Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.
12
votes
5answers
721 views
Is it legal to log passwords from failed logins?
Is it legal to store/log mistyped passwords?
How many of you have seen this happen in a log file or DB?
41
votes
16answers
2k views
Can we still provide confidentiality when cryptography is outlawed?
In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
14
votes
3answers
683 views
Techniques for ensuring verifiability of event log files
Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
11
votes
6answers
3k views
At what point does “hacking” become illegal?
Hypothetical situation:
before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites.
Issue:
this situation raises a big ...
6
votes
1answer
3k views
Why is it so hard to close onion domains (e.g. The Silkroad)?
A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor)
For those who do not know what Tor is and who do not want to waste their time ...
7
votes
5answers
488 views
What security requirements are a defacto standard in the Financial Industry?
What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry?
If you're familliar with the Financial Industry, can you share details? For example:
What ...
18
votes
6answers
6k views
Is Facebook allowed to sell/give your information away to anyone willing to buy it?
Is Facebook allowed to sell information about their users to other companies?
For example selling name, address and IP information on a specific geographic location could be very valuable ...
17
votes
2answers
433 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
7
votes
7answers
2k views
Storing credit cards for automatic payments?
I have no experience with storing credit cards and I do not know anything about the legal end of this.
The company I work for / develop for wants to store credit cards to process auto payments for ...
12
votes
4answers
782 views
Is Steganography considered encryption and subject to USA export restrictions?
I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
10
votes
2answers
493 views
What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?
I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder.
Lets assume, for the sake of this rather hypothetical question, that a ...
17
votes
5answers
681 views
Is there any legal reason to save a cleartext password?
I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen.
I asked her about this and she defended the ...
5
votes
3answers
185 views
Sourcing hardware that is least likely to contain backdoors
I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
8
votes
5answers
1k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
7
votes
2answers
210 views
Business-to-Business Security Disclosure and Agreement
Looking for a template covering the disclosure information security practices that are standard in Business-to-Business partnerships that share data.
For example:
Access management
Password ...
21
votes
6answers
5k views
Sharing wifi at a business - Bad Policy?
Is it safe for a small business to let customers use their wifi while waiting?
My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
15
votes
4answers
758 views
Can ECC be used without infringing on patents?
Can ECC (Elliptic Curve Cryptography) be safely used without infringing on Certicom's patents?
I would like to make use of ECC in an embedded system to establish a secure channel. But, I am concerned ...
12
votes
5answers
28k views
Can someone steal money from my bank account if they know my IBAN and personal details?
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
11
votes
3answers
330 views
How to secure identity after someone dies?
How would you go about securing the online identity(ies) of someone as best you can after they've died, when they haven't put anything in place ahead of time for this event?
Assume we don't know how ...
6
votes
3answers
493 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
3
votes
2answers
170 views
What are the consequences for deceptive practices against stated privacy policy
Disclaimer: I'm aware my question is a bit far from IT security practices but here is the most appropriate place I can think of to post my question within the whole stackexchange.
Let's say, many ...
10
votes
3answers
539 views
Encryption-Laws in Iran
According to this article Iran has criminalized the usage of encryption and VPNs.
According to this blog post it is still possible to use SSH tunnels in Iran.
For me SSH is encryption and thus ...
4
votes
1answer
192 views
Does deliberately wrong information from a DNS server violate standards generally accepted good practices?
For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up.
This is related ...
3
votes
4answers
3k views
What are the laws regarding ISP recording IP addresses? How would they know who had which?
Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...
2
votes
3answers
500 views
What happens with a subpoena and a system designed to protect itself from you?
After reading about the recent Dropbox issue I'm starting to wonder if they could legally keep their initial promise.
Lets say that you're like Dropbox or Lastpass and you store users' information in ...
1
vote
3answers
593 views
Is scanning a site directory considered illegal penetration testing?
Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
0
votes
0answers
79 views
Exhaustive list of abuse notifications that organizations get [closed]
What are the different types of abuse notifications that organizations get? Here are some I could get off the web, but would be good to identify if someone already has a list of "types of abuse" ...
0
votes
2answers
249 views
Can a man engaged in phishing be prosecuted if I know his IP?
My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
-6
votes
4answers
200 views
Is TLS-in-TLS supported in any software? Does it make sense? [closed]
I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
