The attribute of a system that prevents the release of data to unauthorized individuals. The ability or expectation of an individual or group to reveal information about themselves selectively or not at all
87
votes
8answers
8k views
Is Google spying on all of us?
I am curious because, I experienced something bizarre recently. About a month ago, someone asked me to find out a price for a T-shirt printing machine, and probably for the first time, I pressed these ...
70
votes
7answers
4k views
How can I protect my internet-connected devices from discovery by Shodan?
There's been a lot of buzz around this recent CNN article about Shodan, a search engine that can find and allow access to unsecured internet-connected devices.
Shodan runs 24/7 and collects ...
51
votes
8answers
6k views
Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
DuckDuckGo is a search engine that claims it will not share your results with others. Many of my skeptical coworkers think it may be a scam.
Is there any proof that any web search engine will ...
41
votes
1answer
5k views
What is the difference between https://google.com and https://encrypted.google.com?
Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)?
In terms of security what were the ...
37
votes
7answers
3k views
Online backup : how could encryption and de-duplication be compatible?
A "soon to enter beta" online backup service, Bitcasa, claims to have both de-duplication (you don't backup something already in the cloud) and client side encryption.
...
27
votes
19answers
2k views
How can I prevent my kids from bypassing my computer restrictions?
My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions:
Can this damage my computer or corrupt my files? (I have lots of pictures)
Is ...
24
votes
4answers
805 views
How do I deal with companies that call and ask for personal information?
Several times I get a phone call from a company- my bank, utility companies etc. Many times they are just cold calling me, but once or twice they were calling for legitimate reasons (ie, something to ...
23
votes
6answers
1k views
Is there a difference between GET and POST for web application security?
I have 2 choices in sending data between 2 web applications.
I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters.
...
21
votes
3answers
625 views
What is an SSL certificate intended to prove, and how does it do it?
If I get an SSL certificate from a well-known provider, what does that prove about my site and how?
Here's what I know:
Assume Alice and Bob both have public and private keys
If Alice encrypts ...
19
votes
9answers
614 views
What's a good way to trigger a hidden 'distress signal' in instant messaging?
Here's the scenario:
Alice and bob use Off-the-record messaging to communicate over IM. The have:
Encryption
Authentication
Deniability
Perfect forward secrecy
They communicate after ...
18
votes
6answers
6k views
Is Facebook allowed to sell/give your information away to anyone willing to buy it?
Is Facebook allowed to sell information about their users to other companies?
For example selling name, address and IP information on a specific geographic location could be very valuable ...
18
votes
2answers
4k views
Can web sites detect whether you are using private browsing mode?
Most modern browsers support "private browsing mode" (also known in Chrome as "Incognito mode"), where the browser does not save any information to disk about your browsing while in this mode.
In ...
17
votes
2answers
433 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
15
votes
5answers
1k views
How does preventing automatic download of pictures help to protect my privacy?
When viewing some emails in Microsoft Outlook, if the sender has included images, I get the following option appear at the top of the email:
"To help protect your privacy, Outlook prevented ...
15
votes
2answers
494 views
Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?
For example, say the following are HTTPS URLs to two websites by one IP over 5 mins:
"A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2".
Would monitoring of packets reveal:
nothing,
reveal only ...
15
votes
3answers
716 views
How can I protect against email tracking services?
Recently a free service came out for email tracking, bananatag.
It's able to track the fact that the email was read in gmail without any notice or strange inclusions in the email body. In this case ...
14
votes
2answers
679 views
Can robots.txt for your face be made effective?
As Google Glass slowly starts shipping, I've recently came across an article on stopthecyborgs.org that mirrors my anxieties that Google Glass currently does not feature a robots.txt for my face. It ...
13
votes
5answers
1k views
How to be completely anonymous online?
I recently saw this post on reddit: http://www.slashgeek.net/2012/06/15/how-to-be-completely-anonymous-online/
But the majority argument, both on reddit and on comments on that post seems to be that ...
13
votes
2answers
753 views
Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML
It's clear there there is no consistent set of features among any of the popular authentication providers.
Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
12
votes
4answers
1k views
Why users want to disable cookies?
I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
11
votes
3answers
682 views
Why does one need a high level of privacy/anonymity for legal activities?
This question is sort-of spun off of a previous one.
How to counter the statement: "You don't need (strong) security if you're not doing anything illegal"?
There are a lot of great ...
11
votes
6answers
1k views
Anonymous web browser. Is it real?
Do anonymous browsers work? What principles do they use? Can I use them to test access to my web site? Can I detect if a visitor is using one? What is the different between traditional and anonymous ...
11
votes
5answers
886 views
Different strategies for online anonymity and their +/-s?
I saw this question about anonymous web browser, but I wanted to go a little bit more in depth. I prefer answers that take into account how a connection would be traced back, time it would take to ...
11
votes
3answers
1k views
How can I prevent tracking by ETAGs?
An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side.
There is ...
10
votes
8answers
479 views
iPhone Tracking debacle - risks and countermeasures
For those of you who are not familiar with the topic, a quick search will turn up a lot of hits, e.g. see the researcher's report at Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly ...
10
votes
3answers
2k views
Can law enforcement track a criminal through dynamic IP address?
I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
10
votes
3answers
2k views
Should anyone support / implement P3P policies? Do they matter? Are they legally binding?
Google and Facebook authentication both have fake P3P policies in the HTTP headers that link to a webpage that explains why they don't support it:
CP="This is not a P3P policy! See ...
10
votes
3answers
296 views
Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?
Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session?
Would it then be advisable to ask the user to reauthenticate (or simply ...
10
votes
2answers
256 views
Ingress collects a lot of data - what impact could this have on my privacy or security?
The Augmented Reality game from Google, Ingress, has players travel to specific GPS locations to destroy and rebuild virtual targets, link locations, and team up with other players in order to carry ...
10
votes
3answers
3k views
Is a password protected PDF file safe for bank statement attachments?
My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
9
votes
5answers
975 views
Check photos for geotagging and remove lat/long data
I like to upload photos to various internet services, but I prefer not to share my geographic location. I understand Facebook and other services strip out the geolocation data, but they still have ...
9
votes
2answers
699 views
How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?
http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data
http://rt.com/news/uk-privacy-internet-freedom-186/
'Black boxes' will be installed by internet services providers ...
9
votes
2answers
424 views
How to fight browser fingerprinting?
https://panopticlick.eff.org/ , aka "How unique and trackable is your browser". For example it usually gives me a unique score. The biggest entropy values come from navigator.plugins and fonts via ...
9
votes
5answers
3k views
What are the pros and cons of a VPN for privacy
Recently I have been getting more and more interested in the security (privacy and anonymity) issues of my online life. Not that I have anything to hide, or that what I do online is so interesting to ...
9
votes
2answers
366 views
How does the Copyright Alert System work? Who has implemented it?
Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright.
I'm concerned how this oversight relates to my private traffic, and what laws ...
8
votes
11answers
3k views
I'm leaving my job and want to erase as many personal details etc. as possible; any tips?
Obviously this is very open-ended. But, I'm just paranoid about people going through everything on my laptop after I leave my job. Here are the things I'm planning to do:
Completely wipe all browser ...
8
votes
3answers
875 views
SSL Inspection and privacy
I know my company is testing something called "SSL Inspection" based on Websense, which is our proxy. I can not provide more detail about this, but does this mean that in principle all my SSL traffic, ...
8
votes
6answers
867 views
Whats the probability of a personal computer being hacked?
For a normal computer user following these practices:
Have an up to date anti-virus with a firewall installed (Norton).
Do not install cracked software.
Do not open suspicious links or download ...
8
votes
5answers
1k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
7
votes
3answers
465 views
Securing a laptop against attacks (article)
I came across this article when looking for ways of hardening my laptop, and this guide seemed extremely thorough. It is perhaps overly paranoid, but it will be good to have a guide I can trust should ...
7
votes
8answers
4k views
Is it possible to Identify a VPN user by finding relations in traffic?
If I am using VPN service to protect my identity, can my traffic be used to identify all my traffic?
For example, if I am accessing two services:
Some service A, where I do not leave any ...
7
votes
5answers
843 views
What do the various browser “private modes” do?
Recently there has been some disagreement as to what "private mode" means when it comes to various browsers.
Primarily I am referring to...
IE's "InPrivate Browsing"
Google Chrome's "Incognito ...
7
votes
4answers
287 views
What steps should one take to provide “reasonable” levels of privacy from a government?
I'm highly uncomfortable with the recent news surrounding government snooping in the UK.
If we define a typical user to mean somebody who:
Browses web sites such as BBC News and Stack Overflow
Uses ...
7
votes
2answers
86 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
7
votes
2answers
129 views
Privacy violation even when queries with too few results are rejected
I was reading a Computing security book1 and saw a question regarding database security and privacy. I can't quite figure out the answer, so I thought I will ask here.
One approach to ensure ...
7
votes
1answer
124 views
GPG-encrypted mailing list and other approaches to safe communication
What is the best way to communicate privately on a mailing-list?
Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
7
votes
1answer
488 views
Do burned DVDs contain trackable information?
I'd like to know if it's possible to burn a video DVD (not just a regular CDFS DVD with video files in it; I mean a DVD that you can play the video of using regular DVD players), without the ...
7
votes
1answer
218 views
Device fingerprinting & Mass Computer Surveillance
Device fingerprinting is one of the biggest privacy problems as explained because people think cleaning cookies, using proxy servers or blocking domains can protect them (when blacklisted trackers ...
6
votes
3answers
47 views
Patient Hashes for Compression and Security
Are there any front-running approaches to using server-generated hashes to encapsulate patient condition in a concise manner while maximizing security?
For example, a system to represent current med ...
6
votes
3answers
920 views
How can a “server” know that what browser i'm using besides the user-agent?
How can a "webserver" know (or a sniffer between the srv<->and the client) that what browser i'm using besides the user-agent?
Are there any "magic tricks"? javascript? java? How can I securely, ...
