The attribute of a system that prevents the release of data to unauthorized individuals. The ability or expectation of an individual or group to reveal information about themselves selectively or not at all
2
votes
4answers
239 views
What actions should be taken by site according to Data Protection legislations?
Many countries have data protection legislation:
Data Protection Directive in EU
Data Protection Act 1998 in UK
privacy laws in USA
Web application may have registration form where fields for ...
7
votes
4answers
324 views
What steps should one take to provide “reasonable” levels of privacy from a government?
I'm highly uncomfortable with the recent news surrounding government snooping in the UK.
If we define a typical user to mean somebody who:
Browses web sites such as BBC News and Stack Overflow
Uses ...
3
votes
3answers
212 views
Encryption Question for patient PHI
I am the Compliance Officer for a laboratory. Is it permissible to send an unencrypted email with a patient accession number? It does not include patient name, DOB, SS# or address. It is just an ...
8
votes
1answer
521 views
Do burned DVDs contain trackable information?
I'd like to know if it's possible to burn a video DVD (not just a regular CDFS DVD with video files in it; I mean a DVD that you can play the video of using regular DVD players), without the ...
5
votes
2answers
208 views
Is it secure to have an “email no longer available” feature on your registration form?
I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
4
votes
1answer
153 views
What countries have laws in place that respect Do Not Track HTTP headers or cookies?
Google offers a Chrome plugin that uses cookies to control privacy, while Firefox offers a HTTP Header to tell websites to not track the users and log the data anonymously.
This obviously extends a ...
2
votes
3answers
207 views
Would people object my website just because I use Google Analytics, +1, or FB Connect?
Are there people who will refuse to use a website just because that site sends browser information to Google Analytics?
Could the +1 button be a red flag?
Should I expect that there would be ...
4
votes
3answers
292 views
Are there security (esp. privacy) benefits to deleting cookies?
As the title says, I'm wondering if there are any security/privacy benefits to managing cookies - that is, managing by deleting cookies you don't want or need.
I deleted all my cookies about a week ...
3
votes
4answers
403 views
What Gmail features should be Opted-Out to prevent PII from being indexed?
The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise).
Of the free email providers, GMail does support TLS ...
6
votes
2answers
173 views
Where to find papers / information about spyware, tracking and cookie problems?
I am right now working on a problem and looking for some papers / information about spyware, tracking and cookie problems. I am no expert in that area, so I lack the knowledge where to find material ...
3
votes
1answer
2k views
Is there a sms authentication that works like 10minutemail?
I remember reading on this site a user recommending 10minutemail.com as a way to register or give email address to non-trusted websites.
Is there any similar site for disposable phone number for ...
16
votes
5answers
1k views
How does preventing automatic download of pictures help to protect my privacy?
When viewing some emails in Microsoft Outlook, if the sender has included images, I get the following option appear at the top of the email:
"To help protect your privacy, Outlook prevented ...
3
votes
3answers
354 views
Can too much web searching be a danger to a security professional?
As a junior security professional, I spend a lot of time goggling for things such as 'wpa dictionaries', 'vulnerabilities...' , 'how to crack ...','and so on.
I sometimes feel like I am calling for ...
3
votes
2answers
929 views
How do I use DuckDuckGo securely?
The Privacy Policy of DuckDuckGo.com mentions using HTTPs and POSTs affects the privacy of the search requests.
Since HTTPS is disabled by default, and POSTs is enabled by default, how does this ...
5
votes
2answers
296 views
How to refute “don't use internet if you don't like it” answer?
I hope it is legit question, similar to, for example, Why do law-abiding citizens need strong security?, et al. and it is tightly conected with user's security, privacy, etc.
The response I always ...
11
votes
5answers
926 views
Different strategies for online anonymity and their +/-s?
I saw this question about anonymous web browser, but I wanted to go a little bit more in depth. I prefer answers that take into account how a connection would be traced back, time it would take to ...
2
votes
4answers
289 views
How to prevent private data being disclosed to unwanted audience over internet?
Everyday, in order to subscribe to certain services on the Internet we are almost forced to disclose private data even though those services don't necessarily require it.
For example, I need to ...
4
votes
2answers
5k views
Does chatting over Skype expose my IP address?
Is there a way to identify a person's IP address in Skype, when you're chatting with them? Does this depend on their Skype settings? And if you've recorded chat messages, can they lead to the actual ...
2
votes
4answers
570 views
TrueCrypt dataleaks that might betray the “Deniable File System” option
Reading into "Operation Satyagraha", one would have to believe give all the resources used that the investigators had some reason to believe there was data to decrypt, even though in theory and in ...
4
votes
2answers
365 views
Mobile phone security eavesdropping based on data transfer
is there an easy way for particular governmental organizations (especially in
countries where freedom of speech is a problem) have some technology where
they can easily eavesdrop on cellphone internet ...
1
vote
3answers
1k views
How can I use a VPN to protect my privacy
How should I configure a VPN in order to access blocked websites and to hide my identity?
Usually I use SSH tunneling to protect my privacy and to escape censorship. I know nothing else about VPNs ...
6
votes
2answers
306 views
With Google's new Privacy Policies going into effect soon, how can I better protect myself using their services?
From what I can tell, the gist of the new Privacy Policy from Google is that they're making a blanket policy to allow using your data between all their services, however they see fit. So now one ...
4
votes
1answer
442 views
Android for the Paranoid
In the case of a rooted phone, what are the various options to stay anonymous and keep your data secure? I've seen the guys at The Guardian Project work towards this: ...
2
votes
3answers
319 views
Security issues with email accounts
I am starting to become wary of giving out my email account to anyone, just by doing reconnaissance it is evident how easy it is to pull so much information from a person just by a email,
There is a ...
10
votes
3answers
3k views
Is a password protected PDF file safe for bank statement attachments?
My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
3
votes
6answers
326 views
When storing private identifying information in a web application, what is “industry standard” best practices?
I am building a hosted (SaaS) web application that stores PII like name, email address, and employer of the user. As of right now, I don't intend to ever store credit card numbers or bank account ...
10
votes
3answers
2k views
Should anyone support / implement P3P policies? Do they matter? Are they legally binding?
Google and Facebook authentication both have fake P3P policies in the HTTP headers that link to a webpage that explains why they don't support it:
CP="This is not a P3P policy! See ...
4
votes
2answers
619 views
P3P HTTP Headers and Session ID's
Is there any chance that Session ID's can be shared between different websites (one in other IFRAME of others) through P3P Headers?
18
votes
2answers
4k views
Can web sites detect whether you are using private browsing mode?
Most modern browsers support "private browsing mode" (also known in Chrome as "Incognito mode"), where the browser does not save any information to disk about your browsing while in this mode.
In ...
2
votes
1answer
84 views
Privacy policy about links to other sites
In many of the privacy policies, I noticed there is one section as a disclaimer mainly talking about "our websites contain links to other websites, and it is your own risk/responsibility to familiar ...
6
votes
1answer
99 views
Creating a Private Key using Human Intervention
In a hypothetical system, lets say that a design requirement is that people who snoop around the database of a web application (sysadmin gone rogue, or what have you), do not have access to the plain ...
2
votes
1answer
275 views
How does IE's Privacy options affect javascript's ability to save cookies?
I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience.
Is there a guide that ...
3
votes
2answers
172 views
What are the consequences for deceptive practices against stated privacy policy
Disclaimer: I'm aware my question is a bit far from IT security practices but here is the most appropriate place I can think of to post my question within the whole stackexchange.
Let's say, many ...
4
votes
4answers
427 views
Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?
I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies),
I was wondering does other plugins like ...
3
votes
1answer
92 views
Data Protection in EU for usage of personal documents
I don't know if this question fits into this forum or not.
Is there some template documents that comply with the EU regulations for Data Protection and Privacy that I can reuse / (get them signed by ...
2
votes
2answers
314 views
When is an intermediate page needed before directing a user off my primary website? What is the best implementation?
The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example).
I've seen this used in Exchange Outlook Web Access ...
15
votes
2answers
512 views
Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?
For example, say the following are HTTPS URLs to two websites by one IP over 5 mins:
"A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2".
Would monitoring of packets reveal:
nothing,
reveal only ...
11
votes
3answers
694 views
Why does one need a high level of privacy/anonymity for legal activities?
This question is sort-of spun off of a previous one.
How to counter the statement: "You don't need (strong) security if you're not doing anything illegal"?
There are a lot of great ...
3
votes
4answers
2k views
Is it normal that my new VISA debit card has almost the same number as the old one? Is it secure?
My bank issued me a new debit card (VISA Electron) because the old one expired and to my surprise, the card number is almost the same as on my old card. I don't think there would be much chance that ...
1
vote
0answers
261 views
Server side data de-duplication + client-side encryption with private key. Possible with “convergent encryption”? [duplicate]
Possible Duplicate:
Online backup : how could encryption and de-duplication be compatible?
I just saw an article on Techcrunch wherein a startup company was describing their new cloud ...
0
votes
5answers
447 views
What should one do when he/she wants to protect him/her home--computer--?
As you know, deleting a file by pressing shift-delete or by using the Trash doesn't mean that the file is unrecoverable. It's data persists on your computer.
In day to day life, adversaries use ...
0
votes
1answer
738 views
Is OpenVPN secure in this way?
I'm familiar with OpenVPN because my home router has a builtin OpenVPN server.
I would like to use OpenVPN all the time, but how do I deal with situations where I don't own the routers?
ex.: in a ...
11
votes
6answers
1k views
Anonymous web browser. Is it real?
Do anonymous browsers work? What principles do they use? Can I use them to test access to my web site? Can I detect if a visitor is using one? What is the different between traditional and anonymous ...
17
votes
2answers
456 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
4
votes
2answers
238 views
Issues with the use of network surveillance tool in your company?
What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ?
And what policies could be ...
5
votes
3answers
1k views
Resolving an IP address of a Remote machine to its MAC address
I wanted to know whether its possible to get the MAC address of remote node (computer/Access Point) if I know its IP address.
I have heard that if someone sends you an email (even through gmail), you ...
6
votes
3answers
962 views
How can a “server” know that what browser i'm using besides the user-agent?
How can a "webserver" know (or a sniffer between the srv<->and the client) that what browser i'm using besides the user-agent?
Are there any "magic tricks"? javascript? java? How can I securely, ...
6
votes
4answers
239 views
Circumventing a “freemail” account form filter
I'll be honest - I want to download a free PDF from a website which requires me to enter my "non freeware" email address. I do have them, but I dont want to use one as I'm afraid of landing up on a ...
4
votes
4answers
480 views
What issues are most important to cover in Corporate Security Policy?
What about a Privacy Policy? Both internal, and external.
From another Area51 proposal.
