Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.
2
votes
1answer
46 views
Does SGC Support reduce HTTPS security?
Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption.
This article says SGC should never be ...
1
vote
1answer
176 views
Is there any reason to not use DKIM, SPF, and SenderID because it affects plausible deniability?
Is there any basis in not deploying anti-spam (or deliverability) technologies like DKIM, SPF, and SenderID because it affects plausible deniability?
Some definitions to get everyone on the same ...
3
votes
1answer
511 views
How to backup database to comply with UK data protection act?
Charity has a server in their office onto which they backup a database with sensitive information. They want to get rid of this server.
Is there a cost effective solution that would allow them to ...
5
votes
3answers
351 views
Is my sons' school portal in violation of any Password/UserID rules?
My sons' school sends both ID and PW for a portal through USPS at various times during the year, (e.g. class registration) whether I need it or not.
If I change the password, it sends a confirmation ...
2
votes
2answers
234 views
Google Account Compromised - Possible Investigation?
This morning, I've not been able to login to my Google Account.
Google says, my account has been compromised and I had to walk through account credentials recovery and verify (SMS to verify phone ...
1
vote
3answers
593 views
Is scanning a site directory considered illegal penetration testing?
Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
-1
votes
2answers
161 views
Is it Illegal to break out of a forum post by using CSS for example?
Is it illegal in the UK to post styling that breaks out of a post?
For instance, if styling were allowed here and I were to use it to change some stackexchange pictures on this page, would that be ...
3
votes
5answers
271 views
Laws on Programming Security Tools
I am currently working on some POST GATHER modules for the Metasploit Framework the idea is that after a shell is spawned on the target, it will gather certain files from the target such as chat logs. ...
2
votes
2answers
387 views
Hacking / Penetration Testing Laws
Is it illegal to post tutorials and articles on hacking related things? In particular in the UK.
For example would it be illegal under this law?
http://www.legislation.gov.uk/ukpga/1990/18/section/3A
...
2
votes
4answers
234 views
What actions should be taken by site according to Data Protection legislations?
Many countries have data protection legislation:
Data Protection Directive in EU
Data Protection Act 1998 in UK
privacy laws in USA
Web application may have registration form where fields for ...
10
votes
2answers
493 views
What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?
I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder.
Lets assume, for the sake of this rather hypothetical question, that a ...
4
votes
1answer
141 views
What countries have laws in place that respect Do Not Track HTTP headers or cookies?
Google offers a Chrome plugin that uses cookies to control privacy, while Firefox offers a HTTP Header to tell websites to not track the users and log the data anonymously.
This obviously extends a ...
4
votes
4answers
1k views
Encryption laws in India — is it allowed to use ssh and VPN?
I have a very similar question to the one asked here (regarding Iran). However, I would like to use ssh and vpn while being in India. I found already this survey of cryptographic laws but I don't ...
5
votes
2answers
281 views
How to refute “don't use internet if you don't like it” answer?
I hope it is legit question, similar to, for example, Why do law-abiding citizens need strong security?, et al. and it is tightly conected with user's security, privacy, etc.
The response I always ...
0
votes
1answer
150 views
What regulations *require* multi-factor authentication?
Just the straightforward question: What industries require multi-factor authentication?
Please include the following information
Country
Industry
Regulation name
Additional information as you ...
2
votes
2answers
182 views
Legal Risk to unpatched servers
Since one of the 10 domains on the CISSP is legal/governance, I figured this would be the best place to ask.
I recently did a security assessment for a non-profit. I found that their systems needed ...
10
votes
3answers
539 views
Encryption-Laws in Iran
According to this article Iran has criminalized the usage of encryption and VPNs.
According to this blog post it is still possible to use SSH tunnels in Iran.
For me SSH is encryption and thus ...
7
votes
2answers
210 views
Business-to-Business Security Disclosure and Agreement
Looking for a template covering the disclosure information security practices that are standard in Business-to-Business partnerships that share data.
For example:
Access management
Password ...
3
votes
3answers
255 views
What to consider in an SLA to ensure secure software when outsourcing software development?
To ensure secure development in the off shore team what are considerations to be taken into account in the SLA?
I got this as a reference: ...
3
votes
1answer
186 views
HITECH : New United States Federal Act on Data Security
Has anyone heard of the new HITECH Federal Act? I understand that it is an underscore of the HIPAA Federal Act but am unclear of the requirements that they are requesting.
It targets companies that ...
3
votes
1answer
194 views
What lawful interception standards are used outside Europe?
In Europe European Telecommunications Standards Institute (ETSI) define the standard requirements to handle a lawful interception.
It's define all from the terminology and definition to the ...
2
votes
1answer
83 views
Privacy policy about links to other sites
In many of the privacy policies, I noticed there is one section as a disclaimer mainly talking about "our websites contain links to other websites, and it is your own risk/responsibility to familiar ...
3
votes
5answers
332 views
Am I required to hash passwords
Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen?
If not required in the US, but required in the ...
18
votes
6answers
6k views
Is Facebook allowed to sell/give your information away to anyone willing to buy it?
Is Facebook allowed to sell information about their users to other companies?
For example selling name, address and IP information on a specific geographic location could be very valuable ...
1
vote
1answer
178 views
Can we protect domain name by law? [closed]
Some company have domain names worth a million dollar. But sometime they are lost to hackers. So I wonder how can we protect domains by law instead of technology?
10
votes
3answers
2k views
Should anyone support / implement P3P policies? Do they matter? Are they legally binding?
Google and Facebook authentication both have fake P3P policies in the HTTP headers that link to a webpage that explains why they don't support it:
CP="This is not a P3P policy! See ...
3
votes
2answers
170 views
What are the consequences for deceptive practices against stated privacy policy
Disclaimer: I'm aware my question is a bit far from IT security practices but here is the most appropriate place I can think of to post my question within the whole stackexchange.
Let's say, many ...
12
votes
5answers
721 views
Is it legal to log passwords from failed logins?
Is it legal to store/log mistyped passwords?
How many of you have seen this happen in a log file or DB?
4
votes
2answers
335 views
Why have export controls for cryptography?
I've always heard someone justify the means for export restrictions with "it's for governmental control/spying". In most reasonable countries, the justice system asks people to adhere to the "spirit ...
5
votes
1answer
236 views
How does sound signature recognition work and how to override it?
Today a lot of websites that allow the upload of media content are implementing automatic sound signature checks to prevent the illegal distribution of videos containing copyrighted content.
How ...
7
votes
7answers
2k views
Storing credit cards for automatic payments?
I have no experience with storing credit cards and I do not know anything about the legal end of this.
The company I work for / develop for wants to store credit cards to process auto payments for ...
2
votes
2answers
260 views
SOHO router intrusion
In the hypothetical scenario where someone has managed to gain unlawful access to a SOHO router (any of the consumer wifi models will serve nicely), what steps can you take to verify this, so as to ...
4
votes
2answers
162 views
What to do in response to a source code and/or database leak by a third party hosting provider?
My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak.
On first appearances, the web host ...
12
votes
5answers
28k views
Can someone steal money from my bank account if they know my IBAN and personal details?
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
21
votes
6answers
5k views
Sharing wifi at a business - Bad Policy?
Is it safe for a small business to let customers use their wifi while waiting?
My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
11
votes
6answers
3k views
At what point does “hacking” become illegal?
Hypothetical situation:
before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites.
Issue:
this situation raises a big ...
8
votes
3answers
373 views
How do researchers “gain control of an attacking PC” and not themselves be considered attackers / criminals?
In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises"
The Cliff's Notes to the article is thus: ...
17
votes
5answers
681 views
Is there any legal reason to save a cleartext password?
I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen.
I asked her about this and she defended the ...
2
votes
3answers
500 views
What happens with a subpoena and a system designed to protect itself from you?
After reading about the recent Dropbox issue I'm starting to wonder if they could legally keep their initial promise.
Lets say that you're like Dropbox or Lastpass and you store users' information in ...
5
votes
2answers
670 views
Export laws on the cloud (key size)
Do the U.S. export laws around AES-256 apply to applications hosted in the cloud?
17
votes
2answers
433 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
11
votes
5answers
359 views
How can citizens prevent government-led Internet blackouts?
The United Nations now considers Internet access a basic human right. [PDF]
Despite the questionable effectiveness of Internet blackouts in silencing a populace and preventing uprisings1, it's ...
11
votes
3answers
330 views
How to secure identity after someone dies?
How would you go about securing the online identity(ies) of someone as best you can after they've died, when they haven't put anything in place ahead of time for this event?
Assume we don't know how ...
14
votes
3answers
683 views
Techniques for ensuring verifiability of event log files
Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
27
votes
7answers
2k views
Is it illegal to read an e-mail that was accidentally sent to you?
I'm not sure if this is the right website to ask this but I'm giving it a shot.
I got the following message in an email today: (it's translated so sorry for the typo's/mistakes)
This e-mail and ...
4
votes
6answers
539 views
What might be the legal and policy consequences of traffic sniffing?
I found a security hole in an organisation in the UK with many employees. Login form sends user name and password in clear text to the public facing IP via HTTP. Initially I pointed this to IT but ...
5
votes
7answers
2k views
Can I reclaim ex employee gmail account?
This is the best place in SE I can find to post this.
We have an ex employee who created a gmail account for work purposes that looks like staff_name.company_name@gmail.com
He left the company and ...
8
votes
2answers
174 views
How can one easily determine which IT Security related regulations apply?
Joe Tech gets a job managing Acme Startup's IT services. Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C. Joe Tech is aware that some of these data types ...
15
votes
4answers
760 views
Can ECC be used without infringing on patents?
Can ECC (Elliptic Curve Cryptography) be safely used without infringing on Certicom's patents?
I would like to make use of ECC in an embedded system to establish a secure channel. But, I am concerned ...
5
votes
2answers
1k views
Is strong cryptography legal across the internet?
In many countries strong cryptography is outlawed. That means you must store the data of your users in such a way, that government of that country can always decrypt it. And if you don't, you are a ...
