Identity is the property of an object which allows it to be uniquely specified.

learn more… | top users | synonyms

45
votes
3answers
8k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from service@intl.paypal.com, with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
45
votes
5answers
9k views

Are GUIDs safe for one-time tokens?

I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification. Presumably they are appealing because they are easy to generate, unique, ...
29
votes
3answers
10k views

Why do I need to hide my phone's IMEI

If it is a secret then why is it visible on the box, invoice and the back of the phone? If it is not a secret then why does it have to be blurred when it gets posted online?
26
votes
5answers
3k views

Should usernames be kept secret?

Help me settle an discussion among colleagues and guide future design: Even in a high impact scenario: e.g. protecting payment application or government gateway but in an Internet accessible ...
24
votes
3answers
1k views

A Different Approach to PKI

After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
19
votes
2answers
8k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
18
votes
6answers
7k views

How to verify that someone is who they say they are online?

I am working on an online job application web app and the question has come up about how we will verify that someone submitting an application is who they say they are. For example, we don't want ...
18
votes
1answer
319 views

What's this kind of authentication scheme called?

In the past I've heard about a scheme to prove your identity online in places like forums, without having to create an account. When posting, the user would enter a password which is then heavily ...
17
votes
2answers
11k views

Best Practice: “One per-user ssh key” or “multiple per-host ssh keys” [duplicate]

Possible Duplicate: What’s the common pragmatic strategy for managing key pairs? I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when ...
16
votes
4answers
358 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
15
votes
3answers
46k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
15
votes
3answers
868 views

How to secure identity after someone dies?

How would you go about securing the online identity(ies) of someone as best you can after they've died, when they haven't put anything in place ahead of time for this event? Assume we don't know how ...
12
votes
11answers
7k views

Besides IP addresses, how else could one be identified? [closed]

OP: I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the ...
12
votes
1answer
6k views

Ways to sign gpg public key so it is trusted?

I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they ...
12
votes
3answers
8k views

Why would someone register a Facebook account with a stolen email address?

I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
12
votes
1answer
1k views

What encryption prevents the tampering of Windows Identity Foundation (WIF) FedAuth cookies?

It occurred to me that the WIF FedAuth cookies contain identity information, that if tampered with, could permit someone to assume the identity of another user. Fortunately, WIF does ...
11
votes
2answers
3k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
11
votes
3answers
2k views

Length of CSRF Token

Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
10
votes
2answers
345 views

How to protect against exploitation using a lapsed domain

Consider a domain that had been in active use for some time but is no longer desired — perhaps the company is out of business or a name change took place years ago, or whatever. The domain ...
10
votes
1answer
993 views

How to prepare for protecting identity after death?

In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
9
votes
7answers
401 views

Aren't permanantly logged in accounts inherently insecure?

The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...
9
votes
2answers
296 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
8
votes
5answers
383 views

How to verify new accounts against a known persons database?

I need to (try to) solve the problem of new account creation for a patient portal for a medical records system (electronic health record). That is, a way to activate a patient online and match her ...
8
votes
4answers
1k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
8
votes
1answer
286 views

How can I limit the consequences of a possible future identity theft?

I am curious about how I can limit the consequences of an identity theft. I see a lot of discussion and advice about managing passwords securely or blocking malware. But what if it happens? What if ...
7
votes
6answers
1k views

Secure Internet Polling

In the United States, there has been a lot of talk about creating a secure polling system that would operate over the internet. I have also heard that Securing a poll over the Internet is impossible. ...
7
votes
2answers
6k views

Why do some companies ask last 4 digits of my SSN or a scan of my ID? What are my risks?

Yesterday I found out that some major service provider (online rentals) that I use now requires proof of my identity if I want to continue and make a booking. I was offered 2 options: 1) Enter last ...
7
votes
2answers
2k views

Best Practices for verifying a users identity for helpdesk

I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted I know these ...
6
votes
4answers
11k views

Bank account number and account holder in check exposed?

I'm not sure if this is standard practice in all banking institutions but almost all banks where I've received checks the account number of the issuer is exposed (some even the account name). Isn't ...
6
votes
2answers
49k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
6
votes
1answer
77 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
5
votes
3answers
29k views

Someone keeps using my email address. What to do?

I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
5
votes
2answers
385 views

Is there a reason why IMEI is stored in EEPROM?

I've heard that IMEI numbers are stored on an EEPROM, essentially letting them be erased and rewritten. Thieves misuse it to make stolen phones untraceable. Is there a reason why manufacturers don't ...
5
votes
1answer
564 views

Are there risks of using the same OpenID provider for sites with different security levels?

I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
5
votes
2answers
302 views

Single vs multiple personas? What are the security implications?

I have two email addresses, one for work and one for home. I have have two cellphone numbers, one for work and one for home. But I am just one individual (and only have one social security number ...
5
votes
2answers
882 views

Appropriate response to 2014 Russian Security Breach (CyberVor)

The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
5
votes
1answer
1k views

UPS my choice — How can I access my public records?

I was signing up for UPS my choice and they asked me some security questions. It asked me questions that signified that it was able to figure out: Who my father is and when my father was born. My ...
4
votes
3answers
3k views

How secure can IP based login be?

From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. Our idea is not new: we want a one-time validation and ...
4
votes
2answers
142 views

What bad things could an “attacker” do with my stolen ID's?

So if someone steals my (ex.: I didn't teared up a piece of paper that had these and I throwed it away on the street) ID's like my: Full name Permanent address Birth date/place My mothers name ...
4
votes
5answers
165 views

How can I verify that an organization is what they say they are online?

I'm creating a website that only allows nonprofits and government organizations (parks, etc) to sign up and post service project listings. The accounts posting the listings must be verified to protect ...
4
votes
3answers
1k views

Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]

Recently while trying to log-in to Facebook this notification starts to appear: At first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website! I ...
4
votes
2answers
106 views

A potential possibility of improvement of PKI for personal communications

In countries like Germany each citizen has an identity card that is issued by the registration authority. Since the identity of a citizen is, in a sense, created by that authority via assigning him ...
4
votes
1answer
279 views

Deal with number changes in a phone number based authentication/login system

Twitter Digits (https://get.fabric.io/digits) provides an authentication/login system based on phone numbers for mobile apps, and several other mobile apps (e.g. Square Cash, ...
4
votes
1answer
37 views

Keeping login in sync with third party providers

When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status. If I have my own server, which requires an access token of it's own ...
4
votes
0answers
265 views

Ensuring an HTTP request is coming from my program

Is there a way to ensure that an HTTP request to my REST server is coming from my application? I'm guessing no because whatever I do on the client side, as people have access to that code, they can ...
3
votes
4answers
2k views

Can SMS text messages be used to verify a person's unique identity through a short code system?

We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: ...
3
votes
5answers
405 views

Can we have https without certificates?

I apologize in advance if I am fundamentally misunderstanding something, but is it possible to have encrypted communication protocols (https, I suppose) without resorting to a certificate system? ...
3
votes
5answers
200 views

How can I uniquely identify an user when cookies are not an option?

In web application development, how can I uniquely identify an user when cookies are not an option and IPs are dynamic? Are the patterns which I can combine and then created a hash to be used as a ...
3
votes
2answers
2k views

How Is It Possible For Hackers To “Dig Up The Dirt” On People?

Like the title says, I was wondering how its possible for hackers to "dig up the dirt" and get peoples personal information such as address, credit cards, bank accounts, social insurance number, etc? ...
3
votes
2answers
156 views

How to prove flyer was (not) authored by specific person?

Let's say we create a flyer in some desktop publishing software (e.g., InDesign, Illustrator), physically print it and post it somewhere. We don't want inauthentic claims of authorship. Is there a ...