Hot answers tagged

174 votes

Convince people not to share their password with trusted others

The nice and educational way This is a bit similar to your third bullet point. Nobody else should know your password, not even people you trust. That is the only way you can be sure only you have ...
Anders's user avatar
  • 65.6k
160 votes

Convince people not to share their password with trusted others

This post is about communication with people that have absolutely no technical knowledge or interest; especially people afraid of technology. Don't explain, don't complain It is incredible hard to ...
AnoE's user avatar
  • 2,389
88 votes
Accepted

Preventing users from tampering with input

TL,DR: It's impossible to do so client side. Client side validation is just a client convenience, not useful to really validate anything. You don't want the client to mistype his email, putting an ...
ThoriumBR's user avatar
  • 53.9k
82 votes
Accepted

How can I prove to users that my obfuscated code is not malicious without unobfuscating?

How can I prove to users that my obfuscated code is not malicious without unobfuscating? Probably, you can't. Maybe, if trusted persons were willing to audit your code (subject to NDA etc) and sign a ...
Kate's user avatar
  • 7,927
77 votes

Convince people not to share their password with trusted others

Funny enough, I actually don't accept your premise. As an IT professional you can read other people's emails and other communication, delete their directories etc. It is part of the professional code ...
Peter - Reinstate Monica's user avatar
53 votes

How can I prove to users that my obfuscated code is not malicious without unobfuscating?

It is not possible to prove that code isn't malicious if users cannot read it. The best you could hope for is a web-of-trust where a third-party certifies that it's not malicious, but that doesn't ...
Síle's user avatar
  • 531
40 votes

Increasing trust in a downloaded binary

A hash only really gives assurance that the file you downloaded matches the one on the website, not who the author was. So a digital signature using something like GPG (with your key publicly ...
Gh0stFish's user avatar
  • 10.1k
38 votes

Convince people not to share their password with trusted others

Just change the password after you're done helping them, and send them a password reset link. They will soon learn that it's easier to keep their passwords safe than to restore them. Alternatively (e....
Dmitry Grigoryev's user avatar
36 votes
Accepted

Can fingerprint readers be trusted?

It's certainly possible that the fingerprint reader contains some kind of backdoor or malicious code. But that's also true of the motherboard, the network card(s), the camera and microphone, the CPU, ...
Gh0stFish's user avatar
  • 10.1k
28 votes
Accepted

Should I trust a website which breaks when I use a complex password?

Your description is that the site fails to properly validate their input. This (weakly) implies a deep flaw in their code. If your input had simply choked their routine that calls PBKDF2(), then ...
John Deters's user avatar
  • 34.2k
25 votes
Accepted

What are the differences of checking a self-signed certificate vs ignore it?

If it's an official service you are integrating with the provider should really have a valid, publicly signed certificate installed for the sake of security. Assuming that you need to continue on ...
Tim Brigham's user avatar
  • 3,782
25 votes

Preventing users from tampering with input

You'll have to validate it on the server side. You say that the number of possible permutations is too large - but the client side somehow did it, didn't it? If the server side doesn't have enough ...
Vilx-'s user avatar
  • 1,030
24 votes

Should I trust a website which breaks when I use a complex password?

Most likely it means that (like most programs written by Americans) it's never been tested with Unicode characters and you've exposed a bug in their code. It's not a high priority for them to fix, so ...
Xiong Chiamiov's user avatar
23 votes

How does an end user differentiate between OV and DV certificates?

There is no difference between DV and OF in the browser's identity field. The screenshot below shows this field for Chrome, Firefox and MSIE. For both DV and OV, only the URL (no company name) show ...
Free Radical's user avatar
23 votes

How can I re-use my password and still protect the password if it is exposed from one source?

The established solution for this problem is to use different passwords for different websites along with a password manager. That way you won't have to reinvent the wheel. I know the rule don't ...
yeah_well's user avatar
  • 3,794
20 votes

How can I prove to users that my obfuscated code is not malicious without unobfuscating?

Am I able to prove to my users that the generated code is not malicious ... Probably not. Proving that some specific black box (your code) has a specific behavior and only this behavior is not ...
Steffen Ullrich's user avatar
19 votes

Can fingerprint readers be trusted?

On modern Windows systems, biometric authentication (including fingerprints) is handled by Windows Hello, which makes it basically as trustworthy as the rest of the system, and leaves less room for a ...
josh3736's user avatar
  • 2,555
18 votes

Where does the root of trust actually lie?

My question is, what are some guidelines that individuals and organizations can follow to ensure they don't become a target of such an attack? The attack in the hypothetical example that you describe ...
mti2935's user avatar
  • 23.1k
16 votes

How long can X.509 certificate chains be?

Theoretically, X.509 chains are unlimited in length. The Basic Constraints extension can apply a per-chain limit; this is used mostly for CA that agree to issue a sub-CA certificate but want to ...
Thomas Pornin's user avatar
16 votes

What are the differences of checking a self-signed certificate vs ignore it?

By importing a known good self-signed certificate where the private key is unique and not compromised, the connection is just as safe as a full global CA PKI signed certificate. Those are after all ...
John Keates's user avatar
16 votes

How to prevent HTTPS man-in-the-middle with self-signed certificates?

What you describe is the normal way corporate firewalls or antivirus inspect HTTPS traffic. Browsers will by default block access to these sites and users are not supposed to click though the warnings....
Steffen Ullrich's user avatar
14 votes
Accepted

How can I prove that my software is secure for those who are interested to install it?

Prove is a strong word, and to be honest, it isn't the word you're looking for. What you really want is trust. You want users (or potential users, in this case) to trust that your software is ...
Xander's user avatar
  • 35.8k
14 votes
Accepted

How long can X.509 certificate chains be?

There is no technical/specification limit imposed on the length of certificate chains. (However, there are X509v3 attributes which can impose policy-based limits on the length of a certificate chain ...
Castaglia's user avatar
  • 560
13 votes

Can I trust DNS servers?

No, you can't. It's as easy as you search information about "DNS leak" topic. When you use a VPN, you have the risk of a DNS leak. In other words, your DNS resolution will be made outside your VPN. ...
Rodrigo Calvo's user avatar
13 votes

Convince people not to share their password with trusted others

Knowledge leads to responsibility. Imagine you gave me your password... I have to keep your password (which happens to be beerbar2) a secret. The next time I'm at the beer bar, I must actively avoid ...
mafu's user avatar
  • 705
13 votes

How to prevent HTTPS man-in-the-middle with self-signed certificates?

Is the installation of a CA certificate in the browser really the only thing between secure TLS connections and a MITM nightmare? Installing a CA certificate in the browser (or the OS-level trust ...
hobbs's user avatar
  • 647
12 votes

Where does the root of trust actually lie?

My question is, what are some guidelines that individuals and organizations can follow to ensure they don't become a target of such an attack? One way to avoid being the target is to not do anything ...
nobody's user avatar
  • 11.5k
11 votes
Accepted

Why is CAcert not trusted by my browser?

In case of cacert.org, they are presenting a self-signed certificate and that's why your browser complains. There is no trust chain that leads from the certificate to a root CA that you trust. If you ...
techraf's user avatar
  • 9,159
11 votes

Where does the root of trust actually lie?

The root CA list is not hardware-based (in the general case, see about the TPM below). It comes as a built-in feature of your operating system. Other software (e.g. browsers, mail clients, etc...) may ...
fraxinus's user avatar
  • 3,558

Only top scored, non community-wiki answers of a minimum length are eligible