https://transparency.dev/application/ Recent content in Applications on Transparency.dev Hugo -- gohugo.io https://transparency.dev/application/discourage-misbehaviour-by-third-parties/ Mon, 01 Jan 0001 00:00:00 +0000 https://transparency.dev/application/discourage-misbehaviour-by-third-parties/ HTTPS security relies on hundreds of Certificate Authorities (CAs) whose job is to issue certificates while checking that the requester is eligible. For example, they should only issue a certificate for mozilla.org to entities that can prove they control mozilla.org (hopefully only authorized people at Mozilla!). Unfortunately any CA can issue a certificate for any domain (more or less). So an obscure CA in Russia could issue a legitimate certificate for a UK bank. https://transparency.dev/application/add-tamper-checking-to-a-package-manager/ Mon, 01 Jan 0001 00:00:00 +0000 https://transparency.dev/application/add-tamper-checking-to-a-package-manager/ Advantages Ensure all users receive exactly the same code for a given package version. Protect you against hacked Github accounts force-pushing malicious code. Minimise the impact of a hacked download server. Protect you from a man-in-the-middle attack serving a tampered package with malicious code. Prevent upstream authors modifying the source code of an existing released version. How it works Tamper checking means the ability to detect if a package file has been modified since it was first added to the package manager. https://transparency.dev/application/discourage-misbehaviour-by-third-parties-in-certificate-transparency/ Mon, 01 Jan 0001 00:00:00 +0000 https://transparency.dev/application/discourage-misbehaviour-by-third-parties-in-certificate-transparency/ Trillan helps you Discourage misbehaviour by third parties in Certificate Transparency HTTPS security relies on hundreds of Certificate Authorities (CAs) whose job is to issue certificates while checking that the requester is eligible. For example, they should only issue a certificate for mozilla.org to entities that can prove they control mozilla.org (hopefully only authorized people at Mozilla!). Unfortunately any CA can issue a certificate for any domain (more or less). https://transparency.dev/application/reliably-log-all-actions-performed-on-your-servers/ Mon, 01 Jan 0001 00:00:00 +0000 https://transparency.dev/application/reliably-log-all-actions-performed-on-your-servers/ Advantages Guarantee that an audit record is created for all actions performed on your servers. Configure servers to block and report actions that weren’t already logged. Any malicious actions are permanently logged, increasing the likelihood of discovery. You can integrate additional code to monitor the log for potentially malicious actions. It simplifies incident response and forensic analysis as you’ve got a complete log you can rely on. You can prove to auditors exactly what actions were performed on each server. https://transparency.dev/application/strengthen-discovery-of-encryption-keys/ Mon, 01 Jan 0001 00:00:00 +0000 https://transparency.dev/application/strengthen-discovery-of-encryption-keys/ Key Transparency offers tamper-evident key discovery Key Transparency is a design for a tamper-evident key discovery service that providers of end-to-end encryption services could implement. Key Transparency solves the problem of key discovery using Trillian’s Map Mode. Advantages of Key Transparency Automate user discovery of end-to-end encryption keys. Provide a shared global view of public keys - everyone should see the same public key for a given username. Increase the difficulty of an attacker performing a man-in-the-middle attack.