Identity is the property of an object which allows it to be uniquely specified.

learn more… | top users | synonyms

3
votes
3answers
216 views

Best practices for GPG user ids

What is the best practice for choosing GPG user id(s)? I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because ...
3
votes
1answer
227 views

pro and cons of having 2 Identity providers

My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and ...
2
votes
3answers
9k views

Someone keeps using my email address. What to do?

I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
2
votes
2answers
129 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
2
votes
3answers
281 views

Verify if person belongs to the claimed university through his university email id

I need to allow users access to an application after verifying that they belong to the claimed institute through university email id. So that if a person claims that he belongs to Stanford University, ...
2
votes
2answers
23k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
2
votes
1answer
61 views

How good is confidentiality with physical mail forwarding companies? [closed]

I want to use a mail forwarding company that can receive mail for me and forward it to another address. I found many places that do this, but I am worried that eventually my stalker would find out ...
2
votes
1answer
45 views

Is there any College, State or Government ID that transmits a offline verifiably encryptable data blob?

I'm looking for any way to digitally verify a user, ideally with a photo and link PII to that user. My use case is that a user will extract and send an encrypted data blob (say from a passport) to my ...
2
votes
1answer
119 views

Where can I find articles about identity disclosure attack?

Where can I find more details about identity disclosure attack and it's prevention? If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
2
votes
1answer
50 views

SAML Assertion to Windows Identity (Kerberos token?) transformation

This is the scenario I need to cover: A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
2
votes
0answers
29 views

What are proper security precautions when enabling multiple connected social accounts or login/authorization methods?

It is popular today for frameworks and social sites to enable multiple authorization options when creating websites. For example, allowing a user to login with GitHub, Twitter, Facebook, etc. In ...
1
vote
5answers
132 views

Is there a term for Authorizing before Authenticating? Is it even common?

In most scenarios a person identifies who they are (authentication/AuthN) via something like a username and password. Afterwards a system would likely evaluate what that validated identity can perform ...
1
vote
2answers
62 views

A manual function for hasing identity?

I hope you won't close the question. Even though there are no computers involved, it is still about information and security, and I think that security experts are the ones who will be able to help ...
1
vote
1answer
77 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
1
vote
1answer
404 views

What does a Yadis / XRDS discovery session “look like” to the end user? How does it work? Is it relevant?

I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me ...
1
vote
2answers
73 views

Having a consistent “dont reveal email addresses of members” policy [duplicate]

Developers are dogmatic on having "invalid username or password" on login screens; our applications should not reveal if somebody is a member given an email address. But there are two other ways our ...
1
vote
1answer
192 views

Passport copy is being used to defraud others - what can I do?

I was an idiot and sent my passport and address to a scam artist I was hoping to rent an apartment from abroad. Luckily, I realized the trickery before sending anything else or any money. ...
1
vote
2answers
130 views

Should every SAML identity provider provide a unique public certificate to the service provider?

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
1
vote
1answer
197 views

How does IIS persist identity credentials? Does it create any security issues?

We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
1
vote
3answers
775 views

Can Paypal be used to verify a user's identity?

As I use my Paypal account for various online services, I noticed that vendors integrate differently with Paypal for on-demand payment, and scheduled payments. I also noticed that Paypal offers a ...
1
vote
0answers
13 views

Is there a reason why IMEI is stored in EEPROM?

I've heard that IMEI numbers are stored on an EEPROM, essentially letting them be erased and rewritten. Thieves misuse it to make stolen phones untraceable. Is there a reason why manufacturers don't ...
0
votes
2answers
169 views

Why do file storage sites have a long unique id for their download links?

I'm creating a file storage site and what I would do is just have the download links format as: https://www.domain.com/[id]/[file name] //id would just be 1, 2, 3 etc. Dropbox and many others have ...
0
votes
2answers
2k views

How to prevent other hosts on the same LAN from seeing my IP and host name?

I want to hide my computer IP dan hostname when I am online on the same LAN on which other computers running netcut and other network tools. I have installed netcut defender but it seems not to hide ...
0
votes
4answers
1k views

Does Facebook merge accounts? In what circumstances? [closed]

I have two different Facebook accounts with two different passwords and two distinct online personalities, one as myself and one as someone else. Since the last one week, to my horror, both accounts ...
0
votes
2answers
68 views

Is there a way to prevent software from accessing hardware IDs?

I think this is related to this question, but I would like to know if there's also a way to prevent "third party" applications from seeing hardware IDs (motherboard, hard disks, and others), or giving ...
0
votes
2answers
216 views

Verifying users location & authenticity

I am builduing a business to business website, and users are able to sign up with a personal profile and create a business (like linkedin). I need to verify the following: Business Name ...
0
votes
1answer
82 views

Drawbacks of using ADFS for SSO for external users

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
0
votes
2answers
41 views

Is there any mail service accepting real id? [closed]

Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address. If there is a security breach, user may lost important information on that address. They may add phone ...
0
votes
1answer
161 views

Is it safe to recycle unshredded credit card receipts?

Is it safe to recycle unshredded paper credit card receipts? Can identity theft be helped by data disclosed on most vendor's receipts?
0
votes
1answer
2k views

What are the potential vulnerabilities in a SAML-based SSO approach?

What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
0
votes
1answer
99 views

Encrypting important context vs data sets associated with context

I am looking for an example in the real world where only a portion of the entire data set is encrypted even though the entire data set is considered sensitive. Specifically the portion that gives ...
0
votes
1answer
727 views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
0
votes
0answers
21 views

Problem with TLS identity not verified [migrated]

I run a CA server "Microsoft CA Server Enterprise" and I generate certificates then bind the cert to my site. In all clients in my network, I add the cert with certutil -addstore ca org.cer When my ...
0
votes
0answers
22 views

How does WebID fit in the SAML picture?

How does WebID fit in the SAML picture? Are they related or completely unrelated? Can they work together? If yes, what are the benefits?
0
votes
2answers
169 views

Encrypting using the private key in Identity-Based Cryptography

In normal asymmetric crpyto like RSA, if Alice encrypts something using her private key, Bob can decrypt it using Alice's public key. Is the same possible in Identity-Based Cryptography, where the ...
0
votes
4answers
97 views

Recommendation for identity system

I want to develop a system, something like a comment system for a website, that ensures I know who is posting comments. The content that is exchanged is not valuable and does not need to be encrypted, ...
-1
votes
1answer
119 views

Gmail disclosing your account name to recipients? [closed]

My Gmail setting has forever been set to send emails with just my Gmail address as the identifier, so it should not send out my account name (first or last name)... or so I thought! Recently I got a ...
-1
votes
1answer
4k views

how to trace the IP address of gmail account sender via browser [duplicate]

Possible Duplicate: How to trace email? i wanted to know the location of sender email which sent us the threat email the header of email is mentioned below Analysis: Received: from ...
-7
votes
2answers
133 views

Person has no persona on the internet yet runs a business [closed]

Original Question: There is this older person (60+yrs) who is runs a business with internet presence yet when I do am internet search on him nothing pops up, not even photos!! How do I find out if he ...