Identity is the property of an object which allows it to be uniquely specified.

learn more… | top users | synonyms

0
votes
0answers
10 views

What are the benefits to adding a bitcoin blockhash UID notation to one's PGP key?

Example: Notation data: blockhash@bitcoin.org 000000000000000011d9f6931e65f814c6f3b221736b0c45f25e0365a3d156fa As seen here: ...
0
votes
1answer
106 views

Who's been accessing my computer with TeamViewer? Tracking through UUID [duplicate]

So here I am, sitting at my computer screen on the one day of the week I stayed home from work, checking messages on my phone, when out the corner of my eye I see a browser page being opened. It was ...
7
votes
6answers
107 views

Should I use a cryptograpically secure random number generator when I generate IDs?

It is common to generate random identifiers to expose through an API instead of using a simple auto incrementing primary key. The reasons are many: Prevents easy enumeration. Does not give away ...
1
vote
2answers
28 views

Random autofill [closed]

I was trying to pay for something just now, and when I put my name in the chrome autofill came up and I clicked it. The address that showed up was wrong though but corresponded to the postcode of one ...
9
votes
2answers
13k views

Why do some companies ask last 4 digits of my SSN or a scan of my ID? What are my risks?

Yesterday I found out that some major service provider (online rentals) that I use now requires proof of my identity if I want to continue and make a booking. I was offered 2 options: 1) Enter last ...
17
votes
3answers
50k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
3
votes
1answer
43 views

Single randomly generated passphrase for both identity and authentication

There are questions about using a password only to identify and authenticate a user, rather than an email address or username plus password: Why do we authenticate by prompting a user to enter both ...
5
votes
1answer
64 views

Keeping login in sync with third party providers

When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status. If I have my own server, which requires an access token of it's own ...
6
votes
1answer
104 views

Can windows domains be faked?

Without the equipment and software (and knowledge yet) readily available to test myself, I've been wondering about the relationship between computers and domains in a Windows environment. Some ...
0
votes
2answers
48 views

Guarantee one unique identity per node

I'm in the early stages of designing a decentralised systems protocol, based on a blockchain, for a thesis. For the protocol to remain secure, each node in the system must be capable of generating ...
5
votes
3answers
35k views

Someone keeps using my email address. What to do?

I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
-4
votes
1answer
101 views

Is there any way to really have a secure ID? [closed]

Is there any method currently available (regardless of cost) which makes it impossible to spoof or steal my identity in an online situation? If not, is there anything on the horizon that could become ...
3
votes
3answers
70 views

Is it possible to modify jQuery client code to call a remote API in an unintended way?

Is it possible for someone to modify the JQuery code of a remote page and make it call the remote APIs in a different way than intended? Suppose the website www.domain.com has a jquery.js script ...
3
votes
2answers
116 views

A potential possibility of improvement of PKI for personal communications

In countries like Germany each citizen has an identity card that is issued by the registration authority. Since the identity of a citizen is, in a sense, created by that authority via assigning him ...
0
votes
2answers
132 views

Disclosing too much info over email just to close account?

I have account with a stock option trading platform. They are well known and reputable. I had a couple thousand in the account, bought and sold for a while, and then cashed out and withdrew. So I'm ...
11
votes
2answers
3k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
0
votes
1answer
320 views

How WhatsApp identifies a specific user

How does WhatsApp identify a specific user in order to forward the messages to him? Here is what I did: I backed up my iOS App from my old device Restored the backup to the new device Opened ...
3
votes
1answer
165 views

Prove ownership of a GMail account

Is there a way for a person to remotely and irrefutably demonstrate ownership of a Gmail email address? I've considered using DKIM signatures, but this has problems: PGP Key Signing Robot DKIM ...
-4
votes
1answer
62 views

sourcing harrassing texts [closed]

I live in the US. Someone is texting harrassing messages to me. I have done a reverse lookup which dead-ends in a landline number. The number I have has been confirmed by my wireless Carrier. It ...
0
votes
0answers
31 views

Is there any benefit to re-verifying someones identity on the phone once transferred?

So this example is quite specific. You call up an organisation and they verify your identity using two pieces of information (eg; date of birth, last payment date, mothers maiden name). But then once ...
2
votes
0answers
39 views

How does Adobe Pass Auto-Authentication work?

At time marker 2:05 of this video, he describes that Adobe Pass can automatically identify you based on your broadband provider, and sign you in/authorize you for media content. Can anyone describe ...
3
votes
1answer
530 views

SAML Assertion to Windows Identity (Kerberos token?) transformation

This is the scenario I need to cover: A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
1
vote
1answer
281 views

Why should I trust a JSON Web Token (JWT)?

In the SAML and Kerberos authentication models, there is an explicit understanding of what authority has authenticated the user and issued the credential to be trusted by downstream systems. For ...
0
votes
0answers
51 views

What is NFC REVERSED id

I am very new to NFC, and trying to understand what is the ID(Reversed) is for. Also why is there 3 ID, the HEX, DEX and Reversed??
3
votes
0answers
43 views

What business identifiers are considered non-public, and should not be disclosed?

I am setting up a corporation in the US and UK and am presented with a EIN for the US, and VAT Reg. Number. for the EU. Somewhere in the piles of documentation I have been reading, I read that the ...
-2
votes
1answer
72 views

How can I know if any cell phones other than a given set are turned on in the nearby area?

I am searching for a solution to identify phones simply by the signals it emits. Imagine a signal receiver in a room, then I want to know which people are using phones nearby. I don't care what they ...
1
vote
2answers
104 views

Email used to log in but doesn't have to be unique. Issues?

I've moved onto a project where they are implementing a system whereby a user's email address can be used multiple times by different people - i.e. users can sign up as many times as they want with an ...
0
votes
1answer
110 views

Tips if someone else is using “my” username on another site [closed]

This question isn't about me, though it easily could be, since there are many Barry Carter's out there. Suppose I find out someone is using my FaceBook (or Twitter or StackExchange or whatever) ...
16
votes
4answers
363 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
6
votes
1answer
405 views

Deal with number changes in a phone number based authentication/login system

Twitter Digits (https://get.fabric.io/digits) provides an authentication/login system based on phone numbers for mobile apps, and several other mobile apps (e.g. Square Cash, ...
29
votes
3answers
11k views

Why do I need to hide my phone's IMEI

If it is a secret then why is it visible on the box, invoice and the back of the phone? If it is not a secret then why does it have to be blurred when it gets posted online?
2
votes
1answer
98 views

How would a nation-state provide an API for its citizens to verify their legal identity online? [closed]

An official nation-state institution, like the Swedish Skatteverk, could easily let their citizens verify themselves online. O-auth tokens could be created by the nation-state institution, generated ...
1
vote
3answers
236 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
0
votes
0answers
52 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
2
votes
1answer
92 views

What are proper security precautions when enabling multiple connected social accounts or login/authorization methods?

It is popular today for frameworks and social sites to enable multiple authorization options when creating websites. For example, allowing a user to login with GitHub, Twitter, Facebook, etc. In ...
9
votes
2answers
324 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
2
votes
1answer
222 views

Find out the identity of the person that called you

I once heard that if a number that you don't know called you, you can access a website (that I don't remember now) that will call the number and make a recording of what the person said and send it to ...
2
votes
5answers
339 views

How can I uniquely identify an user when cookies are not an option?

In web application development, how can I uniquely identify an user when cookies are not an option and IPs are dynamic? Are the patterns which I can combine and then created a hash to be used as a ...
0
votes
2answers
62 views

How to steganograph ownership information into members uploaded images?

Considering a social website where members upload images which at times can be very similar - is there a way that images can be 'branded' steganographically with (salted+encrypted) text that ...
2
votes
0answers
35 views

Nation-state digital signatures - how is my public key linked to an identity? [duplicate]

A bitcoiner trying to understand the nation-states. When I use my eID (I'm swedish and I have 'BankID'), and I sign something with my private key that's in the 'eID-file' that I've got on my laptop, ...
3
votes
1answer
96 views

Does the modulus of a TLS certificate uniquely identify the client?

I'm working on a project using a trusted-peer setup. I want a way to uniquely identify each actor in the system, ideally across certificate re-issues as well. In my understanding, the modulus of a ...
2
votes
3answers
238 views

Email confirmation techniques in major sites

The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email. If they have not verified ...
4
votes
1answer
67 views

Identicon for SSL certificate

I have a few self-signed certificates that I use, and I find it tedious comparing the entire hex value of the hash when accepting it in a new location. To be honest I usually just look at the first ...
1
vote
1answer
67 views

VPN multiple IP users anonymity

During a support conversation with my VPN provider, I asked specifically: "is it impossible to filter out a single VPN user since your IPs are in use by many?". The answer was yes, it is impossible. ...
0
votes
1answer
40 views

Sharing sensitive information across servers on visits from the same browser

I have this scenario: Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser. Webserver domain B. ...
6
votes
2answers
585 views

Is there a reason why IMEI is stored in EEPROM?

I've heard that IMEI numbers are stored on an EEPROM, essentially letting them be erased and rewritten. Thieves misuse it to make stolen phones untraceable. Is there a reason why manufacturers don't ...
3
votes
1answer
286 views

Why do websites ask for the last four digits of your social security number?

Quite a few websites, Coinbase and Stripe most notably, ask for the last four digits of your social security number to 'verify your identity'. Assuming these websites are not trying to fraud you, how ...
3
votes
3answers
7k views

What are some cards that are vulnerable to RFID theft?

I heard that some credit cards are vulnerable to RFID scanning and thus identity theft. I am concerned about my cards and I would like to learn which cards are vulnerable to such abuse? Are any of ...
2
votes
1answer
78 views

How good is confidentiality with physical mail forwarding companies? [closed]

I want to use a mail forwarding company that can receive mail for me and forward it to another address. I found many places that do this, but I am worried that eventually my stalker would find out ...
1
vote
1answer
79 views

Is there any College, State or Government ID that transmits a offline verifiably encryptable data blob?

I'm looking for any way to digitally verify a user, ideally with a photo and link PII to that user. My use case is that a user will extract and send an encrypted data blob (say from a passport) to my ...