Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

0
votes
2answers
373 views

Can a man engaged in phishing be prosecuted if I know his IP?

My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
2
votes
2answers
231 views

What may a Hungarian employer do with the employee monitoring logs?

Employers often monitor employee network access, even install keyloggers on their computers, etc. But the articles I found on the internet, is about the monitoring but not what they may do with the ...
4
votes
1answer
325 views

Does deliberately wrong information from a DNS server violate standards generally accepted good practices?

For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up. This is related ...
4
votes
4answers
10k views

What are the laws regarding ISP recording IP addresses? How would they know who had which?

Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...
-5
votes
4answers
319 views

Is TLS-in-TLS supported in any software? Does it make sense? [closed]

I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
4
votes
3answers
417 views

Protect our payroll data from a legal and moral obligation

We have our payroll software to be installed on our file server. This contains all the details of current and past employees. The data contained in the payroll software includes tax, bank, National ...
9
votes
4answers
443 views

How should I tell an organisation that they are vulnerable when I wasn't given permission to check?

I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
2
votes
3answers
476 views

Losing Private Keys

Suppose my friend and I make public private key pairs, send some test emails back and forth and a few days later he loses his private key. Is either of us now in potential danger? Could we be ...
2
votes
1answer
57 views

Does SGC Support reduce HTTPS security?

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption. This article says SGC should never be ...
2
votes
1answer
357 views

Is there any reason to not use DKIM, SPF, and SenderID because it affects plausible deniability?

Is there any basis in not deploying anti-spam (or deliverability) technologies like DKIM, SPF, and SenderID because it affects plausible deniability? Some definitions to get everyone on the same ...
3
votes
1answer
1k views

How to backup database to comply with UK data protection act?

Charity has a server in their office onto which they backup a database with sensitive information. They want to get rid of this server. Is there a cost effective solution that would allow them to ...
5
votes
3answers
387 views

Is my sons' school portal in violation of any Password/UserID rules?

My sons' school sends both ID and PW for a portal through USPS at various times during the year, (e.g. class registration) whether I need it or not. If I change the password, it sends a confirmation ...
2
votes
2answers
403 views

Google Account Compromised - Possible Investigation?

This morning, I've not been able to login to my Google Account. Google says, my account has been compromised and I had to walk through account credentials recovery and verify (SMS to verify phone ...
1
vote
3answers
2k views

Is scanning a site directory considered illegal penetration testing?

Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
-1
votes
2answers
176 views

Is it Illegal to break out of a forum post by using CSS for example?

Is it illegal in the UK to post styling that breaks out of a post? For instance, if styling were allowed here and I were to use it to change some stackexchange pictures on this page, would that be ...
3
votes
5answers
365 views

Laws on Programming Security Tools

I am currently working on some POST GATHER modules for the Metasploit Framework the idea is that after a shell is spawned on the target, it will gather certain files from the target such as chat logs. ...
2
votes
2answers
702 views

Hacking / Penetration Testing Laws

Is it illegal to post tutorials and articles on hacking related things? In particular in the UK. For example would it be illegal under this law? http://www.legislation.gov.uk/ukpga/1990/18/section/3A ...
2
votes
4answers
259 views

What actions should be taken by site according to Data Protection legislations?

Many countries have data protection legislation: Data Protection Directive in EU Data Protection Act 1998 in UK privacy laws in USA Web application may have registration form where fields for ...
12
votes
2answers
832 views

What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?

I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder. Lets assume, for the sake of this rather hypothetical question, that a ...
5
votes
1answer
262 views

What countries have laws in place that respect Do Not Track HTTP headers or cookies?

Google offers a Chrome plugin that uses cookies to control privacy, while Firefox offers a HTTP Header to tell websites to not track the users and log the data anonymously. This obviously extends a ...
5
votes
5answers
2k views

Encryption laws in India — is it allowed to use ssh and VPN?

I have a very similar question to the one asked here (regarding Iran). However, I would like to use ssh and vpn while being in India. I found already this survey of cryptographic laws but I don't ...
4
votes
2answers
350 views

How to refute “don't use internet if you don't like it” answer?

I hope it is legit question, similar to, for example, Why do law-abiding citizens need strong security?, et al. and it is tightly conected with user's security, privacy, etc. The response I always ...
0
votes
1answer
312 views

What regulations *require* multi-factor authentication?

What industries require multi-factor authentication? Please include the following information: Country Industry Regulation name Additional information as you see relevant. Some additional ...
2
votes
2answers
331 views

Legal Risk to unpatched servers

Since one of the 10 domains on the CISSP is legal/governance, I figured this would be the best place to ask. I recently did a security assessment for a non-profit. I found that their systems needed ...
10
votes
3answers
763 views

Encryption-Laws in Iran

According to this article Iran has criminalized the usage of encryption and VPNs. According to this blog post it is still possible to use SSH tunnels in Iran. For me SSH is encryption and thus ...
7
votes
2answers
226 views

Business-to-Business Security Disclosure and Agreement

Looking for a template covering the disclosure information security practices that are standard in Business-to-Business partnerships that share data. For example: Access management Password ...
5
votes
3answers
371 views

What to consider in an SLA to ensure secure software when outsourcing software development?

To ensure secure development in the off shore team what are considerations to be taken into account in the SLA? I got this as a reference: ...
3
votes
1answer
199 views

HITECH : New United States Federal Act on Data Security

Has anyone heard of the new HITECH Federal Act? I understand that it is an underscore of the HIPAA Federal Act but am unclear of the requirements that they are requesting. It targets companies that ...
3
votes
1answer
289 views

What lawful interception standards are used outside Europe?

In Europe European Telecommunications Standards Institute (ETSI) define the standard requirements to handle a lawful interception. It's define all from the terminology and definition to the ...
2
votes
1answer
115 views

Privacy policy about links to other sites

In many of the privacy policies, I noticed there is one section as a disclaimer mainly talking about "our websites contain links to other websites, and it is your own risk/responsibility to familiar ...
3
votes
5answers
444 views

Am I required to hash passwords

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen? If not required in the US, but required in the ...
19
votes
6answers
9k views

Is Facebook allowed to sell/give your information away to anyone willing to buy it?

Is Facebook allowed to sell information about their users to other companies? For example selling name, address and IP information on a specific geographic location could be very valuable ...
1
vote
1answer
221 views

Can we protect domain name by law? [closed]

Some company have domain names worth a million dollar. But sometime they are lost to hackers. So I wonder how can we protect domains by law instead of technology?
11
votes
3answers
4k views

Should anyone support / implement P3P policies? Do they matter? Are they legally binding?

Google and Facebook authentication both have fake P3P policies in the HTTP headers that link to a webpage that explains why they don't support it: CP="This is not a P3P policy! See ...
4
votes
2answers
226 views

What are the consequences for deceptive practices against stated privacy policy

Disclaimer: I'm aware my question is a bit far from IT security practices but here is the most appropriate place I can think of to post my question within the whole stackexchange. Let's say, many ...
14
votes
5answers
884 views

Is it legal to log passwords from failed logins?

Is it legal to store/log mistyped passwords? How many of you have seen this happen in a log file or DB?
3
votes
2answers
593 views

Why have export controls for cryptography?

I've always heard someone justify the means for export restrictions with "it's for governmental control/spying". In most reasonable countries, the justice system asks people to adhere to the "spirit ...
5
votes
1answer
326 views

How does sound signature recognition work and how to override it?

Today a lot of websites that allow the upload of media content are implementing automatic sound signature checks to prevent the illegal distribution of videos containing copyrighted content. How ...
7
votes
7answers
5k views

Storing credit cards for automatic payments?

I have no experience with storing credit cards and I do not know anything about the legal end of this. The company I work for / develop for wants to store credit cards to process auto payments for ...
2
votes
2answers
299 views

SOHO router intrusion

In the hypothetical scenario where someone has managed to gain unlawful access to a SOHO router (any of the consumer wifi models will serve nicely), what steps can you take to verify this, so as to ...
5
votes
2answers
262 views

What to do in response to a source code and/or database leak by a third party hosting provider?

My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak. On first appearances, the web host ...
17
votes
5answers
69k views

Can someone steal money from my bank account if they know my IBAN and personal details?

To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
23
votes
6answers
10k views

Sharing wifi at a business - Bad Policy?

Is it safe for a small business to let customers use their wifi while waiting? My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
17
votes
6answers
11k views

At what point does “hacking” become illegal?

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...
8
votes
3answers
408 views

How do researchers “gain control of an attacking PC” and not themselves be considered attackers / criminals?

In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises" The Cliff's Notes to the article is thus: ...
18
votes
5answers
874 views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
2
votes
5answers
652 views

What happens with a subpoena and a system designed to protect itself from you?

After reading about the recent Dropbox issue I'm starting to wonder if they could legally keep their initial promise. Lets say that you're like Dropbox or Lastpass and you store users' information in ...
6
votes
2answers
2k views

Export laws on the cloud (key size)

Do the U.S. export laws around AES-256 apply to applications hosted in the cloud?
17
votes
2answers
597 views

How to handle security issues of someone else's website

A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
12
votes
5answers
474 views

How can citizens prevent government-led Internet blackouts?

The United Nations now considers Internet access a basic human right. [PDF] Despite the questionable effectiveness of Internet blackouts in silencing a populace and preventing uprisings1, it's ...