Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [trust]

A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.

1
vote
0answers
30 views

What guidelines can I follow to know if I can trust a software editor?

At work or at home, I often find some useful piece of software. Sometimes I may find it on a forum, mentioned on a video, or by talking to a colleague. But how do I know if the editor of the software ...
1
vote
0answers
28 views

Trust boundaries for webapps (vs desktop apps)

I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted. In some cases, our ...
0
votes
1answer
15 views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
0
votes
1answer
74 views

Is it desirable to obtain a brand ssl certificate for a password generator?

I need an advice. I have created a password generator, which creates strong passwords on local PC (its a Progressive Web App). But there is one problem: most site visitors are distrustful to the ...
1
vote
1answer
57 views

Deutsche Bank PhotoTan app signed with self-signed certificate?

Deutsche Bank recently started forcing its customers to switch their transaction authentication from iTAN to PhotoTAN. Now I wanted to verify the authenticity of the Android app like this: # ...
2
votes
1answer
131 views

Powershell says microsoft's own ps1 script is insecure, should I proceed with running the script?

I am trying to update Powershell to version 5.1 which I have downloaded directly from Microsoft's website. The download's are signed from Microsoft (although the signatures are expired by a few ...
0
votes
1answer
77 views

Why should I trust the OAuth Providers? [duplicate]

I am trying to understand how OAuth really works. So far I understood the workflow of the authentication process, but I don't get why it is that safe to use a third party OAuth provider. I mean they ...
1
vote
1answer
72 views

How does blockchain client trust other nodes?

If we consider any blockchain based system (bitcoin, for example), how does initial trust setup works? When a new user wants to join blockchain network, how does the client know that it talks to ...
1
vote
0answers
34 views

TPM and trust in cloud provider [closed]

I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
-1
votes
1answer
80 views

Can mp3 files be malicious? [duplicate]

I have an old computer that I don't use for anything important or sensitive. I occasionally download music on this old computer and transfer the mp3 files from a usb onto my primary computer. These ...
2
votes
1answer
280 views

How does verifying the chain of trust for certificate based authentication work on the server side?

Right now I need to import the Root-CA's cert, the Intermediate-CA's cert and the Client cert on the client for it to be able to connect to the server. The server has access to the Root-CA's cert via ...
0
votes
1answer
32 views

Do I need to trust my Paas provider?

I am currently entering the world of deploying my web application to the cloud. While trying out Paas providers like heroku, I realized, that the platform has full access to my application. The ...
1
vote
1answer
36 views

Must all ssl certificates for a domain be trusted?

I've read that it's possible to have multiple certificates on one domain. My question is whether all these certificates should be trusted and valid or whether one valid trusted certificate is enough ...
5
votes
3answers
86 views

How do I diagram a network node with multiple layers of trust?

If I'm communicating security and trust over a network, I might simply note trusted and untrusted nodes. For example, when making an HTTPS connection over some kind proxy node that I own and operate, ...
3
votes
3answers
149 views

Can TPM be used in the same way as TrustZone area?

Can I program the TPM chip to execute a piece of code securely just like executing code in the TrustZone area? In particular, the application will be running in the normal world, but parts of it ...
3
votes
1answer
68 views

External vendor has requested to join our Active Directory Domain

We've received a request from a vendor who wishes to join two computers from their network into our AD Domain. The vendor is proposing to provide a vertical application installed on their servers ...
0
votes
1answer
212 views

Preventing fraud in bitcoin mining pools [closed]

So bitcoin mining pools are very common, almost no one mines alone, because of the great difficulty in mining a block. So mining in a pool has pretty much been the standard. However, how do people ...
4
votes
1answer
75 views

Restrict compilation to certain machines

I am a software developer in a big company. I just realised that I could technically clone the repository of my employers git repository. The infrastructure is in docker images. So technically this ...
0
votes
1answer
47 views

Processing sensitive user data on a server without the possibility of data theft?

I have written an application which I would like to offer via REST API to customers. In the task which is executed on the server there is some sensitive user data involved, e.g. the user's login to a ...
5
votes
1answer
424 views

How should I choose a trust model in GnuPG?

GnuPG offers a set of different trust models, but the manual isn't sufficient (for me at least) to figure out which one to use. Ideally, I would like a trust model that accepts the trust I explicitly ...
2
votes
1answer
94 views

Is RMI considered untrusted input even with TLS?

If an application has an RMI API that's used internally (servers communicating with one another), is the information coming from those calls considered trusted or validation is still required? I can'...
5
votes
3answers
110 views

Is blockchain security dependent on number of transactions in time?

I have a basic understanding of how blockchain technologies works. I know that in depends on the ledger where are transactions recorded and can be effectivelly verified. No one should be able to ...
3
votes
0answers
64 views

Do iPhones contain a cryptographically secure authentication mechanism?

Firstly is it true that iPhones have a trusted execution environment that can be used to protect asymmetric key pairs for which the private portion of the key cannot be exported by any means other ...
3
votes
1answer
106 views

When installing a new software repository, is it required to check the repository key fingerprint?

I'm recording a video about installing some software from a vendor repository. At some point, I download the GPG key for the remote repository and check manually its fingerprint before adding key and ...
1
vote
1answer
2k views

Trust Boundary Definition and Example

I am very confused with Trust Boundary. How does this work? Do I draw a trust boundary in between the application tier and the web tier because my servers in the web tier has a higher chances of ...
2
votes
1answer
194 views

How to get my OpenPGP keys signed?

I was wondering if anyone has any recommendations for getting my OpenPGP key signed by others. I live in the middle of nowhere, and there aren't meetup groups within 50 miles of me ever. How to get ...
1
vote
0answers
38 views

Is there any financial rating of electronic trading platforms?

There are too many different online stores and paid services in the Internet! Some are big and popular, other aren't. I search for some universal financial rating of electronic trading platforms or, ...
2
votes
1answer
904 views

what are the risks associated with an incomplete certificate chain

What are the actual risks associated with an incomplete certificate chain I read about certificate chains and I think I understand the concept but I seem to not understand the potential risks, for ...
1
vote
0answers
108 views

How can car-to-car communication be trusted? [closed]

Giving autonomous vehicles the ability to communicate has a lot of potential benefits: the entire network of cars will be able to operate with more information, making everything more efficient. That ...
4
votes
1answer
197 views

Prevent Chrome extensions from betraying me

As has been discussed in this answer, a flaw with the Chrome Web Store is that an honest-but-naive developer may sell a popular browser extension to someone like Techno SoLotions, assuming that Techno ...
1
vote
1answer
68 views

Building a “Hello, world!” X.509-based system for establishing trust between servers

I want to build a distributed software system with the following elements: A number of workers, which manage potentially sensitive data and execute code on behalf of a number of clients. A number of ...
3
votes
1answer
343 views

Enumerate forest trust relationships

I'm trying to up my Windows domain enumeration game. I'm doing some exercises where I'm tasked to find the forest trust relationships without exploitation or creds or being on the domain. All ...
4
votes
3answers
1k views

Is it acceptable for an employer to install a self-signed root certificate on employees personal devices at home?

At work, my employer uses a self-signed root certificate to MITM all of our SSL/TLS traffic. Many of our internal certificates used by various micro-services and internal websites are also signed by ...
0
votes
1answer
65 views

How to properly implement encrypted connection between two parties who trust each other with SSL?

I would like to have a reliable (as in TCP) encrypted (authenticity, integrity, confidentiality) connection between program A and program B. I am the creator of both A and B. I want A to communicate ...
-1
votes
2answers
118 views

Can cryptography be used to compare and verify time-sensitive responses from untrusted web servers? [closed]

In card games like poker it is critical that players do not know the hands of the other players until they simultaneously show their cards to see who has won. Is there a cryptographic technique to ...
1
vote
2answers
79 views

Protecting digital assets from insider threats

Are there any security mechanisms that can protect a company from malicious employees (think database administrators, sysadmins responsible for authentication etc) trying to steal the customer data? ...
31
votes
4answers
4k views

Should I trust a website which breaks when I use a complex password?

A website "broke" after I changed my password to something like "NÌÿÖÏï£Ø¥üQ¢¨¼Ü9¨ÝIÇÅbÍm". I was unable to log in, and customer service deleted my account and had me create a new one. Does this ...
1
vote
1answer
83 views

Fair Conscription

It is interesting to read about the random number generation problems in the last USA conscription. If, for the same purpose, we need a random permutation of the 366 birthdays, what should the ...
0
votes
1answer
135 views

Is it possible to enroll on behalf if only public key of client is known?

I have the following scenario: I have a lot of embedded devices that should talk to another. To enable trust between these devices I would like to use certificates. The devices generate a keypair and ...
6
votes
1answer
203 views

What are the drawbacks of non-PKI or distributed Key Management systems?

I just came across the Milagro project which seems to be solving some of the limitations introduced by PKI (centralized trust authorities with single point of failure hard-to-revoke root keys, using X....
3
votes
1answer
798 views

Will two intermediate CAs signed by the same root CA trust each other's signed client certs?

I have two intermediate CAs that each sign certificates for their client users, like this: ROOT CA / \ / \ / \ Intermediate ...
3
votes
1answer
581 views

How issuer's certificate is found to verify a given certificate?

I'm trying to understand how digital signing using x509 certificates works. I read a few articles and related answers on the web, but still there are a few questions left to confirm my understanding: ...
163
votes
26answers
20k views

Convince people not to share their password with trusted others

IT workers are usually trusted by their family members who readily share passwords (Facebook, email, twitter, you-name-it!) so they can get easy help to set what-ever-parameter they don't find or ...
2
votes
0answers
95 views

How to put the “trust” into trusted-timestamping

As a part of my thesis, I am about to evaluate different approaches to establish the trust in trusted-timestamping performed by a TSA (see RFC3161 - Trusted Timestamp Protocol). A trustworthy ...
0
votes
0answers
201 views

What is the current status of the zero trust model?

I read of the apprarently ambitious goals of the "zero trust model". Has it found success in practice or encountered problems? A link that may be useful is: https://www.forrester.com/The+Security+...
1
vote
0answers
25 views

Is it safe to build and untrusted Sphinx document?

We would like to build a kind of wiki engine and Sphinx seems like the perfect tool for our project, given a complicated list of requirements we have. So the question is how safe it would be to run ...
1
vote
1answer
93 views

Confusion about trusting certificate chains

Assume you have a client/server pair which wants to set up a secure connection using X509 v3 certificates and asymmetric cryptography. The client sends a chain of certificates (let's say Root CA: C1, ...
7
votes
1answer
629 views

Why does Microsoft use a digital signature catalog instead of a signature in the executable?

I own a code signing certificate, so I can add digital signatures on files that contain executable code. Microsoft seems to use a "new" way and provides most digital signatures not in the file itself ...
2
votes
1answer
320 views

Do not trust all intermediate certificates

I have a trust store containing SSL certificate chain up to Root CA certificate: Root CA -> Intermediate CA - SSL certificate According what I saw as a best practice, only Root CA certificate should ...
1
vote
2answers
88 views

Trust companies for information storage?

Most people have personal information on many sites such as Amazon or smaller sites. When we type create an account and add details like our address and the place where we work, it is never said how ...