71
votes
Why define CIA in security like this?
You're focusing on a very narrow scope here. The CIA triad is about security of a whole system, not just an encrypted message.
That being said, all elements of the triad do apply to your example:
...
- 136k
36
votes
Can proprietary protocols be considered as secured?
Secure communication protocols
The one question that gets overlooked too often in the infosec industry is "secure against what?" The phrase "I want to be secure!" is like saying &...
- 132k
25
votes
Accepted
Should mail addresses for logins be stored hashed to minimize impact of data loss?
Protecting e-mail addresses is of course very reasonable to prevent privacy issues (e.g., if the website deals with a sensitive topic), spam, phishing or attacks against other accounts of the user.
...
- 17.9k
21
votes
Accepted
Is the image of the signature considered PII?
PII by definition is
any information that can be used on its own or with other information
to identify, contact, or locate a single person, or to identify an
individual in context.
And to ...
- 3,941
15
votes
Preventing Javascript in a browser from connecting to servers
Firefox has an offline mode, just press “alt” to reveal the file menu, and select “Work offline”. Combine this with private browsing to make sure nothing is kept in storage for later.
If you want to ...
- 271
12
votes
Accepted
Authentication as CIA triad
CIA are the aspects of a system that information security strives to protect. Authentication and authorization (important and distinct concepts) are security controls that are used to protect the ...
- 16.1k
10
votes
What security operations provide confidentiality, integrity and authentication?
Your question is difficult to answer because security is a property of a system, not a property of a single technology or algorithm.
Confidentiality
It can be assured using encryption, but that's ...
- 9,283
9
votes
Preventing Javascript in a browser from connecting to servers
You can use Firejail to sandbox a particular Firefox instance. This allows you to restrict network access, ranging from no access at all to forcing all traffic through a firewall for more fine-grained ...
- 17.9k
9
votes
Preventing Javascript in a browser from connecting to servers
You can use an addon like uMatrix that injects CSP headers to prevent cross-site network requests.
Note that this may not work with file paths, as there are no HTTP headers, so no CSP header can be ...
- 3,451
8
votes
authenticity, confidentiality & integrity - general questions
The difference between authenticity and integrity is this:
Suppose party A and B are talking to each other. Authenticity would mean that messages received by A are actually sent by B. Integrity ...
- 3,286
7
votes
Android Messages Web and Privacy
Not sure if you found any answer, but have had the same question RE security/privacy and came across this thread higher up on google. Was able to find some information but not much. Some of the below ...
- 171
7
votes
Can proprietary protocols be considered as secured?
"The issue is some of the systems have been telling me that they can fulfil this requirement by using proprietary protocols. I personally do not agree with this statement as it is very debatable.
...
6
votes
Is there a specification for the color values representing information classification levels for the United States?
Ok so after diving into this a bit, this is the best I can come up with. I do not work for the US government so I cant say anything with any level of confidence. However;
It seems that the color ...
- 1,664
6
votes
Accepted
Gravatar - Is it a security risk for medical forums?
HIPAA specifically states that the users email address is protected PII. The md5 hash of the user's password is trivial to reverse, and a data breach of these hashes would result in protected email ...
- 47.3k
6
votes
Is the image of the signature considered PII?
Yes, it is.
Some people have well-readable signatures (sometimes even OCR-readable), so an image of the signature is equivalent to the full name of the person who made it.
People who have unreadable ...
- 49.5k
6
votes
Accepted
How do you securely delete httpOnly cookies previously used for login?
you cannot,
you have make another request to backend from there you can remove the cookies.
6
votes
Can proprietary protocols be considered as secured?
This is close to an opinion debate. What matters here is trust. A public protocol that has been scrutinized by experts in a specific implementation is generally seen as secure. And most security ...
- 26.8k
5
votes
Accepted
Does steganography ensure confidentiality?
Steganography solves a different problem. Steganography attempts to hide the existence of the data at all, not necessarily protect the confidentiality of the data once it's discovered.
Regarding ...
- 3,322
5
votes
Should mail addresses for logins be stored hashed to minimize impact of data loss?
First of all, I will say that I appreciate your creativity in trying to secure your app but you are thinking way over the top here. The drawbacks are innumerable while I can't think of any real ...
- 353
4
votes
What are the security implications of losing a paper calendar?
This depends a lot how valuable these information are for the finder, which also depends on who the finder is, what abilities and intentions he has, maybe what city or country you live in (amount of ...
- 206k
4
votes
Accepted
How to Prove you created Intellectual Property (IP) using a Notary
It is possible to sign a document (using PGP or by other means) and also include a trusted timestamp so that you could technically prove that you had a specific knowledge at a specific time. Or you ...
- 206k
4
votes
Accepted
Is there any point in using PGP or S/MIME when your receipients mostly don't use it?
... company with sensitive customer relations
Given that many common mail clients support at least S/MIME by default, it actually makes sense to use it. This means that mails should at least be ...
- 206k
4
votes
Accepted
Can my ISP know that I have more than one Google Drive account?
The fast response is "no", your ISP can not see how many accounts of gdrive you have and which of them you are using. In fact, as far as I know, the majority of the traffic to google ...
- 2,294
3
votes
When using HTTPS, which part of domain is revealed to ISP?
As Steffen says, the SNI extension will contain the full hostname. The other way your ISP (or anybody else in a position to monitor traffic on the wire) might deduce the full domain you're going to is ...
- 50.4k
3
votes
When using HTTPS, which part of domain is revealed to ISP?
I think you are referring to the hostname as given in clear text in the SNI extension in the ClientHello message as part of the TLS handshake. Since this extension is used to tell the server what ...
- 206k
3
votes
Security aspect vs Security goal
When you look at something from a security perspective, its security aspects emerge. That often refers to the security-related principles and concepts which are part of a particular technology. (This ...
- 45k
3
votes
If smart hardware is evil can I still securely run software?
This answer is a practical take on it. I'll not theorize about encryption, but will take a round trip to earlier attempts at secretive computation.
Whilst I do agree with Numeron that at some point ...
- 5,887
3
votes
Accepted
Identify a user using random characters of the password
The point of a cryptographic hash is to not be reversible, so they can't be getting it from that.
It's possible they pick out and store a few characters from the password when it's set, so customer ...
- 9,452
3
votes
Privacy of client's virtual machine in cloud computing
The rules are:
you cannot protect a machine from its administrator
you cannot protect a machine from someone that has physical access to it
Depending of the kind of cloud service (PaaS or IaaS), the ...
- 26.8k
Only top scored, non community-wiki answers of a minimum length are eligible