3

If I have written a privacy tool as a .NET web application which is to be hosted on a commercial hosting site, other than hosting it in a privacy friendly country, how can I assure users that the application has not been compromised by a third party at the host?

Obviously SSL will be used and the assemblies will be as obfuscated as possible, but these can only go so far.

For example, is there a way I can ensure that my assemblies haven't been wrapped to intercept plain-text user details?

  • 5
    On third party hosting, your security is only as good as the security of the hosting service (and you have to trust the people who run the service). Given these limitations, it may not be possible to make the security good enough to satisfy the requirements for a high security application like a privacy tool. I would consider asking this question on security stack exchange, though. – user82096 Apr 13 '17 at 16:00
  • 2
    You will have to define a clear threat model. What are you defending against? E.g. preventing your database from being hacked is a very different problem from avoiding you or your hoster being subpoenaed. The latter is only possible if your server never sees, stores, and processes user data in unencrypted form. – amon Apr 13 '17 at 16:23
  • Thanks @amon I have that already. I'm specifically talking about physical intervention at the server location relating to modification of the site to capture user details. – CompanyDroneFromSector7G Apr 13 '17 at 17:30
2

If you design for privacy, and you have no control on the remote host, you have to consider the host as being potentially compromised.

The only way then to ensure privacy, is to handle only data which is already encrypted by the client side (end to end encryption).

Of course, this limits seriously the services that could be provided by the server side ( as for the server side the data would be unintelligible. So you could also opt for a mix, encrypting sensitive data only.

SSL or TLS only protect the channel between client and host. It gives no guarantee if the host is by itself at risk.

Last but not least, it is extremely difficult to ensure host security and prevent hacking: every week there's a new story that reminds how vulnerable we are. If you use this end-to-end approach however, you protect the privacy even in case of a hack: the attacker could steal the data, but without the decryption key that would be kept on the client side, he couldn't do much.

Unfortunately, this kind of design is so safe that it would only push attackers to the next weak link: they could then try to corrupt the distributed software to get a copy of the data before it is encrypted (trojan approach)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.