Identity is the property of an object which allows it to be uniquely specified.

learn more… | top users | synonyms

1
vote
2answers
34 views

Best practices for GPG user ids

What is the best practice for choosing GPG user id(s)? I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because ...
1
vote
2answers
95 views

Should every SAML identity provider provide a unique public certificate to the service provider?

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
4
votes
5answers
95 views

How can I verify that an organization is what they say they are online?

I'm creating a website that only allows nonprofits and government organizations (parks, etc) to sign up and post service project listings. The accounts posting the listings must be verified to protect ...
0
votes
2answers
73 views

Encrypting using the private key in Identity-Based Cryptography

In normal asymmetric crpyto like RSA, if Alice encrypts something using her private key, Bob can decrypt it using Alice's public key. Is the same possible in Identity-Based Cryptography, where the ...
2
votes
3answers
2k views

Someone keeps using my email address. What to do?

I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
0
votes
3answers
69 views

Recommendation for identity system

I want to develop a system, something like a comment system for a website, that ensures I know who is posting comments. The content that is exchanged is not valuable and does not need to be encrypted, ...
5
votes
2answers
836 views

Appropriate response to 2014 Russian Security Breach (CyberVor)

The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
5
votes
4answers
6k views

Bank account number and account holder in check exposed?

I'm not sure if this is standard practice in all banking institutions but almost all banks where I've received checks the account number of the issuer is exposed (some even the account name). Isn't ...
3
votes
2answers
143 views

How to prove flyer was (not) authored by specific person?

Let's say we create a flyer in some desktop publishing software (e.g., InDesign, Illustrator), physically print it and post it somewhere. We don't want inauthentic claims of authorship. Is there a ...
3
votes
1answer
176 views

pro and cons of having 2 Identity providers

My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and ...
3
votes
3answers
139 views

What are some cards that are vulnerable to RFID theft?

I heard that some credit cards are vulnerable to RFID scanning and thus identity theft. I am concerned about my cards and I would like to learn which cards are vulnerable to such abuse? Are any of ...
2
votes
2answers
13k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
6
votes
4answers
1k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
15
votes
4answers
254 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
0
votes
2answers
122 views

Why do file storage sites have a long unique id for their download links?

I'm creating a file storage site and what I would do is just have the download links format as: https://www.domain.com/[id]/[file name] //id would just be 1, 2, 3 etc. Dropbox and many others have ...
1
vote
2answers
59 views

A manual function for hasing identity?

I hope you won't close the question. Even though there are no computers involved, it is still about information and security, and I think that security experts are the ones who will be able to help ...
1
vote
1answer
134 views

Passport copy is being used to defraud others - what can I do?

I was an idiot and sent my passport and address to a scam artist I was hoping to rent an apartment from abroad. Luckily, I realized the trickery before sending anything else or any money. ...
41
votes
3answers
8k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from service@intl.paypal.com, with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
3
votes
3answers
2k views

What is the exact difference between SAMLp and WS-Trust?

They seem to be similar on the surface, but I'm not sure how deep the differences are. Can someone explain to me the difference between SAMLp and WS-Trust? ADFSv2 gives me a choice between these ...
0
votes
2answers
36 views

Is there any mail service accepting real id? [closed]

Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address. If there is a security breach, user may lost important information on that address. They may add phone ...
1
vote
1answer
62 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
6
votes
6answers
852 views

Secure Internet Polling

In the United States, there has been a lot of talk about creating a secure polling system that would operate over the internet. I have also heard that Securing a poll over the Internet is impossible. ...
0
votes
2answers
63 views

Is there a way to prevent software from accessing hardware IDs?

I think this is related to this question, but I would like to know if there's also a way to prevent "third party" applications from seeing hardware IDs (motherboard, hard disks, and others), or giving ...
9
votes
3answers
923 views

Length of CSRF Token

Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
0
votes
1answer
77 views

Is it safe to recycle unshredded credit card receipts?

Is it safe to recycle unshredded paper credit card receipts? Can identity theft be helped by data disclosed on most vendor's receipts?
10
votes
3answers
5k views

Why would someone register a Facebook account with a stolen email address?

I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
3
votes
3answers
86 views

Way for two parties to establish that they are not previously known to each other

(Sorry if this isn't in the right SE / is not relevant for security.stackexchange - seemed like the best choice) Is there a way for two anonymous parties to establish that they are not previously ...
2
votes
2answers
359 views

When using private browsing can a website view data stored before private browsing was turned on?

If a browser has been used to visit a few sites and has active logins and then the user turns on private browsing, can the sites still access data such as cookies and cached files that were created ...
5
votes
2answers
264 views

Single vs multiple personas? What are the security implications?

I have two email addresses, one for work and one for home. I have have two cellphone numbers, one for work and one for home. But I am just one individual (and only have one social security number ...
2
votes
2answers
116 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
0
votes
2answers
2k views

How to prevent other hosts on the same LAN from seeing my IP and host name?

I want to hide my computer IP dan hostname when I am online on the same LAN on which other computers running netcut and other network tools. I have installed netcut defender but it seems not to hide ...
8
votes
2answers
3k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
4
votes
3answers
656 views

Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]

Recently while trying to log-in to Facebook this notification starts to appear: At first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website! I ...
1
vote
3answers
554 views

Can Paypal be used to verify a user's identity?

As I use my Paypal account for various online services, I noticed that vendors integrate differently with Paypal for on-demand payment, and scheduled payments. I also noticed that Paypal offers a ...
1
vote
1answer
162 views

How does IIS persist identity credentials? Does it create any security issues?

We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
17
votes
1answer
305 views

What's this kind of authentication scheme called?

In the past I've heard about a scheme to prove your identity online in places like forums, without having to create an account. When posting, the user would enter a password which is then heavily ...
6
votes
2answers
775 views

Best Practices for verifying a users identity for helpdesk

I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted I know these ...
8
votes
11answers
3k views

Besides IP addresses, how else could one be identified? [closed]

OP: I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the ...
10
votes
2answers
260 views

How to protect against exploitation using a lapsed domain

Consider a domain that had been in active use for some time but is no longer desired — perhaps the company is out of business or a name change took place years ago, or whatever. The domain ...
2
votes
1answer
107 views

Where can I find articles about identity disclosure attack?

Where can I find more details about identity disclosure attack and it's prevention? If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
5
votes
1answer
416 views

Are there risks of using the same OpenID provider for sites with different security levels?

I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
0
votes
2answers
194 views

Verifying users location & authenticity

I am builduing a business to business website, and users are able to sign up with a personal profile and create a business (like linkedin). I need to verify the following: Business Name ...
13
votes
3answers
19k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
24
votes
3answers
958 views

A Different Approach to PKI

After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
8
votes
1answer
167 views

How can I limit the consequences of a possible future identity theft?

I am curious about how I can limit the consequences of an identity theft. I see a lot of discussion and advice about managing passwords securely or blocking malware. But what if it happens? What if ...
-1
votes
1answer
3k views

how to trace the IP address of gmail account sender via browser [duplicate]

Possible Duplicate: How to trace email? i wanted to know the location of sender email which sent us the threat email the header of email is mentioned below Analysis: Received: from ...
4
votes
1answer
1k views

UPS my choice — How can I access my public records?

I was signing up for UPS my choice and they asked me some security questions. It asked me questions that signified that it was able to figure out: Who my father is and when my father was born. My ...
4
votes
2answers
133 views

What bad things could an “attacker” do with my stolen ID's?

So if someone steals my (ex.: I didn't teared up a piece of paper that had these and I throwed it away on the street) ID's like my: Full name Permanent address Birth date/place My mothers name ...
3
votes
3answers
173 views

How to know if its the same User?

I asked a question awhile ago asking how to make an efficient encrypted chatroom. What I ended up doing was Making each user generate a 4096 bit RSA KeyPair, share their public Keys, and then one of ...
17
votes
6answers
3k views

How to verify that someone is who they say they are online?

I am working on an online job application web app and the question has come up about how we will verify that someone submitting an application is who they say they are. For example, we don't want ...