The attribute of a system that prevents the release of data to unauthorized individuals. The ability or expectation of an individual or group to reveal information about themselves selectively or not at all
11
votes
5answers
879 views
Different strategies for online anonymity and their +/-s?
I saw this question about anonymous web browser, but I wanted to go a little bit more in depth. I prefer answers that take into account how a connection would be traced back, time it would take to ...
11
votes
6answers
1k views
Anonymous web browser. Is it real?
Do anonymous browsers work? What principles do they use? Can I use them to test access to my web site? Can I detect if a visitor is using one? What is the different between traditional and anonymous ...
15
votes
2answers
491 views
Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?
For example, say the following are HTTPS URLs to two websites by one IP over 5 mins:
"A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2".
Would monitoring of packets reveal:
nothing,
reveal only ...
21
votes
3answers
621 views
What is an SSL certificate intended to prove, and how does it do it?
If I get an SSL certificate from a well-known provider, what does that prove about my site and how?
Here's what I know:
Assume Alice and Bob both have public and private keys
If Alice encrypts ...
27
votes
19answers
2k views
How can I prevent my kids from bypassing my computer restrictions?
My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions:
Can this damage my computer or corrupt my files? (I have lots of pictures)
Is ...
37
votes
7answers
3k views
Online backup : how could encryption and de-duplication be compatible?
A "soon to enter beta" online backup service, Bitcasa, claims to have both de-duplication (you don't backup something already in the cloud) and client side encryption.
...
13
votes
2answers
752 views
Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML
It's clear there there is no consistent set of features among any of the popular authentication providers.
Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
9
votes
5answers
3k views
What are the pros and cons of a VPN for privacy
Recently I have been getting more and more interested in the security (privacy and anonymity) issues of my online life. Not that I have anything to hide, or that what I do online is so interesting to ...
1
vote
3answers
1k views
How can I use a VPN to protect my privacy
How should I configure a VPN in order to access blocked websites and to hide my identity?
Usually I use SSH tunneling to protect my privacy and to escape censorship. I know nothing else about VPNs ...
8
votes
11answers
3k views
I'm leaving my job and want to erase as many personal details etc. as possible; any tips?
Obviously this is very open-ended. But, I'm just paranoid about people going through everything on my laptop after I leave my job. Here are the things I'm planning to do:
Completely wipe all browser ...
23
votes
6answers
1k views
Is there a difference between GET and POST for web application security?
I have 2 choices in sending data between 2 web applications.
I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters.
...
18
votes
6answers
6k views
Is Facebook allowed to sell/give your information away to anyone willing to buy it?
Is Facebook allowed to sell information about their users to other companies?
For example selling name, address and IP information on a specific geographic location could be very valuable ...
17
votes
2answers
431 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
12
votes
5answers
1k views
How to be completely anonymous online?
I recently saw this post on reddit: http://www.slashgeek.net/2012/06/15/how-to-be-completely-anonymous-online/
But the majority argument, both on reddit and on comments on that post seems to be that ...
10
votes
8answers
477 views
iPhone Tracking debacle - risks and countermeasures
For those of you who are not familiar with the topic, a quick search will turn up a lot of hits, e.g. see the researcher's report at Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly ...
9
votes
2answers
696 views
How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?
http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data
http://rt.com/news/uk-privacy-internet-freedom-186/
'Black boxes' will be installed by internet services providers ...
8
votes
3answers
866 views
SSL Inspection and privacy
I know my company is testing something called "SSL Inspection" based on Websense, which is our proxy. I can not provide more detail about this, but does this mean that in principle all my SSL traffic, ...
5
votes
2answers
568 views
Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?
SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet.
I've read the information at it's Stanford University home page, the Wiki ...
4
votes
2answers
1k views
Does Google record search / source IP [/ user] pairs?
Does Google record search / source IP [/ user] pairs? What if my Search History is off?
2
votes
2answers
304 views
When is an intermediate page needed before directing a user off my primary website? What is the best implementation?
The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example).
I've seen this used in Exchange Outlook Web Access ...
3
votes
1answer
213 views
Can SIP registrars and VOIP providers eavesdrop?
An e-mail provider provides people with usernames for e-mail accounts. That normally means that they have access to your e-mail if it is unencrypted.
Likewise, do sip registrars have access to ...
51
votes
8answers
6k views
Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
DuckDuckGo is a search engine that claims it will not share your results with others. Many of my skeptical coworkers think it may be a scam.
Is there any proof that any web search engine will ...
8
votes
6answers
857 views
Whats the probability of a personal computer being hacked?
For a normal computer user following these practices:
Have an up to date anti-virus with a firewall installed (Norton).
Do not install cracked software.
Do not open suspicious links or download ...
8
votes
5answers
1k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
11
votes
3answers
681 views
Why does one need a high level of privacy/anonymity for legal activities?
This question is sort-of spun off of a previous one.
How to counter the statement: "You don't need (strong) security if you're not doing anything illegal"?
There are a lot of great ...
7
votes
4answers
284 views
What steps should one take to provide “reasonable” levels of privacy from a government?
I'm highly uncomfortable with the recent news surrounding government snooping in the UK.
If we define a typical user to mean somebody who:
Browses web sites such as BBC News and Stack Overflow
Uses ...
4
votes
2answers
847 views
Does Java applets reveal the real IP address, even when using proxy or vpn?
Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
11
votes
3answers
1k views
How can I prevent tracking by ETAGs?
An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side.
There is ...
4
votes
5answers
486 views
Could I be defrauded by a website who has my address, phone number, and credit card number?
Exactly what kind of information does a scammer need to scam someone money?
For example, if there's a website which wants me to provide my details, Exactly what kind of information can I divulge and ...
3
votes
2answers
1k views
Using Cain and Abel to capture traffic of machine in the same network
I have installed Cain and Able in machine A, which is connected to another machine B via a LAN. Now I want to analyze all the traffic of machine B. Is this possible by installing Cain and Abel on ...
5
votes
5answers
746 views
Is a TOR router really safer than a proxy?
If I use a tor router to browse the regular internet that it has to leave the TOR network through an exit node. Apparently the exit node has all the information from the original user it came from on ...
4
votes
3answers
284 views
Are there security (esp. privacy) benefits to deleting cookies?
As the title says, I'm wondering if there are any security/privacy benefits to managing cookies - that is, managing by deleting cookies you don't want or need.
I deleted all my cookies about a week ...
3
votes
2answers
169 views
What are the consequences for deceptive practices against stated privacy policy
Disclaimer: I'm aware my question is a bit far from IT security practices but here is the most appropriate place I can think of to post my question within the whole stackexchange.
Let's say, many ...
18
votes
2answers
4k views
Can web sites detect whether you are using private browsing mode?
Most modern browsers support "private browsing mode" (also known in Chrome as "Incognito mode"), where the browser does not save any information to disk about your browsing while in this mode.
In ...
7
votes
8answers
4k views
Is it possible to Identify a VPN user by finding relations in traffic?
If I am using VPN service to protect my identity, can my traffic be used to identify all my traffic?
For example, if I am accessing two services:
Some service A, where I do not leave any ...
7
votes
5answers
839 views
What do the various browser “private modes” do?
Recently there has been some disagreement as to what "private mode" means when it comes to various browsers.
Primarily I am referring to...
IE's "InPrivate Browsing"
Google Chrome's "Incognito ...
5
votes
2answers
205 views
Is it secure to have an “email no longer available” feature on your registration form?
I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
5
votes
2answers
431 views
Does Google log my activity on service A when logged in to service B or by IP address?
Now that Google's new Privacy Policy will combine data from their various services...
Will Google associate me to my activity on one service even if I am not logged in to that service? Did they ...
4
votes
3answers
2k views
WiFi security from another authorized user (roommate)
I believe we use WPA or WPA2 encryption.
To what extent can another user monitor my traffic?
Monitor my desktop activity?
View documents I've saved on my computer?
Tell what sites i visit?
Tell ...
3
votes
4answers
177 views
Improving the privacy of a casual Web user
I am interested in improving the privacy available to me as a casual internet user with a default browser. I think that Tor is too slow and that the "Privacy Mode" in browsers isn't really practical. ...
3
votes
3answers
208 views
Encryption Question for patient PHI
I am the Compliance Officer for a laboratory. Is it permissible to send an unencrypted email with a patient accession number? It does not include patient name, DOB, SS# or address. It is just an ...
3
votes
4answers
400 views
What Gmail features should be Opted-Out to prevent PII from being indexed?
The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise).
Of the free email providers, GMail does support TLS ...
2
votes
1answer
54 views
Is it a good idea to generate certificate-specific CRLs? What is this technique called?
Suppose I create 3 certificates with the following CRLs
Cert1 http://crl.server.com/batch1/root1.crl
Cert2 http://crl.server.com/batch2/root2.crl
Cert3 ...
2
votes
3answers
316 views
Are there any addons that disable only some functionality of scripts?
Tor comes bundled with NoScript. Correct me if I'm wrong but that's because client sided scripts can determine the originating IP address regardless of who the traffic is passed through. But NoScript ...
1
vote
1answer
108 views
Is privacy a part of security? (Bruce Schneier) [closed]
From this talk: http://vimeo.com/8053634, around 35 minutes he argues that privacy is part of security.
What is your take on that? Are privacy questions on topic on this board?
-1
votes
4answers
476 views
How to protect myself from cyberbullying?
I want to learn how can I protect my PC from getting hacked in order to protect myself from cyberbullying. There is an intruder who has hacked my system over the last 4 years.
He has hacked my all ...
