Skip to main content

Questions tagged [zero-trust]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
31 views

Difference between Spire node attestation with VM instance identities and Kubernetes projected service account tokens

We deploy Spire to self-managed Kubernetes clusters on hyperscaler VMs (i.e. AWS EC2, Azure VMs, GCP Compute Engine) Technically speaking, we could set up node attestation either based on VM instance ...
mlenkeit's user avatar
  • 101
1 vote
0 answers
65 views

Minimizing trust assumptions in Messaging Protocols

As I was listening to an interview yesterday, the journalist claimed that his Signal communications were being spied on by the NSA. Whether to believe him or not is subjective. Still, it is an ...
enricobottazzi's user avatar
1 vote
1 answer
166 views

Is it possible to authenticate a device with a server without the device knowing any sort of secret?

Pretty much what the title says. I have been playing around with discord webhooks lately and one problem I have discovered is that anyone with the webhook url/token can send messages. This means that ...
OldAmmo's user avatar
  • 13
1 vote
1 answer
165 views

Keeping customer secrets safe from sysadmins and devs in Kubernetes

I've spent a few weeks on GCP and GKE (Kubernetes) trying to figure out how to store customer secrets. The secrets are used by some application even when the user is not logged on so I want to ensure ...
Johan Hanssen Seferidis's user avatar
0 votes
1 answer
242 views

Is there a viable zero-knowledge approach for using oAuth to generate and manage private keys?

I've been doing a deep dive into how products like Web3Auth work under the hood and wonder if this is a viable approach to building applications where a user can have the convenience of using oAuth to ...
user3458571's user avatar
1 vote
2 answers
105 views

Trustless Application Architecture for end-users with secure enclaves

I am working on a project where I want to store end-user private data, but immediately this brings up the trust question of why a user would trust me to hold their data. I don't actually want to hold ...
vin42tau's user avatar
0 votes
0 answers
110 views

Libraries or boilerplates providing fundamentals for Public-key generation and encryption of client data?

This may be more suitable for StackOverflow in terms of a recommendation for a library or implementation, but security-related questions are often overlooked or misinterpreted. I'd like to first ...
Charles's user avatar
1 vote
0 answers
246 views

Zero-Trust alternative to google sign-in, is this a feasable design?

I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
Gamer2015's user avatar
  • 727
4 votes
1 answer
376 views

How to validate client side safety in a Zero Knowlegde model

What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
Sibwara's user avatar
  • 1,348
2 votes
1 answer
167 views

Is uncompromisable obfuscated x86-64 execution possible?

I have a problem which has several layers; Provide a distributed computing plane where actors can voluntarily add and remove computing resources from, the actors are untrusted by default, and thus ...
Shadowjonathan's user avatar
0 votes
1 answer
229 views

Google approach to device security (BeyondCorp): managed devices and inference engine

I'm reading the BeyondCorp papers and trying to get a very high level idea of how it could be implemented by a small to medium organisation, rather than a behemoth like Google. What kind of software ...
Augusto's user avatar
  • 398
1 vote
0 answers
184 views

Verify Encryption Key with Non-Interactive Zero-Knowledge Proof

I wrote an implementation of a non-interactive zero-knowledge proof system as outline in this research paper. As far as I can tell, it functions flawlessly as intended with text secrets such as ...
Goodies's user avatar
  • 135
1 vote
1 answer
253 views

How can I securely generate secret-sharing/multisig keys on a p2p network?

I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key. ...
36bitavi's user avatar
5 votes
2 answers
1k views

Zero trust across micro-services using JWT

I am planning to implement JWT authentication on my micro-services to achieve zero trust architecture. User will generate a JWT token through front end micro-service. Each subsequent request will ...
Saqib's user avatar
  • 151
1 vote
1 answer
467 views

Is the zero trust approach really so safe? [closed]

Recently, I see so many emerging vendors that are advertising their use of zero-trust. What potential risks are we exposed to if we shift to zero-trust in our bank?
Filipon's user avatar
  • 1,294
2 votes
1 answer
145 views

Where custom auth source code fits into the micro-segmentation, zero-trust architecture

So micro-segmentation seems a bit of a buzz-word, but it helps in painting the picture of how to better do security in a network. Basically from what I understand divide the network into a bunch of ...
Lance's user avatar
  • 642
2 votes
2 answers
349 views

storing user's information without been able to access it

For a university project of mine I am making a password manager online and I want to be able to store user's passwords on my server without being able to access it myself. Here is what I intend to do: ...
melanholly's user avatar
1 vote
0 answers
351 views

What is the current status of the zero trust model?

I read of the apprarently ambitious goals of the "zero trust model". Has it found success in practice or encountered problems? A link that may be useful is: https://www.forrester.com/The+Security+...
Mok-Kong Shen's user avatar