Questions tagged [confidentiality]

Confidentiality is the property of maintaining the secrecy of an asset. In other words, confidentiality means protecting against the threat of disclosure. It is one of the three key security properties of an asset, along with integrity and availability.

Filter by
Sorted by
Tagged with
69
votes
6answers
54k views

Does SSL/TLS (https) hide the urls being accessed [duplicate]

Suppose I type this in my browser https://www.mysite.com/getsecret?username=alice&password=mysecret and an attacker is watching all traffic from me to my ISP. What information is protected by ...
13
votes
3answers
8k views

Is it possible to get all the data I send through wifi?

Is it possible, that the network administrator (wpa2 wifi network) can log all the data the users send and then get password out of it? I know it is not possible to get the password if I'm surfing ...
6
votes
4answers
18k views

Bank account number and account holder in check exposed?

I'm not sure if this is standard practice in all banking institutions but almost all banks where I've received checks the account number of the issuer is exposed (some even the account name). Isn't ...
7
votes
2answers
8k views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I need ...
11
votes
2answers
2k views

How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?

http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data http://rt.com/news/uk-privacy-internet-freedom-186/ 'Black boxes' will be installed by internet services providers ...
8
votes
4answers
8k views

How effectively can ISPs detect illegal file sharing?

Recently the USA passed a law requiring ISPs to spy on their customers' internet connections to check for illegal file sharing. I assume that they would do this by sniffing packets, but doesn't this ...
33
votes
3answers
10k views

Why can a Tor exit node decrypt data, but not the entry node?

Me -> Node A -> Node B -> Node C -> destination The documentation on Tor always states that only the exit node C can see plain text data. How is this possible without me talking to Node C ...
18
votes
5answers
10k views

Keyboard sniffing through audio recorded typing patterns

I've been thinking about this for a while; I know people are aware of wireless wiretapping of keyboards. However, has there been research on how to wiretap keyboards based on typing patterns? I'm ...
4
votes
3answers
3k views

Google App Engine Security

I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is. Does anyone know if there was ...
11
votes
3answers
1k views

Using encryption inside of SSL connection

We are using SSL to make our connection between clients and backbone servers safer. Does it really make sense if also we use another encryption mechanism to encrypt transmitted data twice? For example,...
5
votes
3answers
3k views

storing the third party credentials in the database/some secure place

This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user. Our system connect to the third party system using ...
37
votes
3answers
4k views

Is passing sensitive data through the process environment secure?

Recently I have been looking for the possibility to pass sensitive information from one process to another (at process startup time) without passing it through the command line or without using a ...
25
votes
6answers
16k views

Why encrypt data in memory?

I saw that KeePass not only encrypts its password-database-file, it also can encrypt the passwords it holds in memory. This is just an example. I thinking of a new project dealing with sensitve / ...
11
votes
6answers
5k views

when is it safe to click through an SSL warning message?

How does a user know if it's safe to click through scary browser warnings about SSL certificates? Ideally, a user should never need to click through these warning messages, but sometimes honest ...
20
votes
5answers
3k views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
11
votes
3answers
8k views

Storing Credit Card Numbers

I'll be making a website with a membership type of option for the website, and I'll be most likely using Authorize.Net to make the transactions, however, I need to know what kind of encryption I can ...
11
votes
1answer
2k views

Can all the (other) recepients of a PGP encrypted message be identified?

Does an encrypted message contain any information about whom it is encrypted to, or at least to how many recipients? And if so, is it at least only obtainable for other recipients or for just anybody?
5
votes
2answers
4k views

How to mask SEPA (IBAN and BIC) information correctly?

I'm currently developing a payment system where users can use SEPA-debit to pay for the service. The user has the ability to enter the data once and can then select the same payment method when making ...
7
votes
1answer
1k views

can multiple encryption of data with multiple keys increase the security?

I mean: does encrypting data multiple times have an effect on diffusion and confusion? Does it increase security, or does it have no effect? Is it useless? Does it make it harder to break the secret, ...
3
votes
3answers
824 views

Any solutions out there to counter shoulder surfing?

I'm talking about an unknown or undetected physical presence who may be looking over your shoulder as you view or type in sensitive information or passwords. Most likely to happen when you are ...
7
votes
4answers
5k views

Is it possible for a third party to sniff data off the line to an ISP and determine what the user is doing?

Can somebody hack the line between my router and service provider and monitor what I'm doing online and what sites I'm visiting?
5
votes
2answers
1k views

Can TLS provide integrity/authentication without confidentiality

It was a bit surprising that Wikipedia has switched to TLS because we all know it's public information available to anyone, but I suppose that the real purpose for that is to provide authentication/...
4
votes
2answers
479 views

When using HTTPS, which part of domain is revealed to ISP? [duplicate]

Let's say you are visiting https://57vdyr6tyuibgyoihp.blogspot.com. Does the ISP only see the blogspot.com part, or the entire 57vdyr6tyuibgyoihp.blogspot.com?
4
votes
3answers
2k views

The history of thumbnails (or just a previous thumbnail) is embedded in an image file?

I was surprised when I cropped an image on Windows Phone, saved it, sent it via e-mail to a PC, and then downloaded it - and the thumbnail in the download folder was the one of original, not cropped ...
1
vote
2answers
925 views

How do I ensure that a VPS host will keep my information private?

Basically, I want to use OpenVPN on a VPS to browse confidentially. However, I don't know much about VPS hosters and to me, it seems to be a hard choice because there are so many. However, I think ...
-3
votes
0answers
6k views

Is TCP more secure than UDP? [duplicate]

I am referring to confidentiality not integrity. are there any security features that UDP lack compared to TCP? According to this paragraph While TACACS uses UDP port 49, TACACS+ uses TCP port 49 ...