Questions tagged [integrity]

Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

Integrity is the property of an asset that states that it remains intact. In other words, it requires that only authorized parties are able to modify the data. It is one of the three elements in the classic CIA triad of security properties, alongside and .

Typical measures to enforce integrity include physical protection (e.g. keeping papers in a locked safe, or writing to read-only media). Cryptography can help maintain integrity; in particular, to verify the integrity of some data, it is enough to compare its against a known value (the hash must still be obtained reliably).

293 questions
79
votes
6 answers

Does SSL/TLS (https) hide the urls being accessed

Suppose I type this in my browser https://www.mysite.com/getsecret?username=alice&password=mysecret and an attacker is watching all traffic from me to my ISP. What information is protected by HTTPS? Is the URL revealed? Are the parameters of the…
Jus12
  • 1,315
  • 2
  • 11
  • 16
63
votes
4 answers

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. Protection against MITM attacks: A man in the…
Tom Marthenal
  • 3,272
  • 4
  • 22
  • 26
52
votes
4 answers

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And because of this, I have no idea about how to verify…
ThankYouSRT
  • 1,275
  • 3
  • 12
  • 15
34
votes
1 answer

JSON Web Tokens - How to securely store the key?

I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The conceptual core of this method is that the server is the only agent that knows the secret key used to digest…
NMO
  • 443
  • 1
  • 4
  • 5
32
votes
2 answers

How does subresource integrity actually help?

Subresource integrity basically lets me know that a resource I'm about to download is valid, because the hash of its contents matches what I expect. But this assumes that I'm already running on some trusted and verified code. If a hacker has…
29
votes
2 answers

Something is changing my hosts file without asking

First: I can't find any information on this phenomenon, not anywhere on the net. I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) updates my hosts file. I have UAC enabled. To edit my…
Jacob Bruinsma
  • 413
  • 1
  • 4
  • 8
26
votes
5 answers

Is unauthorised deletion an integrity or availability issue?

During a web application test I have discovered a parameter tampering issue that allows a user to delete comments left by other users. They can't modify the content of other users' comments, and they can only view them where this is intentional. I'm…
paj28
  • 32,736
  • 8
  • 92
  • 130
24
votes
2 answers

Is Torrent safe for sharing legitimate files (file verification)? Does it use SHA1 or SHA256?

Let's assume that a legitimate torrent file has been safely and successfully downloaded over HTTPS and perhaps even OpenPGP verification was used to verify the integrity of the torrent file. How good are torrent clients against attackers who want to…
user539484
  • 343
  • 3
  • 6
24
votes
4 answers

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ones distributed by me. Keep in mind that not all…
Silverfox
  • 3,369
  • 2
  • 19
  • 39
22
votes
2 answers

Is there a way to verify a binary against the sources?

It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the compiled binaries really represent the public…
flori
  • 381
  • 2
  • 8
19
votes
3 answers

Difference between authentication, integrity and data origin authentication

I first thought all these terms were synonyms, but I sometimes see those terms used in the same document. For instance, on MSDN: data origin authentication, which enables the recipient to verify that messages have not been tampered with in…
Jacques
  • 565
  • 1
  • 5
  • 12
19
votes
5 answers

How can I ensure my dll has not been modified?

I have an old project in VB which created an unique pc code from MAC address and disc id. This was used to identify a pc so credentials cannot be used between pcs. This project migrated to C#, and I encapsulated this logic in a DLL which simply…
Vallo
  • 319
  • 1
  • 2
  • 7
18
votes
4 answers

Why would a website serve different versions of a file over HTTP and HTTPS?

Here is a link given on curl's official website: (prefix omitted) bintray.com/artifact/download/vszakats/generic/curl-7.46.0-win64-mingw.7z When I downloaded it with prefixes http:// and https:// I got two different files. My question is why is this…
solarflare97
  • 191
  • 1
  • 7
18
votes
7 answers

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run nightly and installed it on a fresh non-rootkitted…
dr jimbob
  • 38,768
  • 8
  • 92
  • 161
17
votes
4 answers

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work? Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum for it. My understanding is that this is…
kmfsousa
  • 181
  • 1
  • 6
1
2 3
19 20