Questions tagged [trust]

A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.

Filter by
Sorted by
Tagged with
10
votes
4answers
4k views

What are the differences of checking a self-signed certificate vs ignore it?

I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors: Exception in thread "main" ...
2
votes
2answers
89 views

TLS: Clarification on trust in the certificate trust chain

Suppose I have the following trust chain in my trust store: ROOT_CERT | |---INTERMEDIATE_CERT_1 | |---INTERMEDIATE_CERT_2 I know that any certificate that is signed by INTERMEDIATE_CERT_2 ...
0
votes
1answer
95 views

Accidentally “trusted” work PC when I connected my iPhone 6 - can my employers still see my pictures after I unplug it?

I just trusted my work PC (Windows 10). I didn't open my iPhone 6 files. I didn't view any pictures and I unplugged it pretty quick after I accidentally trusted it. I was wondering if my employers ...
2
votes
0answers
69 views

How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?

The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...
3
votes
1answer
83 views

SSO level of trust external identity providers

I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our ...
1
vote
1answer
124 views

Is it safe to enable - Trust Access to the VBA object model - Microsoft Office

I am trying to run a VBS script which calls a macro and won't run unless I click "Trust Access to the VBA object model" in Microsoft Office Trust Center. I forget where I read it but I thought I read ...
0
votes
1answer
153 views

Is the zero trust approach really so safe? [closed]

Recently, I see so many emerging vendors that are advertising their use of zero-trust. What potential risks are we exposed to if we shift to zero-trust in our bank?
1
vote
2answers
77 views

How to sign a text in a way, so it can not be altered or split in parts unacknowledged

Given, I want to create a document (text-only for the sake of this question) and give it to someone I do not trust. I am not allowed to publish it myself. It's probably not going to be published (...
-1
votes
2answers
106 views

How can I ensure that I can trust to OS?

How can I ensure that some OS can be trusted? I'm not speaking about possible security problems which can happen everywhere but about something like a backdoor left by a developer. Can such a thing ...
1
vote
3answers
310 views

Ken Thompson's compiler hack

I have gone through Ken Thompson's compiler hack paper; can't we just go through the compiler's source code and check for any backdoor, what was the article's point? Can we be sure that there are no ...
0
votes
2answers
128 views

Could someone recommend me a citable definition of honest but curious/semi-trusted?

As far as I know honest but curious or also called semi-trusted means that a client follows protocol but will try to learn as much information as possible, without actively “cheating”. Does anyone ...
0
votes
0answers
29 views

Re-establish trust while minimizing persistent tokens

I'm trying to solve what appears to be a chicken-and-egg problem. When a machine appears on my network, how do I know that it is whom it asserts to be? Suppose, for instance, the host has an ...
1
vote
1answer
41 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
1
vote
0answers
36 views

What guidelines can I follow to know if I can trust a software editor?

At work or at home, I often find some useful piece of software. Sometimes I may find it on a forum, mentioned on a video, or by talking to a colleague. But how do I know if the editor of the software ...
1
vote
0answers
48 views

Trust boundaries for webapps (vs desktop apps)

I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted. In some cases, our ...
0
votes
1answer
82 views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
0
votes
1answer
99 views

Is it desirable to obtain a brand ssl certificate for a password generator?

I need an advice. I have created a password generator, which creates strong passwords on local PC (its a Progressive Web App). But there is one problem: most site visitors are distrustful to the ...
1
vote
1answer
115 views

Deutsche Bank PhotoTan app signed with self-signed certificate?

Deutsche Bank recently started forcing its customers to switch their transaction authentication from iTAN to PhotoTAN. Now I wanted to verify the authenticity of the Android app like this: # ...
3
votes
1answer
172 views

Powershell says microsoft's own ps1 script is insecure, should I proceed with running the script?

I am trying to update Powershell to version 5.1 which I have downloaded directly from Microsoft's website. The download's are signed from Microsoft (although the signatures are expired by a few ...
0
votes
1answer
79 views

Why should I trust the OAuth Providers? [duplicate]

I am trying to understand how OAuth really works. So far I understood the workflow of the authentication process, but I don't get why it is that safe to use a third party OAuth provider. I mean they ...
1
vote
1answer
81 views

How does blockchain client trust other nodes?

If we consider any blockchain based system (bitcoin, for example), how does initial trust setup works? When a new user wants to join blockchain network, how does the client know that it talks to ...
1
vote
0answers
43 views

TPM and trust in cloud provider [closed]

I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
0
votes
1answer
162 views

Can mp3 files be malicious? [duplicate]

I have an old computer that I don't use for anything important or sensitive. I occasionally download music on this old computer and transfer the mp3 files from a usb onto my primary computer. These ...
2
votes
1answer
374 views

How does verifying the chain of trust for certificate based authentication work on the server side?

Right now I need to import the Root-CA's cert, the Intermediate-CA's cert and the Client cert on the client for it to be able to connect to the server. The server has access to the Root-CA's cert via ...
0
votes
1answer
35 views

Do I need to trust my Paas provider?

I am currently entering the world of deploying my web application to the cloud. While trying out Paas providers like heroku, I realized, that the platform has full access to my application. The ...
1
vote
1answer
39 views

Must all ssl certificates for a domain be trusted?

I've read that it's possible to have multiple certificates on one domain. My question is whether all these certificates should be trusted and valid or whether one valid trusted certificate is enough ...
5
votes
3answers
91 views

How do I diagram a network node with multiple layers of trust?

If I'm communicating security and trust over a network, I might simply note trusted and untrusted nodes. For example, when making an HTTPS connection over some kind proxy node that I own and operate, ...
3
votes
3answers
185 views

Can TPM be used in the same way as TrustZone area?

Can I program the TPM chip to execute a piece of code securely just like executing code in the TrustZone area? In particular, the application will be running in the normal world, but parts of it ...
3
votes
1answer
73 views

External vendor has requested to join our Active Directory Domain

We've received a request from a vendor who wishes to join two computers from their network into our AD Domain. The vendor is proposing to provide a vertical application installed on their servers ...
0
votes
1answer
257 views

Preventing fraud in bitcoin mining pools [closed]

So bitcoin mining pools are very common, almost no one mines alone, because of the great difficulty in mining a block. So mining in a pool has pretty much been the standard. However, how do people ...
4
votes
1answer
75 views

Restrict compilation to certain machines

I am a software developer in a big company. I just realised that I could technically clone the repository of my employers git repository. The infrastructure is in docker images. So technically this ...
0
votes
1answer
48 views

Processing sensitive user data on a server without the possibility of data theft?

I have written an application which I would like to offer via REST API to customers. In the task which is executed on the server there is some sensitive user data involved, e.g. the user's login to a ...
5
votes
1answer
555 views

How should I choose a trust model in GnuPG?

GnuPG offers a set of different trust models, but the manual isn't sufficient (for me at least) to figure out which one to use. Ideally, I would like a trust model that accepts the trust I explicitly ...
2
votes
1answer
108 views

Is RMI considered untrusted input even with TLS?

If an application has an RMI API that's used internally (servers communicating with one another), is the information coming from those calls considered trusted or validation is still required? I can'...
5
votes
3answers
116 views

Is blockchain security dependent on number of transactions in time?

I have a basic understanding of how blockchain technologies works. I know that in depends on the ledger where are transactions recorded and can be effectivelly verified. No one should be able to ...
3
votes
0answers
68 views

Do iPhones contain a cryptographically secure authentication mechanism?

Firstly is it true that iPhones have a trusted execution environment that can be used to protect asymmetric key pairs for which the private portion of the key cannot be exported by any means other ...
3
votes
1answer
127 views

When installing a new software repository, is it required to check the repository key fingerprint?

I'm recording a video about installing some software from a vendor repository. At some point, I download the GPG key for the remote repository and check manually its fingerprint before adding key and ...
1
vote
1answer
2k views

Trust Boundary Definition and Example

I am very confused with Trust Boundary. How does this work? Do I draw a trust boundary in between the application tier and the web tier because my servers in the web tier has a higher chances of ...
2
votes
1answer
215 views

How to get my OpenPGP keys signed?

I was wondering if anyone has any recommendations for getting my OpenPGP key signed by others. I live in the middle of nowhere, and there aren't meetup groups within 50 miles of me ever. How to get ...
1
vote
0answers
39 views

Is there any financial rating of electronic trading platforms?

There are too many different online stores and paid services in the Internet! Some are big and popular, other aren't. I search for some universal financial rating of electronic trading platforms or, ...
3
votes
1answer
1k views

what are the risks associated with an incomplete certificate chain

What are the actual risks associated with an incomplete certificate chain I read about certificate chains and I think I understand the concept but I seem to not understand the potential risks, for ...
2
votes
0answers
112 views

How can car-to-car communication be trusted? [closed]

Giving autonomous vehicles the ability to communicate has a lot of potential benefits: the entire network of cars will be able to operate with more information, making everything more efficient. That ...
4
votes
1answer
224 views

Prevent Chrome extensions from betraying me

As has been discussed in this answer, a flaw with the Chrome Web Store is that an honest-but-naive developer may sell a popular browser extension to someone like Techno SoLotions, assuming that Techno ...
1
vote
1answer
84 views

Building a “Hello, world!” X.509-based system for establishing trust between servers

I want to build a distributed software system with the following elements: A number of workers, which manage potentially sensitive data and execute code on behalf of a number of clients. A number of ...
3
votes
1answer
408 views

Enumerate forest trust relationships

I'm trying to up my Windows domain enumeration game. I'm doing some exercises where I'm tasked to find the forest trust relationships without exploitation or creds or being on the domain. All ...
5
votes
3answers
2k views

Is it acceptable for an employer to install a self-signed root certificate on employees personal devices at home?

At work, my employer uses a self-signed root certificate to MITM all of our SSL/TLS traffic. Many of our internal certificates used by various micro-services and internal websites are also signed by ...
0
votes
1answer
71 views

How to properly implement encrypted connection between two parties who trust each other with SSL?

I would like to have a reliable (as in TCP) encrypted (authenticity, integrity, confidentiality) connection between program A and program B. I am the creator of both A and B. I want A to communicate ...
-1
votes
2answers
118 views

Can cryptography be used to compare and verify time-sensitive responses from untrusted web servers? [closed]

In card games like poker it is critical that players do not know the hands of the other players until they simultaneously show their cards to see who has won. Is there a cryptographic technique to ...
1
vote
2answers
86 views

Protecting digital assets from insider threats

Are there any security mechanisms that can protect a company from malicious employees (think database administrators, sysadmins responsible for authentication etc) trying to steal the customer data? ...
31
votes
4answers
4k views

Should I trust a website which breaks when I use a complex password?

A website "broke" after I changed my password to something like "NÌÿÖÏï£Ø¥üQ¢¨¼Ü9¨ÝIÇÅbÍm". I was unable to log in, and customer service deleted my account and had me create a new one. Does this ...