Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

0
votes
0answers
13 views

What jurisdiction do DNS root servers and corresponding TLDs have?

We are setting up DNSSec and want to document risks that relate to the core root servers, their binding keys, and the next level DNS TLD. Since there is history saying that the US Government owns ...
1
vote
1answer
47 views

Is CloudKit or iCloud suitable for storing PII?

iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device. CloudKit is a similar technology that allows (from what I can tell) the partial ...
34
votes
8answers
8k views

Is it legal to start a private website for you and your friends to hack? [closed]

My friends have expressed an interest in hacking, but we don't want to do anything illegal, and considered CTF365, but it was WAY to expensive. Is it possible/legal for one of us to create a private ...
0
votes
2answers
80 views

Can a school legally access an account that a student logged in to at school? [closed]

Is this scenario legal, A school has a few public computers that can be used. The only browsers that are installed are chrome and internet explorer, and the entire network is man-in-the-middled. ...
1
vote
2answers
53 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [closed]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
2
votes
0answers
58 views

Who is responsible for a compromised computer? [closed]

In light of the recent public hacks on public systems, is there any culpability for the owner of a compromised system? Two examples: The owner is a large public company that leaks sensitive ...
0
votes
2answers
61 views

Web/App vulnerability responsibility [closed]

While auditing a few web apps and websites I uncovered a few serious vulnerabilities which I've since flagged (responsibly, of course). One of the things I noticed was that several development ...
2
votes
0answers
172 views

How do I avoid drawing the ire of the Department of Homeland Security when prepping to run my RPG? [closed]

So I'm running a long-standing role-playing game wherein the players' characters in the game are unknowningly working for another character who wants access to the data of the United States ...
1
vote
0answers
121 views

Has 100+USD, accidentally [closed]

Yesterday, I just visit a shopping site which use serial payment method and I type in some serials randomly then my account have 100USD; I just want to 'test' that website (for the bug bounty), is my ...
4
votes
2answers
269 views

Has a plaintext password ever been used in a court of law as evidence to a crime?

Regardless of how the password was obtained (decryption, bad hashing, confession): Are there any prior known cases where the contents of the password was used to prove motive or guilt? Or, looking ...
7
votes
1answer
866 views

Why does every site makes me acknowledge cookie usage? [closed]

In the last year or so every other site on the net started showing different kinds of notification that they're using cookies and I should be aware of it. The sheer number of different sites doing ...
-1
votes
1answer
132 views

Is attempting mySQL injection illegal? [closed]

I was testing an SQL injector I made in Java and the site I tested it on said 'Detected security breach attempt' blah blah blah. Is what I did illegal or not? I have found different opinions and ...
2
votes
1answer
136 views

Is it legal to “use” security vulnerabilities [closed]

I understand that the answer to questions like this depend on country, but I'd like to get an idea what the usual approach to cases like this are. Heres the case: I found a security hole in one of ...
2
votes
2answers
502 views

Penetration testing's terms of agreement template

My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it. I'm wondering if is there any template which states the most ...
1
vote
0answers
90 views

Traveling abroad with encryption software on my computer [closed]

I have software installed on my computer that has encryption capabilities. This is the case both for things like VPN/SSL, and also GPG. I don't really use GPG (there are not that many people I can use ...
0
votes
2answers
179 views

Are files hosted on cloud servers/websites/databases manually checked by people?

I was wondering ... when I upload a file to, say, Dropbox, does anybody personally check it to see what it is? Say I upload a copy of my Blu-ray movie to cloud storage ... will anyone check, and ...
0
votes
2answers
114 views

Content of a penetration testing authorization

Recently I conducted a penetration testing where I used the following text as authorization: Penetration testing authorization During a penetration testing is possible that: The ...
0
votes
2answers
176 views

Is it legal to create a remote administration tool? [closed]

I'm planning to make a simple remote administration tool with the basic features that are available on all other rats in the market. However, I'm really worrying about legal issues after marketing it. ...
2
votes
2answers
170 views

Does SMIME differ from TLS, PGP, DMARC signature, or a Portal Encrypted email message in terms of legal non-repudiation?

I'm interested in protecting email messages from NSA-style snooping, but don't want to incur additional legal risk in doing so. In other words, does SMIME encryption and/or signing cause a given ...
0
votes
3answers
3k views

Are VPNs/proxies legal? [closed]

Are VPNs/proxies (and VPN/proxy software such as Tunnelblick and Hola) legal in the U.S., assuming that you are doing legitimate activities on the Internet (i.e. nothing illegal)?
1
vote
2answers
303 views

Is it illegal to publish an exploit against a known vulnerability in US?

Is it illegal to publish an exploit against a known vulnerability in US? The exploit could be published in one's blog or places like exploit-DB. It seems that in countries like Germany and France such ...
1
vote
2answers
104 views

Can I save & store a user's data in a way that proves that the information has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
1
vote
3answers
555 views

How does a GSM triangulation work? [closed]

A have always been told that to get a geolocation of mobile phones there is the need 'ping' it with at least three cells. So actually, a standard and basic triangulation would just get from three ...
2
votes
1answer
436 views

Are legal notices in a login banner legally significant in terms of computer misuse?

Is there any case-law where having or not having a legal notice (example here) in the login banner of a system of nay kind made a difference in prosecution? The question is in consideration both of ...
1
vote
1answer
120 views

What companies drive around recording license plates? What do they do this for and on what grounds are they able to do so, legally speaking?

A friend shared a "security service" he just read about. Apparently the product is in beta and can thus be tried by anyone right now. I found it very interesting and surprising. I'm curious to know ...
-3
votes
1answer
55 views

major US cybersecurity laws/policies since 2000? [closed]

I am reading Cybersecurity and Cyberwar by P.W. Singer, and trying to tie the subject in with a government class project. I am looking laws and policies regarding cyberspace or cyber security, passed ...
2
votes
1answer
534 views

Is there a maximum allowed key size in the USA?

I've heard that using encryption outside military use has been illegal for a long time in the USA. However, I've also heard that when the regulation was updated, limits were put on encryption strength ...
52
votes
13answers
7k views

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
1
vote
0answers
31 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
-2
votes
1answer
54 views

Privacy vs monitoring cyber crime [closed]

So , how does the police find/monitor criminals' actions (eavesdropping) that do cyber crime(pornography , drug trafficking etc..) without breaking their privacy, and succesfully catch em and provide ...
1
vote
2answers
179 views

How could police identify digital contraband and charge someone if it's encrypted with keys?

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an ...
-1
votes
1answer
389 views

How can an ISP throttle encrypted connections? [closed]

I have had experience with an ISP that slows down all encrypted connections (down to an average 20-35 KBps) I was wondering if a) this is legal b)how can they do it and c) is there a way to bypass it. ...
2
votes
1answer
373 views

Legality of downloading leaked hashes / attempt cracking [closed]

Note: I realize there is no legally binding talk hereinafter. There are lots of leaked password hashes on the internet. Twitter searches for "hash dump" pull back tons of links, generally from "deep ...
2
votes
2answers
127 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
0
votes
2answers
54 views

Contents retrieved from a not protected url from content owner's server. Legal? [closed]

Is legal to use contents retrieved from a not protected url (no authentication involved, just a public accessible URL) from the content owner's server? Is legal to distribute urls pointing to that ...
2
votes
2answers
132 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
1
vote
3answers
259 views

Tell and sell a (web app) vulnerability legally

If someone discover an unknown vulnerability for a given online service or website, is there a decent way to sell it directly to the concerned entity.
4
votes
3answers
235 views

Is there any reason in particular encryption keys aren't arbitrarily large?

It's my understanding that the more bits an encryption key has, the longer it takes to break the encryption. What is the down side of having a larger encryption key or why don't we see keys of size ...
1
vote
1answer
181 views

Is it legal to publish viticim's password and email?

With so many identities stolen last ten years, we know a bunch of emails and a bunch of passwords. Are the two following databases legal under the US federal laws? Publish a database which victim's ...
2
votes
2answers
100 views

Should digital forensics examiners avoid the term “evidence” outside legal proceedings? [closed]

This is what the authors of the book "Digital Forensics with Open Source Tools" say about the term evidence: The examiner reveals the truth of an event by discovering and exposing the remnants of ...
5
votes
1answer
2k views

What are the implications of running a TOR non-exit relay node?

Intuitively, running a non-exit TOR node should bring the benefit of plausible deniability that a packet originated from your device. Unlike exit nodes however, you would not have to worry about ...
1
vote
0answers
175 views

Encrypted chat using any smartphone. Is it legal? [closed]

Here's my case. We have written app for Android smartphones which allows users to exchange secured cipher messages. For key-exchange we're using elliptic curve 112 bits, for messaging we're using DES ...
0
votes
1answer
45 views

Export Restriction of wrapper for existing crypto library

I am creating a packaged C++ library for creating http/https clients/servers. As part of that, I am planning on using either the botan (http://botan.randombit.net/) or openssl tls wrappers. My ...
21
votes
2answers
5k views

In the SilkRoad takedown, what does it mean “An IP address was leaking” in Tor?

According to the official complaint, on Page 28 they mention: on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from ...
0
votes
2answers
521 views

Is it illegal to use Fake User-agents? [closed]

Is it illegal to impersonate user-agents when you are crawling a website? If so, what and how a legal action can be taken against the faking requester? Is this law applies only for crawlers or a user ...
4
votes
1answer
578 views

Avoid being implicated in criminal activity when using Tor

What steps does a Tor user need to take to ensure that he or she doesn't become implicated in other Tor users' criminal activity? For example, I recently came across a Tech Republic article by ...
1
vote
1answer
239 views

Which cloud providers can be used for the simulation of DDoS attacks? [closed]

Cloud providers have a great infrastructure to perform DDoS simulations. You can get thousands of virtual machines with different IP addresses, fully customizable with the tools you need for testing. ...
0
votes
2answers
120 views

Germany: Privacy Protection Regulations and Response [closed]

Do privacy protection laws within Germany/EU protect students from gross invasions of privacy? I have reason to believe that through some either permitted or unsanctioned channel my teacher was able ...
0
votes
1answer
169 views

In which country can you host a service which honors privacy?

Recent events like the Lavabit case have shown that it is no loger possible to host a server in the United States and guarantee your users that you will keep their data confidential, because the US ...
1
vote
2answers
350 views

What are some examples of legal action taken as the result of a security breach? [closed]

As of late, there's been lots of reports of companies losing data due to "hackers". More often than not, this just boils down to lax security. I am looking for concrete examples of a breech where ...