Questions tagged [trust]

A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.

Filter by
Sorted by
Tagged with
1
vote
1answer
80 views

Validity, Owner Trust, Trust Signatures & Certification Level

Two questions on signatures. I am trying to understand the various types of "trust signature". The man page says, "For more information please read the sections “Trust Signature” and “...
7
votes
3answers
199 views

Zero Knowledge Proof of ownership of an email address

Let's say that we want to develop a blogging service where only people with an @example.com email can contribute. Prior to post submission, the user requests that a large random token be generated by ...
1
vote
1answer
52 views

In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?

I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
2
votes
1answer
74 views

Is uncompromisable obfuscated x86-64 execution possible?

I have a problem which has several layers; Provide a distributed computing plane where actors can voluntarily add and remove computing resources from, the actors are untrusted by default, and thus ...
0
votes
1answer
70 views

How to bootstrap trust in an on-premise environment?

As part of moving from few on-premise monoliths to multiple on-premise microservices, I'm trying to improve the situation where database passwords and other credentials are stored in configuration ...
0
votes
0answers
47 views

Generating trusted random numbers for a group?

Alice and Bob need to share some cryptographically-secure random numbers. Alice does not trust Bob, and Bob does not trust Alice. Clearly, if Alice generates some numbers, and hands them to Bob, Bob ...
2
votes
3answers
78 views

Password checking process for common websites

This will seem like a very basic question, but I wanted to make sure I don't miss something. When you enter your password in a login page and you press enter, what exactly happens right after until ...
0
votes
1answer
61 views

Risk of specific changes to the “Trusted” security zone

Our EDI VAN provides software to transmit sensitive customer and business data between our ERP and their website. This software requires that I add several URLs (including one plain HTTP) to the "...
2
votes
0answers
57 views

“Trusted memory” What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
-3
votes
1answer
202 views

Why, with such insanely powerful computers, are no efforts to speak of spent on security? [closed]

The only technology "news" I ever hear about go on about "performance this" and "performance that". I haven't felt that my computer was "slow" since the 1990s. 20 years ago. Yet this is the only thing ...
0
votes
1answer
86 views

Google approach to device security (BeyondCorp): managed devices and inference engine

I'm reading the BeyondCorp papers and trying to get a very high level idea of how it could be implemented by a small to medium organisation, rather than a behemoth like Google. What kind of software ...
2
votes
1answer
170 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
0
votes
1answer
62 views

Proving authenticity of data accessed over TLS by an untrusted third party

Is there any way an untrusted third party who has access to content from a website over HTTPS can prove the authenticity of the data (i.e. that it was distributed by a server in possession of a ...
1
vote
0answers
64 views

How does a GPG Keyserver deal with conflicting signatures?

Part of the web of trust of GPG is the use of Keyservers to publish/distribute versions of public keys. It's encouraged of course to sign public keys you trust so the the web may grow. How does a ...
-1
votes
1answer
2k views

How trustworthy is KMSpico? [closed]

KMSpico is a very common tool to crack Windows. It is considered malware by many malware/virus detection programs. Even so, it is very popular as far as I've seen. Download links I found: https://...
0
votes
0answers
23 views

Macros and Trust Center Settings - Alternative Combo of Settings

I asked a question in the about enabling Macro's in the "Trust Center" and the security implications. I have now begun signing my projects with a "Code Signing" certificate and placed that certificate ...
2
votes
2answers
92 views

Understanding how clients handle incomplete certificate chains

How do clients (browser for example) handle a missing intermediate certificate? In the following answer it is explained that they download certificates or use cached certificates: https://security....
0
votes
1answer
163 views

Difference between Trust and Federation

In the context of Identity and Access Management, is my understanding that Trust is between directory services and Federation is between IdP servers correct? I have also come across terms that are ...
2
votes
0answers
140 views

Can developers stop their software from being flagged as malicious by AV products?

This may not be the correct community for this question, I apologize if that's the case. Scenario: A software development company has created a collection of small desktop applications. They have ...
0
votes
0answers
131 views

Azure AD subdomains best practice

I'm setting up an Azure AD subscription for a small retailer with 3 branches and a headquarters (100s of users in each). The branches are self-sufficient and intend to manage their own users. Users ...
2
votes
2answers
144 views

How can we avoid the Facebook SDK? General: Trusted forge for Android apps?

I know that privacy is dead etc, but I saw a presentation (Link: https://www.youtube.com/watch?v=OTt1AVRQyx0 )about developers of Android apps using the Facebook SDK for whatever reason in their ...
2
votes
1answer
52 views

why use a CA-signed key pair to encrypt SAML2 assertions?

I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions. In this use case, I hold the private key in my Service Provider, and ...
3
votes
2answers
315 views

Can I blindly trust 127.0.0.1?

On my system (Ubuntu Server 18.04, if that matters) I have two servers. They are behind a Nginx reverse proxy (i.e. accessing service.mywebsite.com internaly proxies the request to 127.0.0.1:...
22
votes
8answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
4
votes
2answers
751 views

How to Trust a Self-Signed Certificate

According to Why are self signed certificates not trusted and is there a way to make them trusted?, to trust a self-signed certificate we need to import the root certificate into the trust store of ...
11
votes
4answers
4k views

What are the differences of checking a self-signed certificate vs ignore it?

I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors: Exception in thread "main" ...
2
votes
2answers
258 views

TLS: Clarification on trust in the certificate trust chain

Suppose I have the following trust chain in my trust store: ROOT_CERT | |---INTERMEDIATE_CERT_1 | |---INTERMEDIATE_CERT_2 I know that any certificate that is signed by INTERMEDIATE_CERT_2 ...
2
votes
1answer
196 views

Consequences of trusting a PC from my iPhone

I just trusted my work PC (Windows 10) from my iPhone. I connected the phone via USB to charge it. I didn't open my iPhone 6 files from the PC. I didn't view any pictures and I unplugged it pretty ...
2
votes
0answers
184 views

How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?

The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...
3
votes
1answer
128 views

SSO level of trust external identity providers

I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our ...
1
vote
2answers
673 views

Is it safe to enable - Trust Access to the VBA object model - Microsoft Office

I am trying to run a VBS script which calls a macro and won't run unless I click "Trust Access to the VBA object model" in Microsoft Office Trust Center. I forget where I read it but I thought I read ...
1
vote
1answer
189 views

Is the zero trust approach really so safe? [closed]

Recently, I see so many emerging vendors that are advertising their use of zero-trust. What potential risks are we exposed to if we shift to zero-trust in our bank?
1
vote
2answers
84 views

How to sign a text in a way, so it can not be altered or split in parts unacknowledged

Given, I want to create a document (text-only for the sake of this question) and give it to someone I do not trust. I am not allowed to publish it myself. It's probably not going to be published (...
-1
votes
2answers
121 views

How can I ensure that I can trust to OS?

How can I ensure that some OS can be trusted? I'm not speaking about possible security problems which can happen everywhere but about something like a backdoor left by a developer. Can such a thing ...
3
votes
3answers
415 views

Ken Thompson's compiler hack

I have gone through Ken Thompson's compiler hack paper; can't we just go through the compiler's source code and check for any backdoor, what was the article's point? Can we be sure that there are no ...
0
votes
2answers
811 views

Could someone recommend me a citable definition of honest but curious/semi-trusted?

As far as I know honest but curious or also called semi-trusted means that a client follows protocol but will try to learn as much information as possible, without actively “cheating”. Does anyone ...
1
vote
1answer
42 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
1
vote
1answer
124 views

What guidelines can I follow to know if I can trust a software editor? [closed]

At work or at home, I often find some useful piece of software. Sometimes I may find it on a forum, mentioned on a video, or by talking to a colleague. But how do I know if the editor of the software ...
1
vote
0answers
93 views

Trust boundaries for webapps (vs desktop apps)

I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted. In some cases, our ...
0
votes
1answer
320 views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
0
votes
1answer
104 views

Is it desirable to obtain a brand ssl certificate for a password generator?

I need an advice. I have created a password generator, which creates strong passwords on local PC (its a Progressive Web App). But there is one problem: most site visitors are distrustful to the ...
1
vote
1answer
151 views

Deutsche Bank PhotoTan app signed with self-signed certificate?

Deutsche Bank recently started forcing its customers to switch their transaction authentication from iTAN to PhotoTAN. Now I wanted to verify the authenticity of the Android app like this: # ...
3
votes
1answer
329 views

Powershell says microsoft's own ps1 script is insecure, should I proceed with running the script?

I am trying to update Powershell to version 5.1 which I have downloaded directly from Microsoft's website. The download's are signed from Microsoft (although the signatures are expired by a few ...
0
votes
1answer
90 views

Why should I trust the OAuth Providers? [duplicate]

I am trying to understand how OAuth really works. So far I understood the workflow of the authentication process, but I don't get why it is that safe to use a third party OAuth provider. I mean they ...
1
vote
1answer
84 views

How does blockchain client trust other nodes?

If we consider any blockchain based system (bitcoin, for example), how does initial trust setup works? When a new user wants to join blockchain network, how does the client know that it talks to ...
1
vote
0answers
45 views

TPM and trust in cloud provider [closed]

I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
0
votes
1answer
726 views

Can mp3 files be malicious? [duplicate]

I have an old computer that I don't use for anything important or sensitive. I occasionally download music on this old computer and transfer the mp3 files from a usb onto my primary computer. These ...
2
votes
1answer
528 views

How does verifying the chain of trust for certificate based authentication work on the server side?

Right now I need to import the Root-CA's cert, the Intermediate-CA's cert and the Client cert on the client for it to be able to connect to the server. The server has access to the Root-CA's cert via ...
1
vote
1answer
40 views

Do I need to trust my Paas provider?

I am currently entering the world of deploying my web application to the cloud. While trying out Paas providers like heroku, I realized, that the platform has full access to my application. The ...
1
vote
1answer
44 views

Must all ssl certificates for a domain be trusted?

I've read that it's possible to have multiple certificates on one domain. My question is whether all these certificates should be trusted and valid or whether one valid trusted certificate is enough ...