Questions tagged [confidentiality]

Confidentiality is the property of maintaining the secrecy of an asset. In other words, confidentiality means protecting against the threat of disclosure. It is one of the three key security properties of an asset, along with integrity and availability.

Filter by
Sorted by
Tagged with
4
votes
1answer
2k views

Authentication as CIA triad

As we all know, information security principles are stated as CIA triad, i.e., confidentiality, integrity, and availability. I wonder why authentication is not a part of CIA triad as being an ...
4
votes
3answers
3k views

Google App Engine Security

I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is. Does anyone know if there was ...
4
votes
2answers
554 views

When using HTTPS, which part of domain is revealed to ISP? [duplicate]

Let's say you are visiting https://57vdyr6tyuibgyoihp.blogspot.com. Does the ISP only see the blogspot.com part, or the entire 57vdyr6tyuibgyoihp.blogspot.com?
4
votes
1answer
249 views

Gravatar - Is it a security risk for medical forums?

If site forums use Gravatar, and the users are predominantly posting personal information about mental health issues, is this a security risk? Should the site consider turning off, or allowing opt ...
4
votes
1answer
14k views

Is there a specification for the color values representing information classification levels for the United States? [closed]

Executive Order 13526 section 1.2.⁠ Specifies Information may be classified as Top Secret, Secret, and Confidential. The absense of a classification is Unclassified. US Classification Levels are used ...
4
votes
3answers
39k views

authenticity, confidentiality & integrity - general questions

I am pretty new when it comes to information security. And before I move on with more specific things I wanted to ask if I understood the three main parts of IPsec correctly: authenticity, ...
4
votes
3answers
3k views

The history of thumbnails (or just a previous thumbnail) is embedded in an image file?

I was surprised when I cropped an image on Windows Phone, saved it, sent it via e-mail to a PC, and then downloaded it - and the thumbnail in the download folder was the one of original, not cropped ...
4
votes
2answers
171 views

Internet browsing confidentiality [duplicate]

I wonder how easy or difficult it is to find out who I am, using information security's most advanced techniques. And what can I do that will not affect my browsing experience too much, as a lambda ...
4
votes
0answers
756 views

How is it possible for threatmetrix to detect VPN? [duplicate]

Threatmetrix is a fraud prevention SaaS aimed at preventing fraud. Their company website states: ThreatMetrix is also uniquely able to uncover hackers and fraudsters trying to cover their true ...
3
votes
2answers
998 views

Sharing encrypted data

I have a web app that is storing information related to a organization that I would like to encrypt but share amongst organization members. I would only like the members of the organization to be able ...
3
votes
2answers
4k views

How Is It Possible For Hackers To “Dig Up The Dirt” On People?

Like the title says, I was wondering how its possible for hackers to "dig up the dirt" and get peoples personal information such as address, credit cards, bank accounts, social insurance number, etc? ...
3
votes
2answers
514 views

Confidentiality and integrity for web session

When the client authenticates with our service, he is issued an opaque "token". This token includes the information, that identifies the client and some other information about the client ("payload"). ...
3
votes
3answers
980 views

Any solutions out there to counter shoulder surfing?

I'm talking about an unknown or undetected physical presence who may be looking over your shoulder as you view or type in sensitive information or passwords. Most likely to happen when you are ...
3
votes
3answers
5k views

What do browser VPNs actually do?

Firstly, I am not sure if this is the correct forum to be asking this question so I apologise if not. What I would like to know is, what do VPN browser plug-ins (such as zenmate) actually do and how ...
3
votes
3answers
222 views

In what situations are web services required to protect confidentiality of user information?

I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential. Under what other situations ...
3
votes
2answers
677 views

What does it mean to have authentication without confidentiality or authentication without encryption?

I came across these functions m+EeA(H(m)) (for authentication without confidentiality) and m+H(m+k) (for authentication without encryption) and I'm having a bit of a difficult time understanding them. ...
3
votes
1answer
197 views

Imagine I found a fast algorithm for prime factorization. What to do? Who to contact? [closed]

I'm often playing around with prime numbers, just for fun. Imagine, I found an algorithm by accident that factorizes numbers into their prime parts exactly as fast as multiplicating them in the first ...
3
votes
1answer
220 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
3
votes
1answer
2k views

iPhone iOS 7 Encryption at Lock Screen

Following this topic, I have a question about how the OS and apps access data while the phone is locked. Particularly in the case of iPhone 5S running iOS 7. When the device is locked, what allows ...
3
votes
4answers
422 views

Is a pre-shared secret enough for encryption?

Suppose: A and B are initially configured to possess the same key. -- the key is only known by the pair -- no key needs to be public A has an algorithm, a, that takes a message(plain text), ...
3
votes
2answers
1k views

Shutdown: Clear virtual memory pagefile

I was reading about Windows Local Policy of "Shutdown: Clear virtual memory pagefile". I need some clarification on this brief policy description: What do it mean by operating system that allow ...
3
votes
1answer
106 views

Is this a valid secure cookie scheme?

I have a scheme for a cookie with high-level confidentiality of information. The information to be hidden from the client is the expiration time of the cookie. I am wondering what insecurities i am ...
3
votes
2answers
1k views

PHP processing form submission, how can I best protect sensitive information submitted via the form?

I am using PHP 5.6 on Apache 2.4 I have a form that will collect sensitive information about the user that need to be encrypted. My current solution grabs the sensitive information from the POST and ...
3
votes
2answers
122 views

How do ERP systems track classified business activity?

One of the selling points of Enterprise Resource Planning systems like SAP or Oracle E-Business Suite is their claim to give management visibility across the business, by aggregating (or at least ...
2
votes
3answers
10k views

Are private pastes on pastebin.com vulnerable? Can you trust pastebin?

I use https://pastebin.com/ to organize some lists. When I select "Paste Exposure: Private" , will it be really private and only accessible via login? I read somewhere in the internet that there are ...
2
votes
2answers
3k views

Keeping valuable algorithms secret

Given a securities trading algorithm that is very effective and thereby very valuable, how do you keep it secret and protect it from theft or copying? What techniques or architecture is the best? The ...
2
votes
1answer
94 views

Can the System Admin (the main guy with all the permissions) decrypt confidential data from the server?

We have a company Foo, we have user data all encrypted that are stored in some kind of a database. Correct me if I am wrong, the encryption keys have to be saved in the system. Now say the admin ...
2
votes
2answers
2k views

HMAC and non-repudiation

This was a question on an exam: Two persons are using a one way communication channel and the HMAC functionality (concretely HMAC-SHA1). Choose the correct statement below: 1) We can prove who the ...
2
votes
1answer
292 views

SSL/TLS in-memory data interception after decryption

In a scenario where a client is reading data from a server over SSL/TLS and then encrypts that data using a client-side symmetric key before saving it to the disk, how susceptible is the data to an in-...
2
votes
1answer
483 views

Securely notify users about account changes

I am developing a web application (using PHP) and I am wondering what the best way is to notify users that someone updated their account information? The information that can be updated includes: ...
2
votes
1answer
97 views

How good is confidentiality with physical mail forwarding companies? [closed]

I want to use a mail forwarding company that can receive mail for me and forward it to another address. I found many places that do this, but I am worried that eventually my stalker would find out ...
2
votes
1answer
1k views

How do you securely delete httpOnly cookies previously used for login?

I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the ...
2
votes
2answers
56 views

MongoIDs and confidentiality

Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually ...
2
votes
1answer
103 views

Digital testament

I have been thinking about a way of storing a "digital testament" without using a physical safe, which is the typical solution I have read. Here is my idea roughly: Generate a strong key pair using ...
2
votes
0answers
56 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
2
votes
0answers
73 views

Is common_schema safe?

Edit: this already has an answer here. I just ran across common_schema, a utility for MySQL database administrators. It is a SQL script that creates a schema called common_schema in your database and ...
1
vote
2answers
958 views

How do I ensure that a VPS host will keep my information private?

Basically, I want to use OpenVPN on a VPS to browse confidentially. However, I don't know much about VPS hosters and to me, it seems to be a hard choice because there are so many. However, I think ...
1
vote
2answers
136 views

What policies and agreements regarding information security are a must have for every self respecting company?

I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. What kind of documents should be considered? For example (...
1
vote
2answers
134 views

What are the security implications of losing a paper calendar?

Assuming I have a paper calendar (organizer) with the following information on it: dates/locations where I have been and where I'm planning to go phone numbers and e-mail addresses of a few people my ...
1
vote
1answer
940 views

Should I trust zxcvbn with my password?

I want to measure current and future password entropy with the zxcvbn formula. Is there any way to test and detect if the input on this website is truly confidential? EDIT: 1. I found an ...
1
vote
2answers
103 views

How to Prove you created IP using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
1
vote
2answers
410 views

Is unclassified a classification?

The answer many sources provide is "technically, no, unclassified is not a classification", but they often are referring specifically to Unclassified SBU or FOUO. Besides that... any answer that ...
1
vote
1answer
510 views

Does steganography ensure confidentiality?

Can we say that steganography ensures confidentiality? I think it does not ensure because it is based on the security through obscurity and then it does not respect Kerckhoffs's principles, but the ...
1
vote
1answer
523 views

Are there different degrees of “confidentiality”? What is the best way for a psychologist to maintain confidentiality of communications with patients?

A non-tech savvy friend of mine is a psychologist. She has many patients who constantly invite her to communicate through all sorts of mediums such as text, email, voicemail, and other mediums. But ...
1
vote
3answers
1k views

Is PGP suitable for encrypting webservices?

I would like to know if I can use of PGP to ensure SOAP webservices confidentiality? I don't want use SSL, it's kind of slow mechanism to make a tunnel for high throughput data transaction. I though ...
1
vote
1answer
204 views

Is it safe to put the output of 'strace' online?

For debugging purposes, one might be asked to put the output of strace for some process online, i.e. attached to a bug report. Is this safe in general? Under what circumstances is this safe or ...
1
vote
1answer
107 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
1
vote
1answer
189 views

Security aspect vs Security goal

What is the difference between a security goal and a security aspect ? I know about the three network security goals Confidentiality, Integrity and Availability. But I do not know much about security ...
1
vote
2answers
221 views

Identify a user using random characters of the password

Assuming a password is not stored in plain-text, how is it possible that a support guy is able to identify during a phone call a customer by asking him random characters of his password? For example, ...
1
vote
2answers
283 views

Confidentiality and integrity

Users permissions and privilege should be considered as a part of confidentiality (specifically access control) or integrity? And I'm also wondering if we can categorize Accountability, Authenticity ...