Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [trust]

A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.

Filter by
Sorted by
Tagged with
2 votes
0 answers
117 views

Discovery Service as a Trust Anchor for P2P Network?

Context I'm designing a P2P network with a central Discovery Service (providing core info about every platform in the network) but no centralised Auth server. OAuth 2.0 and OpenID Connect will be used ...
joannaW's user avatar
  • 21
1 vote
0 answers
60 views

Minimizing trust assumptions in Messaging Protocols

As I was listening to an interview yesterday, the journalist claimed that his Signal communications were being spied on by the NSA. Whether to believe him or not is subjective. Still, it is an ...
enricobottazzi's user avatar
7 votes
3 answers
5k views

Increasing trust in a downloaded binary

I'm building a tool and users will run it by downloading a binary. What I'm considering is good ways to secure this for the user. There's for me easy ways like "Recommend running this on a new ...
dutt's user avatar
  • 171
1 vote
0 answers
75 views

Is it common practice that vendors put own root certificates on customer devices? [closed]

At work, we are deploying a new VoIP solution, and as part of that, we are supposed to install a custom root certificate on our computers and mobile devices. The manufacturer of that VoIP solution ...
Torsten Bronger's user avatar
2 votes
1 answer
114 views

How to feasibly digital sign high volume documents with CA issued digital certificate?

My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
BambiBundle's user avatar
16 votes
5 answers
9k views

Can fingerprint readers be trusted?

I've recently obtained a new notebook, specifically a Thinkpad. Now I found out that it has a fingerprint reader integrated into the power button. I am skeptical about biometrics as a security ...
programonkey's user avatar
5 votes
4 answers
247 views

How to understand which website is official for a project?

Let's say I want to download a golang. How to understand which website is official for a project without referring to a some kind of authority like Wikipedia or a search engine rank? Is there a ...
Lem's user avatar
  • 53
2 votes
0 answers
780 views

Couldn't establish a secure connection

NordVPN popped up with "Couldn't establish a secure connection." "We couldn't validate this TLS certificate and ensure a secure connection required for NordVPN to run. It looks like ...
Richard's user avatar
  • 21
2 votes
0 answers
342 views

How to wrap/unwrap with TPM2 endorsement key

I have a remote client A which wants to communicate securely with a server B having a discrete TPM. My understanding is that each TPM normally come with a endorsement key from manufacture like ...
feplooptest's user avatar
0 votes
1 answer
132 views

Verifying closed-source services' security [duplicate]

I tried to find a resource about how one verifies a service's security and their claims when they are not open source. Like 1Password, they describe many good approaches that they are using to secure ...
Okoba's user avatar
  • 17
0 votes
1 answer
270 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
Vlad A.'s user avatar
0 votes
1 answer
327 views

What mechanisms exist to detect compromised default certificate private signing keys?

This is partially a follow-up to the these questions: Is visiting HTTPS websites on a public hotspot secure? Can free Wi-Fi hotspot providers snoop on HTTPS communications? I understand of course ...
Tronman's user avatar
  • 101
6 votes
1 answer
228 views

What is the best practice for relying parties to selectively trust certificates in a corporate pki hierarchy?

I have a pki infrastructure for internal company use. In this pki there are multiple registration authorities whose responsibility is to. receive certificate issuance requests verify the identity of ...
Giovanni Spiricchi's user avatar
16 votes
5 answers
6k views

Where does the root of trust actually lie?

We are told that the roots of trust in the PKI are the handful of Certificate Authorities that issue root certificates and sign other certificates and ensure at least some extent of trust to be ...
Jaskaran Veer Singh's user avatar
1 vote
1 answer
632 views

Why include the root certficiate in the chain, if it is already in receiving parts' truststore?

If I have a self-signed CA certificate in my truststore, and I am sent a chain of certificates where the root CA is missing, is this a problem and if so why? Say that the last certificate in the chain ...
A_Weierstrass's user avatar
15 votes
6 answers
7k views

Preventing users from tampering with input

Let's say that I have a single-page web app written in JavaScript and a server-side API, both changeable by me. The app calculates some values based on user input and POSTs these to the API. The ...
TrueWill's user avatar
  • 365
4 votes
1 answer
2k views

Difference between -CAfile and -trusted in OpenSSL verify

openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual: -CAfile <FILE> A file of trusted certificates. The file ...
fast-reflexes's user avatar
1 vote
1 answer
147 views

Looking for a solution: trusted identity with corresponding digital signatures (QES) for intercontinental charity

We are looking for a solution to meet the needs of a UK incorporated charity (CIO) that has three to seven trustees from at least three continents. Obligations as trustees of a board include signing (...
Konchog's user avatar
  • 605
7 votes
2 answers
4k views

How to prevent HTTPS man-in-the-middle with self-signed certificates?

I came across this issue when we implemented a new security solution. Said solution has its own root CA certificate and will create certificates for HTTPS web pages "on the fly". Each HTTPS ...
Bebef's user avatar
  • 79
2 votes
1 answer
427 views

How safe is it to use a Github Action contributed by a third party?

I'm considering using a Github Action from the Github Marketplace to back up some of my source code to an AWS S3 bucket. My question is this: I found a Github Action, written by a third-party open ...
Mark's user avatar
  • 121
1 vote
2 answers
781 views

What happens if one certificate path is valid while the other one is not?

I have recently figured out that Lets Encrypt provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it ...
Ilya Chernomordik's user avatar
0 votes
1 answer
369 views

How should I securely rsync to a host with a self-signed certificate on a private network?

I have a backup server that has a self-signed certificate (x509) and another server on the same network. I would like to rsync data to the backup server from the other server. However, I prefer not to ...
dloy's user avatar
  • 3
0 votes
1 answer
2k views

Is there a more convenient, yet safe, way to run DOSBox-X than I'm currently doing it?

I recently learned about DOSBox-X. It's basically a somewhat less awful version of the basically-abandoned DOSBox. I currently have it installed inside a Windows 10 VM inside of my Windows 10 bare ...
Kalo's user avatar
  • 1
1 vote
2 answers
174 views

How to assess a website's trustworthiness?

How do you assess the trustworthiness of a new website? Especially to download and then install software from. Edit: My underlying concern is to: Trust the website. Trust the website to not inject ...
YetAnotherRandomUser's user avatar
31 votes
16 answers
14k views

How can I prove to users that my obfuscated code is not malicious without unobfuscating?

I created my own anti-adblock system, that does something similar to services like BlockAdblock except mine goes about Adblocker detection in a different manner (and so far cannot be bypassed like ...
pigeonburger's user avatar
0 votes
1 answer
232 views

Does End-To-End-Encryption in Web Applications require trust?

In a talk from Moxie Marlinspike he mentioned that Signal does not intend to release a web application because they are impossible to audit. The javascript code is retrieved on each page load, so it ...
Gamer2015's user avatar
  • 727
2 votes
2 answers
803 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
Akhilesh Gupta's user avatar
1 vote
0 answers
307 views

Hardware roots of trust nowadays

I find that names and terms used in relation to Trusted (Trustworthy, Confidential,..) Computing are highly interchanged and thus creating confusion for laymen as am I. Trusted Computing has been ...
T. Maxx's user avatar
  • 145
0 votes
0 answers
381 views

What is the difference betwen a Trusted Computing Base and a Root of Trust?

What is the difference betwen a Trusted Computing Base (TCB) and a Root of Trust (RoT)? Can both terms be used interchangeably? A TCB is defined by the NIST as follows: Totality of protection ...
DurandA's user avatar
  • 127
1 vote
1 answer
529 views

How secure is to authorize a website to "trust your device"?

A bank has a form of 2FA where, after you put in your username and password, they send a code via SMS to your mobile phone and you have to put that too. On the screen asking for the SMS code, there ...
robertspierre's user avatar
1 vote
1 answer
155 views

Can a client prove to a third party that they sent a message to another client in a P2P network?

Let's say Alice sends a message to Bob in their P2P chat app asking him to complete some work. Bob is lazy, so he deletes the message off his machine, does not complete the work, and just claims that ...
JGut's user avatar
  • 135
1 vote
1 answer
195 views

Chrome extensions: tool to notify users of ownership change (to avoid malicious code injection)? [closed]

A problem with Chrome extensions was raised in an earlier question: extension owners can sell their extension to another owner, who can then insert malicious code. From a user's perspective, they may ...
user108903's user avatar
9 votes
3 answers
21k views

What really is the difference between firmware TPM and a discrete one and should it be trusted more?

What really is the difference between a physical TPM and any implementation of a fTPM? I get that both adhere to the same specification and in my mind should be the same thing, but then, I don't ...
T. Maxx's user avatar
  • 145
0 votes
0 answers
24 views

Practical ways to tell if a Chrome extension is safe? [duplicate]

After reading about Emails a browser extension developer gets from scammers (and the comments here) I understand that there are people who try to convince good addon developers to introduce shady (or ...
stevec's user avatar
  • 1,280
4 votes
2 answers
323 views

Are reproducible builds practically possible on major app stores?

'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it. But numerous sources1,2 indicate reproducible builds are very ...
stevec's user avatar
  • 1,280
0 votes
2 answers
306 views

Can I trust opera browser free VPN?

When traffic leaves the VPN, the operator of the VPN server can see the websites I'm accessing. Opera browser has a free VPN. Can I trust this VPN? https://www.opera.com/features/free-vpn
Joe Smith's user avatar
  • 401
7 votes
1 answer
5k views

Is `gpg --refresh-keys` secure and where is this documented?

From the gpg manual: --refresh-keys Request updates from a keyserver for keys that already exist on the local keyring. This is useful for updating a key with the latest signatures, user IDs, etc. ...
Tino's user avatar
  • 221
0 votes
2 answers
144 views

Academic/Campus WiFi Security - Setup: Open

At CERN the WiFi used, is not using any encryption. This means that it is a plain, standard Wi-Fi network with no authentication. However, it is mandatory to register each device when first connecting ...
wizOfOz's user avatar
0 votes
1 answer
390 views

who should create a CSR, the developer or system management? [closed]

I am developing an internal web application. I think it would be a good idea to secure the local web server with an https certificate. I read several postings recommending certificates on local ...
Roland's user avatar
  • 137
0 votes
1 answer
163 views

In what ways can you trust a third party server with your data? [closed]

What can you do that will make it easier for you to trust a third-party server? For example, using Intel sgx enclaves.
Jack Resone's user avatar
0 votes
1 answer
149 views

how end certificate refers to intermediate certificate

As far as i know certificate chain is accomplished based on the issuer's CA name. It is possible that the algorithm to create certificate chain first reads end-certificate's issuer area and get the ...
Nas Ahmet's user avatar
6 votes
1 answer
1k views

Validity, Owner Trust, Trust Signatures & Certification Level

Two questions on signatures. I am trying to understand the various types of "trust signature". The man page says, "For more information please read the sections “Trust Signature” and “...
Diagon's user avatar
  • 378
8 votes
3 answers
864 views

Zero Knowledge Proof of ownership of an email address

Let's say that we want to develop a blogging service where only people with an @example.com email can contribute. Prior to post submission, the user requests that a large random token be generated by ...
Brian Tracy's user avatar
2 votes
1 answer
628 views

In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?

I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
SpiderRico's user avatar
2 votes
1 answer
163 views

Is uncompromisable obfuscated x86-64 execution possible?

I have a problem which has several layers; Provide a distributed computing plane where actors can voluntarily add and remove computing resources from, the actors are untrusted by default, and thus ...
Shadowjonathan's user avatar
3 votes
1 answer
407 views

How to bootstrap trust in an on-premise environment?

As part of moving from few on-premise monoliths to multiple on-premise microservices, I'm trying to improve the situation where database passwords and other credentials are stored in configuration ...
Peter V. Mørch's user avatar
0 votes
0 answers
324 views

Generating trusted random numbers for a group?

Alice and Bob need to share some cryptographically-secure random numbers. Alice does not trust Bob, and Bob does not trust Alice. Clearly, if Alice generates some numbers, and hands them to Bob, Bob ...
Him's user avatar
  • 130
2 votes
3 answers
295 views

Password checking process for common websites

This will seem like a very basic question, but I wanted to make sure I don't miss something. When you enter your password in a login page and you press enter, what exactly happens right after until ...
Ozwel's user avatar
  • 173
1 vote
1 answer
243 views

Risk of specific changes to the "Trusted" security zone

Our EDI VAN provides software to transmit sensitive customer and business data between our ERP and their website. This software requires that I add several URLs (including one plain HTTP) to the "...
StackOverthrow's user avatar
1 vote
0 answers
183 views

"Trusted memory" What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
Lavender's user avatar
  • 259

1
2 3 4 5