Questions tagged [trust]

A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.

Filter by
Sorted by
Tagged with
0
votes
0answers
34 views

How safe is it to use a Github Action contributed by a third party?

I'm considering using a Github Action from the Github Marketplace to back up some of my source code to an AWS S3 bucket. My question is this: I found a Github Action, written by a third-party open ...
1
vote
2answers
91 views

What happens if one certificate path is valid while the other one is not?

I have recently figured out that Lets Encrypt provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it ...
1
vote
1answer
60 views

How should I securely rsync to a host with a self-signed certificate on a private network?

I have a backup server that has a self-signed certificate (x509) and another server on the same network. I would like to rsync data to the backup server from the other server. However, I prefer not to ...
0
votes
0answers
114 views

Is there a more convenient, yet safe, way to run DOSBox-X than I'm currently doing it?

I recently learned about DOSBox-X. It's basically a somewhat less awful version of the basically-abandoned DOSBox. I currently have it installed inside a Windows 10 VM inside of my Windows 10 bare ...
1
vote
2answers
71 views

How to assess a website's trustworthiness?

How do you assess the trustworthiness of a new website? Especially to download and then install software from. Edit: My underlying concern is to: Trust the website. Trust the website to not inject ...
32
votes
16answers
13k views

How can I prove to users that my obfuscated code is not malicious without unobfuscating?

I created my own anti-adblock system, that does something similar to services like BlockAdblock except mine goes about Adblocker detection in a different manner (and so far cannot be bypassed like ...
0
votes
0answers
72 views

Cloud storage data integrity without trusting the server

Assuming I am using a cloud storage provider like Google Drive, how do I know that data hasn't been lost, deleted, modified or created by the service provider? I think the answer is that it is not ...
0
votes
1answer
111 views

Does End-To-End-Encryption in Web Applications require trust?

In a talk from Moxie Marlinspike he mentioned that Signal does not intend to release a web application because they are impossible to audit. The javascript code is retrieved on each page load, so it ...
2
votes
2answers
137 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
1
vote
0answers
85 views

Hardware roots of trust nowadays

I find that names and terms used in relation to Trusted (Trustworthy, Confidential,..) Computing are highly interchanged and thus creating confusion for laymen as am I. Trusted Computing has been ...
0
votes
0answers
85 views

What is the difference betwen a Trusted Computing Base and a Root of Trust?

What is the difference betwen a Trusted Computing Base (TCB) and a Root of Trust (RoT)? Can both terms be used interchangeably? A TCB is defined by the NIST as follows: Totality of protection ...
1
vote
1answer
70 views

How secure is to authorize a website to "trust your device"?

A bank has a form of 2FA where, after you put in your username and password, they send a code via SMS to your mobile phone and you have to put that too. On the screen asking for the SMS code, there ...
1
vote
1answer
85 views

Can a client prove to a third party that they sent a message to another client in a P2P network?

Let's say Alice sends a message to Bob in their P2P chat app asking him to complete some work. Bob is lazy, so he deletes the message off his machine, does not complete the work, and just claims that ...
2
votes
1answer
95 views

Chrome extensions: tool to notify users of ownership change (to avoid malicious code injection)?

A problem with Chrome extensions was raised in an earlier question: extension owners can sell their extension to another owner, who can then insert malicious code. From a user's perspective, they may ...
1
vote
0answers
123 views

What to do when you simply cannot trust anyone anymore? [closed]

I need a CSS crusher and it must be made in PHP or be a very trusted stand-alone CLI application. The only thing I can find is this: https://github.com/peteboere/css-crush It's not been updated in ...
5
votes
1answer
11k views

What really is the difference between firmware TPM and a discreet one and should it be trusted more?

What really is the difference between a physical TPM and any implementation of a fTPM? I get that both adhere to the same specification and in my mind should be the same thing, but then, I don't ...
0
votes
0answers
24 views

Practical ways to tell if a Chrome extension is safe? [duplicate]

After reading about Emails a browser extension developer gets from scammers (and the comments here) I understand that there are people who try to convince good addon developers to introduce shady (or ...
1
vote
1answer
76 views

Are reproducible builds practically possible on major app stores?

'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it. But numerous sources1,2 indicate reproducible builds are very ...
0
votes
2answers
184 views

Can I trust opera browser free VPN?

When traffic leaves the VPN, the operator of the VPN server can see the websites I'm accessing. Opera browser has a free VPN. Can I trust this VPN? https://www.opera.com/features/free-vpn
2
votes
0answers
602 views

Is `gpg --refresh-keys` secure and where is this documented?

From the gpg manual: --refresh-keys Request updates from a keyserver for keys that already exist on the local keyring. This is useful for updating a key with the latest signatures, user IDs, etc. ...
0
votes
2answers
77 views

Academic/Campus WiFi Security - Setup: Open

At CERN the WiFi used, is not using any encryption. This means that it is a plain, standard Wi-Fi network with no authentication. However, it is mandatory to register each device when first connecting ...
0
votes
1answer
93 views

who should create a CSR, the developer or system management? [closed]

I am developing an internal web application. I think it would be a good idea to secure the local web server with an https certificate. I read several postings recommending certificates on local ...
0
votes
1answer
80 views

In what ways can you trust a third party server with your data? [closed]

What can you do that will make it easier for you to trust a third-party server? For example, using Intel sgx enclaves.
0
votes
1answer
66 views

how end certificate refers to intermediate certificate

As far as i know certificate chain is accomplished based on the issuer's CA name. It is possible that the algorithm to create certificate chain first reads end-certificate's issuer area and get the ...
3
votes
1answer
339 views

Validity, Owner Trust, Trust Signatures & Certification Level

Two questions on signatures. I am trying to understand the various types of "trust signature". The man page says, "For more information please read the sections “Trust Signature” and “...
7
votes
3answers
295 views

Zero Knowledge Proof of ownership of an email address

Let's say that we want to develop a blogging service where only people with an @example.com email can contribute. Prior to post submission, the user requests that a large random token be generated by ...
1
vote
1answer
175 views

In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?

I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
2
votes
1answer
99 views

Is uncompromisable obfuscated x86-64 execution possible?

I have a problem which has several layers; Provide a distributed computing plane where actors can voluntarily add and remove computing resources from, the actors are untrusted by default, and thus ...
1
vote
1answer
106 views

How to bootstrap trust in an on-premise environment?

As part of moving from few on-premise monoliths to multiple on-premise microservices, I'm trying to improve the situation where database passwords and other credentials are stored in configuration ...
0
votes
0answers
88 views

Generating trusted random numbers for a group?

Alice and Bob need to share some cryptographically-secure random numbers. Alice does not trust Bob, and Bob does not trust Alice. Clearly, if Alice generates some numbers, and hands them to Bob, Bob ...
2
votes
3answers
103 views

Password checking process for common websites

This will seem like a very basic question, but I wanted to make sure I don't miss something. When you enter your password in a login page and you press enter, what exactly happens right after until ...
1
vote
1answer
85 views

Risk of specific changes to the "Trusted" security zone

Our EDI VAN provides software to transmit sensitive customer and business data between our ERP and their website. This software requires that I add several URLs (including one plain HTTP) to the "...
2
votes
0answers
85 views

"Trusted memory" What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
-3
votes
1answer
215 views

Why, with such insanely powerful computers, are no efforts to speak of spent on security? [closed]

The only technology "news" I ever hear about go on about "performance this" and "performance that". I haven't felt that my computer was "slow" since the 1990s. 20 years ago. Yet this is the only thing ...
0
votes
1answer
138 views

Google approach to device security (BeyondCorp): managed devices and inference engine

I'm reading the BeyondCorp papers and trying to get a very high level idea of how it could be implemented by a small to medium organisation, rather than a behemoth like Google. What kind of software ...
2
votes
1answer
225 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
0
votes
1answer
104 views

Proving authenticity of data accessed over TLS by an untrusted third party

Is there any way an untrusted third party who has access to content from a website over HTTPS can prove the authenticity of the data (i.e. that it was distributed by a server in possession of a ...
1
vote
0answers
81 views

How does a GPG Keyserver deal with conflicting signatures?

Part of the web of trust of GPG is the use of Keyservers to publish/distribute versions of public keys. It's encouraged of course to sign public keys you trust so the the web may grow. How does a ...
1
vote
1answer
10k views

How trustworthy is KMSpico? [closed]

KMSpico is a very common tool to crack Windows. It is considered malware by many malware/virus detection programs. Even so, it is very popular as far as I've seen. Download links I found: https://...
2
votes
2answers
140 views

Understanding how clients handle incomplete certificate chains

How do clients (browser for example) handle a missing intermediate certificate? In the following answer it is explained that they download certificates or use cached certificates: https://security....
0
votes
1answer
473 views

Difference between Trust and Federation

In the context of Identity and Access Management, is my understanding that Trust is between directory services and Federation is between IdP servers correct? I have also come across terms that are ...
2
votes
0answers
245 views

Can developers stop their software from being flagged as malicious by AV products?

This may not be the correct community for this question, I apologize if that's the case. Scenario: A software development company has created a collection of small desktop applications. They have ...
2
votes
2answers
215 views

How can we avoid the Facebook SDK? General: Trusted forge for Android apps?

I know that privacy is dead etc, but I saw a presentation (Link: https://www.youtube.com/watch?v=OTt1AVRQyx0 )about developers of Android apps using the Facebook SDK for whatever reason in their ...
2
votes
1answer
79 views

why use a CA-signed key pair to encrypt SAML2 assertions?

I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions. In this use case, I hold the private key in my Service Provider, and ...
4
votes
2answers
360 views

Can I blindly trust 127.0.0.1?

On my system (Ubuntu Server 18.04, if that matters) I have two servers. They are behind a Nginx reverse proxy (i.e. accessing service.mywebsite.com internaly proxies the request to 127.0.0.1:...
22
votes
8answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
4
votes
2answers
1k views

How to Trust a Self-Signed Certificate

According to Why are self signed certificates not trusted and is there a way to make them trusted?, to trust a self-signed certificate we need to import the root certificate into the trust store of ...
11
votes
4answers
4k views

What are the differences of checking a self-signed certificate vs ignore it?

I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors: Exception in thread "main" ...
3
votes
2answers
384 views

TLS: Clarification on trust in the certificate trust chain

Suppose I have the following trust chain in my trust store: ROOT_CERT | |---INTERMEDIATE_CERT_1 | |---INTERMEDIATE_CERT_2 I know that any certificate that is signed by INTERMEDIATE_CERT_2 ...
3
votes
2answers
302 views

Consequences of trusting a PC from my iPhone

I just trusted my work PC (Windows 10) from my iPhone. I connected the phone via USB to charge it. I didn't open my iPhone 6 files from the PC. I didn't view any pictures and I unplugged it pretty ...

1
2 3 4 5