Questions tagged [zero-trust]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
140 views

Is it possible to authenticate a device with a server without the device knowing any sort of secret?

Pretty much what the title says. I have been playing around with discord webhooks lately and one problem I have discovered is that anyone with the webhook url/token can send messages. This means that ...
OldAmmo's user avatar
  • 13
1 vote
1 answer
109 views

Keeping customer secrets safe from sysadmins and devs in Kubernetes

I've spent a few weeks on GCP and GKE (Kubernetes) trying to figure out how to store customer secrets. The secrets are used by some application even when the user is not logged on so I want to ensure ...
Johan Hanssen Seferidis's user avatar
0 votes
1 answer
183 views

Is there a viable zero-knowledge approach for using oAuth to generate and manage private keys?

I've been doing a deep dive into how products like Web3Auth work under the hood and wonder if this is a viable approach to building applications where a user can have the convenience of using oAuth to ...
user3458571's user avatar
1 vote
2 answers
84 views

Trustless Application Architecture for end-users with secure enclaves

I am working on a project where I want to store end-user private data, but immediately this brings up the trust question of why a user would trust me to hold their data. I don't actually want to hold ...
vin42tau's user avatar
0 votes
0 answers
95 views

Libraries or boilerplates providing fundamentals for Public-key generation and encryption of client data?

This may be more suitable for StackOverflow in terms of a recommendation for a library or implementation, but security-related questions are often overlooked or misinterpreted. I'd like to first ...
Charles's user avatar
1 vote
0 answers
224 views

Zero-Trust alternative to google sign-in, is this a feasable design?

I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
Gamer2015's user avatar
  • 717
4 votes
1 answer
354 views

How to validate client side safety in a Zero Knowlegde model

What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
Sibwara's user avatar
  • 1,338
2 votes
1 answer
152 views

Is uncompromisable obfuscated x86-64 execution possible?

I have a problem which has several layers; Provide a distributed computing plane where actors can voluntarily add and remove computing resources from, the actors are untrusted by default, and thus ...
Shadowjonathan's user avatar
0 votes
1 answer
214 views

Google approach to device security (BeyondCorp): managed devices and inference engine

I'm reading the BeyondCorp papers and trying to get a very high level idea of how it could be implemented by a small to medium organisation, rather than a behemoth like Google. What kind of software ...
Augusto's user avatar
  • 398
1 vote
0 answers
166 views

Verify Encryption Key with Non-Interactive Zero-Knowledge Proof

I wrote an implementation of a non-interactive zero-knowledge proof system as outline in this research paper. As far as I can tell, it functions flawlessly as intended with text secrets such as ...
Goodies's user avatar
  • 135
1 vote
1 answer
225 views

How can I securely generate secret-sharing/multisig keys on a p2p network?

I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key. ...
36bitavi's user avatar
5 votes
2 answers
1k views

Zero trust across micro-services using JWT

I am planning to implement JWT authentication on my micro-services to achieve zero trust architecture. User will generate a JWT token through front end micro-service. Each subsequent request will ...
Saqib's user avatar
  • 151
1 vote
1 answer
444 views

Is the zero trust approach really so safe? [closed]

Recently, I see so many emerging vendors that are advertising their use of zero-trust. What potential risks are we exposed to if we shift to zero-trust in our bank?
Filipon's user avatar
  • 1,264
2 votes
1 answer
128 views

Where custom auth source code fits into the micro-segmentation, zero-trust architecture

So micro-segmentation seems a bit of a buzz-word, but it helps in painting the picture of how to better do security in a network. Basically from what I understand divide the network into a bunch of ...
Lance's user avatar
  • 620
2 votes
2 answers
335 views

storing user's information without been able to access it

For a university project of mine I am making a password manager online and I want to be able to store user's passwords on my server without being able to access it myself. Here is what I intend to do: ...
melanholly's user avatar
1 vote
0 answers
340 views

What is the current status of the zero trust model?

I read of the apprarently ambitious goals of the "zero trust model". Has it found success in practice or encountered problems? A link that may be useful is: https://www.forrester.com/The+Security+...
Mok-Kong Shen's user avatar