Tag Info

New answers tagged

0

In addition to all of the above and below answers, to truly anonymise yourself you need to get a name change. That way when people meet you and search for you online, any of the accounts that you used with your real name will no longer come up (as it was your old name). However name changes are public record, so in reality it's just more "security through ...


2

There is a way to do this via Google's Native Client. However, executables have to be compiled for this environment explicitely. It is difficult to achieve otherwise (i.e. without a sandbox). DEP can't do this for you, as it only prevents memory segments without the executable flag from being executed. Just think of reading the CPUID, which is a simple ...


0

Hardware enforced DEP may be able to prevent, unsure about returning false values


9

This is a timing attack and the idea (including defenses against it) has been the subject of several academic papers. The short answer to your question of "will this work and has it been used?" is "yes". Some anonymity tools / networks (not sure if TOR does this) introduce their own latency and fake packets to make it harder (see "dependent link padding"). ...


1

A potential method I'm considering is to give the user a file full of random data upon account creation, and have them use that as a token for resetting their account. The only issue I can see with that, though, is that people would likely lose the file. Let the user upload this verification file and verify the hash. So a potential attacker need to know ...


1

You could encourage your users to put their passwords in a secure password storage system such as KeePass. The system requires that the hold on to something anyway, better just have them hold onto the password and not add another piece (they would have to somehow secure the token file you give them to prevent it from being stolen/intercepted). You may also ...


0

It Depends on the value of the account and Implications of Deanonomization Possible solutions Store a mobile phone number to text the unlock id. Store the hash of a email address, so that the user must prove that they know the email address before emailing the unlock id. Notes on your proposed solution: Yes you could: Force them to construct a ...



Top 50 recent answers are included