The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
1answer
39 views

How to use TPM to identify a computer for licensing purposes

I've been comissioned to use TPM to add a licensing system to an existing software project. The idea is to use TPM to uniquely identify the computer (that runs GNU/Linux, probably CentOS/RHEL/Fedora) ...
3
votes
3answers
136 views

Can identification imply authentication in biometric systems?

I know the difference between Identification and Authentication, which are basically claiming who you are and proving that claim. In terms of a system, they are username and password in general. But ...
1
vote
0answers
66 views

Risks of using UUID to identify user in mobile app

I've got an existing customer base. A customer has appointments. Currently they cannot access or change their appointments without contacting me directly. I want to offer them a way to access and ...
2
votes
1answer
88 views

Beyond Nmap: Investigating open TCP ports bound to unknown services

I have an uninvited guest using my private WLAN. At first I thought it was probably just a tech-savvy neighbour in need of Internet access, in which case; it wouldn't really bother me. However, I've ...
0
votes
1answer
46 views

Checking if my username X is the same guy as username Y

I'm creating a new alias online for creative works that I don't want anyone I know in real life to see, but I'd like it to be possible for online people to check that things copyrighted and licensed ...
2
votes
3answers
85 views

Does MAC spoofing prevent identification?

I regularly connect to public wireless APs scattered around the city, offered by my carrier. I remember reading an article that a determined owner can track you between APs and thus know your location ...
1
vote
1answer
34 views

Multi-User-Server Public-Key-Based Authentication

So, lets say we have Alice, John, Peter and Bob. Alice, John and Bob all know Peter's public key and trust Peter. Alice wants to connect to Bob's server, so she presents her public key, which was ...
46
votes
6answers
8k views

How do I deal with companies that call and ask for personal information?

Several times I get a phone call from a company- my bank, utility companies etc. Many times they are just cold calling me, but once or twice they were calling for legitimate reasons (ie, something to ...
9
votes
2answers
21k views

Why do some companies ask last 4 digits of my SSN or a scan of my ID? What are my risks?

Yesterday I found out that some major service provider (online rentals) that I use now requires proof of my identity if I want to continue and make a booking. I was offered 2 options: 1) Enter last ...
0
votes
2answers
107 views

Is there a way to uniquely identify a mobile device through packet sniffing?

I need to uniquely identify a mobile device using the "ping" packets that it transmits to cellular towers regularly, in an area of interest by installing a packet sniffer at that location? I only need ...
0
votes
1answer
25 views

Principal Password in Kerberos KDC database

Is there a way for me to merge a bank account number, fingerprint image and IMEI of a phone into a single entity that I could possibly use as a password in the Kerberos KDC to uniquely identity a ...
-4
votes
2answers
121 views

How to identify this hash?

I have one hash, I know its value, but not its type. Here is it: 6dfb036bf703d75f9bc8219ba1224d876783fa61 I tried something like php -r "echo sha1('abc');", but it gave me another value, so this ...
1
vote
0answers
53 views

What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?

I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7. When this happens a problem signature is presented, like this example from SuperUser: Problem Event ...
14
votes
6answers
15k views

Difference between authentication and identification [Crypto and Security perspective]

I am always confused by the way the word authentication is used in security literature (i.e., outside the crypto realm). Most of the time I understand that they are actually implying identification. ...
0
votes
1answer
587 views

How WhatsApp identifies a specific user

How does WhatsApp identify a specific user in order to forward the messages to him? Here is what I did: I backed up my iOS App from my old device Restored the backup to the new device Opened ...
1
vote
1answer
115 views

does the --nack command do what I think it does in reaver and why won't it work?

I have a problem with reaver. I try the --nack command reaver -i mon0 -b 00:01:02:03:04:05 -vv --nack --mac=00:BA:AD:BE:EF:6 for example. And I assume it will try a different PIN, even if it doesn'...
0
votes
1answer
138 views

Protect software from copy [duplicate]

Imagine I wrote some software on .NET which will run on client machine. Is it possible to detect that someone copied my software to different computer? (Assuming my software can connect to a remote ...
0
votes
1answer
44 views

How do API's authenticate a user?

I've read many documents about API's but they don't seem to mention API's for private accounts instead of publicly accessible information. How does an API work to request private account data? How ...
2
votes
1answer
104 views

What are proper security precautions when enabling multiple connected social accounts or login/authorization methods?

It is popular today for frameworks and social sites to enable multiple authorization options when creating websites. For example, allowing a user to login with GitHub, Twitter, Facebook, etc. In ...
1
vote
0answers
41 views

Let users sign in with eIDs - do I need government authorisation? (scope: all nation-states) [closed]

I've decided to launch a crypto-basic income system. Crypto UBIs are pretty popular now. For me, it seems like an open nation-state ID should exist by now (2015). However, Mike Hearn, Bitcoin core-...
2
votes
5answers
473 views

How can I uniquely identify an user when cookies are not an option?

In web application development, how can I uniquely identify an user when cookies are not an option and IPs are dynamic? Are the patterns which I can combine and then created a hash to be used as a UID?...
1
vote
1answer
55 views

SSL/TLS entity identification

Does SSL/TLS contain any form of identification in the initial handshake, so an attacker cannot simply waive the certificate around claiming they are someone else? Wikipedia did not say that it did, ...
2
votes
2answers
488 views

How does a user get authorized wihtout authentication

I have a back-end (API) and a front-end, eg a web server, and I have users and ID-providers. The web server is provided by a third aprty and it may just as well be a mobile app, but whatever the case ...
2
votes
1answer
310 views

Are internal patient identifiers considered PHI under HIPAA?

We use GUIDs to internally to identify patients in our system. I'm having a debate with our regulatory people on whether these identifiers can be used in query strings to REST calls. They are ...
-4
votes
4answers
129 views

Why aren't all photo-IDs/cards digitized these days, for security/convenience? [closed]

With so many people losing wallets and physical, plastic pieces of ID cards, drivers licenses, etc., why haven't we moved on to fully digitized ID in the digital world? We have made money almost ...
7
votes
1answer
129 views

Anonymity of sneakernet: identifiable information on removable storage

Alice, an anonymous informant, would like to transmit digital documents to Bob while maintaining her anonymity. For whatever reason, she chooses to copy the documents to some kind of physical ...
3
votes
1answer
354 views

Why do websites ask for the last four digits of your social security number?

Quite a few websites, Coinbase and Stripe most notably, ask for the last four digits of your social security number to 'verify your identity'. Assuming these websites are not trying to fraud you, how ...
2
votes
1answer
78 views

How good is confidentiality with physical mail forwarding companies? [closed]

I want to use a mail forwarding company that can receive mail for me and forward it to another address. I found many places that do this, but I am worried that eventually my stalker would find out ...
1
vote
1answer
84 views

Is there any College, State or Government ID that transmits a offline verifiably encryptable data blob?

I'm looking for any way to digitally verify a user, ideally with a photo and link PII to that user. My use case is that a user will extract and send an encrypted data blob (say from a passport) to my ...
2
votes
1answer
100 views

What is the best way to be sure of user's identity?

Not sure this is the right stack to ask this in, it's kind of an abstract question. Say you have a website where it is very important that the personal information provided by the users is authentic. ...
0
votes
1answer
366 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
7
votes
4answers
370 views

How to suspend a user from my website and prevent them from creating a second account?

I am an outsourcing person, not a programmer. My website is a shopping website (think eBay). My website will need a user suspension feature, in case a user violates the terms and conditions. The ...
3
votes
2answers
2k views

Authentication vs. Verification in General and with Biometrics

I am reading The Basics of Information Security, 2nd. Ed., Andress, Jason. He says on p.25, "Identity verification is a step beyond identification, but it is still a step short of authentication, ...
4
votes
9answers
2k views

Where is the identification process when I use a key fob to unlock a door

I can understand that typing my user name on the computer is "identification" and providing the password is "authentication" but when I use a smart card or a key fob I see no identification taking ...
6
votes
7answers
454 views

Is providing a website password over the phone any less secure than other identifying information?

I've been dealing with two separate banks for completing a 401k rollover (I do not have any other accounts with either of the two banks), and I've encountered something with both that I've never seen ...
0
votes
2answers
136 views

What methods can be used to verify identity against a database?

I have a database with individual contact data for students... this data includes name, address, phone number, birthdate, etc. (no social... that would have made this too easy apparently, ha ha) I ...
0
votes
2answers
255 views

What kind of information can be found from email?

When an average person sees an email, he can see only part of an information enclosed in the mail. To see full information one can look at the source of an email, which shows more. Example of an email ...
0
votes
0answers
25 views

Determining the efficiency of a biometric system [duplicate]

How can find the efficiency of any biometric system is there an equation to find it? How is the efficiency of a biometric security system?
8
votes
3answers
602 views

Why would a website allow answers to security questions to be used interchangeably?

I needed to reset my password on a website that uses security questions for the purpose, and I noticed something strange. My hypothetical security questions are (not the ones I actually use) are: ...
0
votes
2answers
977 views

How to identify a specific operating system with port scans?

According to the implementation of the TCP/IP stack an attacker is able to identify which operating system is running on a network device. Is there any paper or the like according on this topic?
3
votes
7answers
483 views

How does an IDS identify a computer ?

How does an IDS identify a computer on the network. I mean do IDS' actually check whether a device is actually what it claims to be ? If so what factors does it check (MAC etc) ? For e.g. if a ...
2
votes
1answer
965 views

How do I ensure secure communication and inter-process authentication in a multi-server application

Note: Question updated to narrow the scope a bit. Scenario Client <-> Application server <-> Data server Users use the client to connect to the application server and build queries for ...
0
votes
1answer
219 views

Hack profile identification

What does it suggest about a "hack" when people I know get emails from me, but my email password hasn't been changed to lock me out? (Not a spoofed sender - I see some in my sent folder). If my ...
1
vote
2answers
585 views

How to uniquely identify / tag client devices to whitelist VPN access?

I'm just wondering if there is any way to uniquely identify or tag client devices like laptops and towers in order to whitelist them for vpn access. (Note: This is a thought-experiment at the moment, ...
19
votes
1answer
324 views

What's this kind of authentication scheme called?

In the past I've heard about a scheme to prove your identity online in places like forums, without having to create an account. When posting, the user would enter a password which is then heavily ...
18
votes
6answers
8k views

How to verify that someone is who they say they are online?

I am working on an online job application web app and the question has come up about how we will verify that someone submitting an application is who they say they are. For example, we don't want ...
2
votes
1answer
1k views

Unknown Service Identification

How can one identify a service running on a non-standard port? I'm not talking about services like webserver or FTP since nmap can do that without any problems. I'm talking about services that are not ...
5
votes
1answer
550 views

How does sound signature recognition work and how to override it?

Today a lot of websites that allow the upload of media content are implementing automatic sound signature checks to prevent the illegal distribution of videos containing copyrighted content. How ...
5
votes
2answers
230 views

What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?

In many organizations these days, employee IDs are very mutli-functional. They can serve as: Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
0
votes
1answer
2k views

Identify an HTTP scanner from some HTTP headers

My personal Apache server occasionally gets some pretty obvious scans for vulnerabilities. The client that does the scanning does GET HTTP/1.1 methods on a variety of URLs, and uses a variety of User-...