detecting them I use their Reverse DNS, which I always check whether it includes i.e. google.com. My questions would ...
Munchkin's user avatar
  • 264
0 votes
1 answer
170 views

Why can't you give special security cookies to a specific crawler so that they could securely crawl the website?

In the current day and age we have the problem of malicious/spam crawlers and similar concerns. My suggestion would be implementing cookie support for crawling and by that I mean giving specific ...
Munchkin's user avatar
  • 264
1 vote
0 answers
563 views

Do anti-cheat software actually "patch" the UEFI firmware on your motherboard?

I've recently read about the new game called Bloodhunt containing an Anti-Cheat, which had a bug, in which the anti-cheat service would stay installed even though the game is removed. The top Steam ...
Sir Muffington's user avatar
0 votes
1 answer
688 views

ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?

Are files put into the Pages/Shared folder public to the whole WWW if the website is hosted publicly? I am asking since I want to implement a partial view load thru a controller and want to know ...
Munchkin's user avatar
  • 264
0 votes
1 answer
503 views

Is malware a threat vector for REST APIs?

Let's assume we have REST API in which you accept GET and POST HTTP requests without the ability to execute files. Is it possible to execute malware in this scenario? Would there be any justifiable ...
user1876202's user avatar
9 votes
9 answers
4k views

Can proprietary protocols be considered as secured?

I am new to the info-sec industry and was recently tasked with evaluating the communication protocols used by my various subsystems. So it was stated in the requirements that the systems have to ...
Lucas's user avatar
  • 99
-1 votes
1 answer
202 views

Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]

I believe it would violate all the three aspects due to following reasons: Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
LoneWolf's user avatar
1 vote
2 answers
705 views

How do I do asymmetric/hybrid encryption in practice?

Question I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated. What do ...
Fax's user avatar
  • 185
1 vote
1 answer
239 views

Are hosted bare-metal servers more secure than VPS against unauthorized disclosure?

Our small company needs to store sensitive data in the cloud. We are debating VPS's or rented bare-metal servers due to cost. Our threat model includes malicious sysadmins working at the hosting ...
Neil Ferdinand's user avatar
0 votes
0 answers
115 views

Confidentially seperating web content under single IP address

I am interested in exposing web content to strangers on the internet (Reddit, Discord, ..). This content I wish to reside on the same web server under which personal web content resides. (None of this ...
reign's user avatar
  • 101
1 vote
2 answers
2k views

Is it OK to hash sensitive data, given hashes provide no confidentiality?

Confidentiality is the property of a message whereby no one but the person who knows a secret (let's calle it K) can read the message. Hashes do not provide confidentiality (data is destroyed, you can'...
joaquinlpereyra's user avatar
0 votes
0 answers
26 views

Will Internet provider know what sub-page I visited on a site? [duplicate]

Let's say in my address bar I see such link: Privatebin URL/key interception? Can somebody besides server and me know that I'm visiting not just security.stackexchangec.com but excactly ../questions/...
R S's user avatar
  • 225
2 votes
1 answer
391 views

how message authentication code share keys?

How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
erfan ahmad's user avatar
7 votes
1 answer
1k views

Can Google access data in their Confidential Computing VMs?

A cloud operator such as Google can take a snapshot of a normal VM. This includes CPU state, RAM and disk. This can then be copied to another physical and resumed there. Or it can be analyzed off-line,...
Ole Tange's user avatar
  • 342
2 votes
1 answer
947 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
Munchkin's user avatar
  • 264
1 vote
0 answers
369 views

Keeping data confidential from the system administrator

Problem How do I ensure that I cannot access confidential data manually through the database? Practically speaking, this is a firestore database on google cloud, and I have access to the administrator ...
Programmdude's user avatar
0 votes
0 answers
1k views

Passing confidential data to an IFrame

There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to ...
kremerd's user avatar
  • 198
0 votes
1 answer
177 views

Is using full TLS suite in all communication scenarios a defacto standard?

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. ...
Akhilesh Gupta's user avatar
2 votes
1 answer
140 views

Alternative approaches to letting users identify themselves while maintaining privacy

This is kind of a weird question maybe, so let me explain a little background first that I hope is relevant. I work as a Developer/Analyst for an organization that operates in a federated model with ...
Cowman's user avatar
  • 123
0 votes
0 answers
475 views

What are the main differences between a covert timing channel and a covert storage channel?

I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages. Is ...
Nick's user avatar
  • 13
24 votes
4 answers
11k views

Why define CIA in security like this?

As we know CIA of the demand for security means: Confidentiality Integrity Availability I don't understand why define the "Integrity" and "Availability`, If we make a plaintext Confidentiality, the ...
244boy's user avatar
  • 925
0 votes
1 answer
1k views

Forced to install certificate on my laptop when using company WiFi. Risk? [duplicate]

My company has a 'bring your own device' policy. You connect your device to the WiFi, and then open a citrix environment through a web portal. Basically, everything inside the citrix env is company-...
Jeremy's user avatar
  • 103
7 votes
1 answer
12k views

How do you securely delete httpOnly cookies previously used for login?

I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the ...
Munchkin's user avatar
  • 264
2 votes
0 answers
138 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
Basj's user avatar
  • 953
3 votes
3 answers
451 views

How to Prove you created Intellectual Property (IP) using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
Lance's user avatar
  • 632
1 vote
1 answer
160 views

What's the safest way to store data on a server abroad? [closed]

A very good friend of mine is a journalist in a country where the state is becoming more and more despotic. She would like to store critical data on a server abroad. Is there any service that would ...
Laurent Mesguen's user avatar
2 votes
2 answers
145 views

MongoIDs and confidentiality

Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually ...
Cyril Duchon-Doris's user avatar
0 votes
3 answers
5k views

Can importing an .ics file be dangerous?

Can there theoretically be any possible malicious code hidden in .ics files, which would steal your calendar data or something similar? For an example case, we'd be importing the .ics file into Google ...
Sir Muffington's user avatar
1 vote
2 answers
1k views

What is the difference between concealment and secrecy in context of confidentiality?

I just started studying up for the CISSP and am having trouble understanding few concepts. This is regarding confidentiality, Below are some of the aspects of confidentiality Sensitivity Discretion ...
kudlatiger's user avatar
3 votes
2 answers
240 views

How do ERP systems track classified business activity?

One of the selling points of Enterprise Resource Planning systems like SAP or Oracle E-Business Suite is their claim to give management visibility across the business, by aggregating (or at least ...
Simon Brady's user avatar
0 votes
3 answers
393 views

I found a website that lists all the email addresses of Facebook users in UK. What do I do? [closed]

I came across this very peculiar website that supposedly lists the email addresses of Facebook users in the UK. I will not be posting the URL for obvious reasons. I entered a couple of emails to see ...
Alan Whitteaker's user avatar