Identity is the property of an object which allows it to be uniquely specified.

learn more… | top users | synonyms

4
votes
1answer
37 views

Keeping login in sync with third party providers

When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status. If I have my own server, which requires an access token of it's own ...
-4
votes
1answer
93 views

Is there any way to really have a secure ID? [closed]

Is there any method currently available (regardless of cost) which makes it impossible to spoof or steal my identity in an online situation? If not, is there anything on the horizon that could become ...
3
votes
3answers
48 views

Is it possible to modify jQuery client code to call a remote API in an unintended way?

Is it possible for someone to modify the JQuery code of a remote page and make it call the remote APIs in a different way than intended? Suppose the website www.domain.com has a jquery.js script ...
0
votes
2answers
128 views

Disclosing too much info over email just to close account?

I have account with a stock option trading platform. They are well known and reputable. I had a couple thousand in the account, bought and sold for a while, and then cashed out and withdrew. So I'm ...
0
votes
1answer
146 views

How WhatsApp identifies a specific user

How does WhatsApp identify a specific user in order to forward the messages to him? Here is what I did: I backed up my iOS App from my old device Restored the backup to the new device Opened ...
3
votes
1answer
121 views

Prove ownership of a GMail account

Is there a way for a person to remotely and irrefutably demonstrate ownership of a Gmail email address? I've considered using DKIM signatures, but this has problems: PGP Key Signing Robot DKIM ...
-4
votes
1answer
61 views

sourcing harrassing texts [closed]

I live in the US. Someone is texting harrassing messages to me. I have done a reverse lookup which dead-ends in a landline number. The number I have has been confirmed by my wireless Carrier. It ...
0
votes
0answers
21 views

Is there any benefit to re-verifying someones identity on the phone once transferred?

So this example is quite specific. You call up an organisation and they verify your identity using two pieces of information (eg; date of birth, last payment date, mothers maiden name). But then once ...
2
votes
0answers
31 views

How does Adobe Pass Auto-Authentication work?

At time marker 2:05 of this video, he describes that Adobe Pass can automatically identify you based on your broadband provider, and sign you in/authorize you for media content. Can anyone describe ...
0
votes
0answers
30 views

What is NFC REVERSED id

I am very new to NFC, and trying to understand what is the ID(Reversed) is for. Also why is there 3 ID, the HEX, DEX and Reversed??
3
votes
0answers
42 views

What business identifiers are considered non-public, and should not be disclosed?

I am setting up a corporation in the US and UK and am presented with a EIN for the US, and VAT Reg. Number. for the EU. Somewhere in the piles of documentation I have been reading, I read that the ...
-2
votes
1answer
62 views

How can I know if any cell phones other than a given set are turned on in the nearby area?

I am searching for a solution to identify phones simply by the signals it emits. Imagine a signal receiver in a room, then I want to know which people are using phones nearby. I don't care what they ...
0
votes
1answer
166 views

Why should I trust a JSON Web Token (JWT)?

In the SAML and Kerberos authentication models, there is an explicit understanding of what authority has authenticated the user and issued the credential to be trusted by downstream systems. For ...
1
vote
2answers
98 views

Email used to log in but doesn't have to be unique. Issues?

I've moved onto a project where they are implementing a system whereby a user's email address can be used multiple times by different people - i.e. users can sign up as many times as they want with an ...
0
votes
1answer
84 views

Tips if someone else is using “my” username on another site [closed]

This question isn't about me, though it easily could be, since there are many Barry Carter's out there. Suppose I find out someone is using my FaceBook (or Twitter or StackExchange or whatever) ...
4
votes
2answers
106 views

A potential possibility of improvement of PKI for personal communications

In countries like Germany each citizen has an identity card that is issued by the registration authority. Since the identity of a citizen is, in a sense, created by that authority via assigning him ...
1
vote
3answers
178 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
0
votes
0answers
49 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
2
votes
1answer
183 views

Find out the identity of the person that called you

I once heard that if a number that you don't know called you, you can access a website (that I don't remember now) that will call the number and make a recording of what the person said and send it to ...
3
votes
5answers
201 views

How can I uniquely identify an user when cookies are not an option?

In web application development, how can I uniquely identify an user when cookies are not an option and IPs are dynamic? Are the patterns which I can combine and then created a hash to be used as a ...
7
votes
2answers
7k views

Why do some companies ask last 4 digits of my SSN or a scan of my ID? What are my risks?

Yesterday I found out that some major service provider (online rentals) that I use now requires proof of my identity if I want to continue and make a booking. I was offered 2 options: 1) Enter last ...
0
votes
2answers
59 views

How to steganograph ownership information into members uploaded images?

Considering a social website where members upload images which at times can be very similar - is there a way that images can be 'branded' steganographically with (salted+encrypted) text that ...
2
votes
0answers
35 views

Nation-state digital signatures - how is my public key linked to an identity? [duplicate]

A bitcoiner trying to understand the nation-states. When I use my eID (I'm swedish and I have 'BankID'), and I sign something with my private key that's in the 'eID-file' that I've got on my laptop, ...
1
vote
1answer
95 views

How would a nation-state provide an API for its citizens to verify their legal identity online? [closed]

An official nation-state institution, like the Swedish Skatteverk, could easily let their citizens verify themselves online. O-auth tokens could be created by the nation-state institution, generated ...
9
votes
2answers
297 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
2
votes
1answer
72 views

Does the modulus of a TLS certificate uniquely identify the client?

I'm working on a project using a trusted-peer setup. I want a way to uniquely identify each actor in the system, ideally across certificate re-issues as well. In my understanding, the modulus of a ...
2
votes
3answers
208 views

Email confirmation techniques in major sites

The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email. If they have not verified ...
1
vote
1answer
65 views

VPN multiple IP users anonymity

During a support conversation with my VPN provider, I asked specifically: "is it impossible to filter out a single VPN user since your IPs are in use by many?". The answer was yes, it is impossible. ...
3
votes
1answer
63 views

Identicon for SSL certificate

I have a few self-signed certificates that I use, and I find it tedious comparing the entire hex value of the hash when accepting it in a new location. To be honest I usually just look at the first ...
4
votes
1answer
280 views

Deal with number changes in a phone number based authentication/login system

Twitter Digits (https://get.fabric.io/digits) provides an authentication/login system based on phone numbers for mobile apps, and several other mobile apps (e.g. Square Cash, ...
0
votes
1answer
40 views

Sharing sensitive information across servers on visits from the same browser

I have this scenario: Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser. Webserver domain B. ...
3
votes
1answer
212 views

Why do websites ask for the last four digits of your social security number?

Quite a few websites, Coinbase and Stripe most notably, ask for the last four digits of your social security number to 'verify your identity'. Assuming these websites are not trying to fraud you, how ...
5
votes
2answers
387 views

Is there a reason why IMEI is stored in EEPROM?

I've heard that IMEI numbers are stored on an EEPROM, essentially letting them be erased and rewritten. Thieves misuse it to make stolen phones untraceable. Is there a reason why manufacturers don't ...
2
votes
1answer
77 views

How good is confidentiality with physical mail forwarding companies? [closed]

I want to use a mail forwarding company that can receive mail for me and forward it to another address. I found many places that do this, but I am worried that eventually my stalker would find out ...
1
vote
1answer
71 views

Is there any College, State or Government ID that transmits a offline verifiably encryptable data blob?

I'm looking for any way to digitally verify a user, ideally with a photo and link PII to that user. My use case is that a user will extract and send an encrypted data blob (say from a passport) to my ...
0
votes
1answer
540 views

Drawbacks of using ADFS for SSO for external users

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
3
votes
1answer
2k views

Generating token for email validation and registration security

My boss gave me a list of 8K users in csv format and asking me to create accounts for them. The list have users with gmail, hotmail, and organization email addresses. I am using MVC 5 and ASP.NET ...
3
votes
1answer
421 views

SAML Assertion to Windows Identity (Kerberos token?) transformation

This is the scenario I need to cover: A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
1
vote
1answer
228 views

Gmail disclosing your account name to recipients? [closed]

My Gmail setting has forever been set to send emails with just my Gmail address as the identifier, so it should not send out my account name (first or last name)... or so I thought! Recently I got a ...
2
votes
1answer
88 views

What are proper security precautions when enabling multiple connected social accounts or login/authorization methods?

It is popular today for frameworks and social sites to enable multiple authorization options when creating websites. For example, allowing a user to login with GitHub, Twitter, Facebook, etc. In ...
3
votes
5answers
405 views

Can we have https without certificates?

I apologize in advance if I am fundamentally misunderstanding something, but is it possible to have encrypted communication protocols (https, I suppose) without resorting to a certificate system? ...
6
votes
1answer
77 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
29
votes
3answers
10k views

Why do I need to hide my phone's IMEI

If it is a secret then why is it visible on the box, invoice and the back of the phone? If it is not a secret then why does it have to be blurred when it gets posted online?
1
vote
5answers
154 views

Is there a term for Authorizing before Authenticating? Is it even common?

In most scenarios a person identifies who they are (authentication/AuthN) via something like a username and password. Afterwards a system would likely evaluate what that validated identity can perform ...
-6
votes
2answers
158 views

Person has no persona on the internet yet runs a business [closed]

Original Question: There is this older person (60+yrs) who is runs a business with internet presence yet when I do am internet search on him nothing pops up, not even photos!! How do I find out if he ...
3
votes
4answers
418 views

Lock a website login to a certain computer

I've got a web based system where a specific site only shall be available on a certain computer. On that computer I have a desktop application. The desktop application and the website communicate ...
3
votes
2answers
60 views

What is the name for “imperfect” verification options?

Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the ...
1
vote
2answers
153 views

Having a consistent “dont reveal email addresses of members” policy [duplicate]

Developers are dogmatic on having "invalid username or password" on login screens; our applications should not reveal if somebody is a member given an email address. But there are two other ways our ...
4
votes
0answers
265 views

Ensuring an HTTP request is coming from my program

Is there a way to ensure that an HTTP request to my REST server is coming from my application? I'm guessing no because whatever I do on the client side, as people have access to that code, they can ...
3
votes
3answers
600 views

Best practices for GPG user ids

What is the best practice for choosing GPG user id(s)? I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because ...