Tag Info

Hot answers tagged

53

It seems like the spammer got your personal information including your password through a security breach somewhere. Why did they use your password instead of your name? I would say it was an honest mistake on their side. They just mixed up the fields when designing the spam mail. When you are still using the password somewhere, you should change it ASAP. ...


25

As the answer by phillipp stated, there is a good chance they got your password from some form of security breach. I doubt that they would have obtained that through Paypal's system. It could have happened in one of the following ways, to name a few (with tips on how to protect yourself from each one). At some point you could have accessed a fake PayPal ...


23

Mapping the public key to an IP address is easy (just hash it and keep the first 80 bits) and you have listed the ways to make this somehow robust (i.e. make the transform slow). It has the drawback that it does not solve the problem at all: it just moves it around. The problem is about binding the cryptographically protected access (namely, the server ...


20

Identity is a malleable concept with an irksome tendency to morph whenever you look at it too closely. What I understand from your description is that you want to be able to track back some actions (i.e. "applying for a job") from a random network user back to the actual individual, in such a way that, should the job application be fake in some way, you have ...


19

This is a nobrainer. Don't let the domain lapse. Domains are cheap, security incidents are expensive.


16

Displaying a hash of nick and password to identify users is known as Tripcode. There are different variants of this, sometimes the website operator adds a secret key, sometimes an expensive hash like PBKDF2 or bcrypt is used, sometimes the password is replaced by public key.


15

In case of web browsing your software configuration usually provides a pretty unique fingerprint that can be tracked as you browse. Check out the Panoptclick project. Also every piece of information you post to different sites will contain information about you. For example the time of your postings will give a clue about which time zone you are in even if ...


14

It depends on how smart the thief is. We work with police to catch criminals based on their IP address on a regular basis. We've got a high success rate, but we can't catch them all. Usually, the IP address is enough to trace the connection back to the ISP (Internet Service Provider). Generally, ISPs will work with law enforcement in cased of known fraud ...


13

Are they safe enough for the purposes you described? In my opinion, generally yes. Are they safe enough in applications where security is a significant concern? No. They're generated using a non-random algorithm, so they are not in any way cryptographically random or secure. So for an unsubscribe or subscription verification function, I really don't ...


12

The first big flaw of your idea is that it doesn't really solve much. Once you want meaningful names like they're currently in use, you need DNS or a similar system. So your point of failure is back, except that it's now DNS and not CAs. Putting the fingerprint into the IP offers little advantage over putting it into DNS alongside the IP, but has the ...


11

The UUID specification details several "versions" which are methods for generating the UUID. Most are aimed at ensuring uniqueness (that's the main point of UUID) by using, e.g., the current date. This is efficient but means that while the generated UUID are unique, they are also predictable, which makes them inadequate for some security usages. The ...


10

Voting in a polling booth definitely has advantages as you can enforce that a voter is isolated. That makes internet voting difficult, but not impossible. In general we want some of five properties: Ballot Secrecy - That each voter's choices remain secret. Integrity - That each voter's choice is included unmodified in the final tally. Untrustworthy ...


9

There are two (four technically, see link below) basic problems that need to be solved: How do you prevent false voting (coerced, bought, multiple votes, etc)? How do you protect the person's right to voter privacy? To solve problem one you need to secure the voting station (the website), the connection to the website, the computer browsing the website, ...


9

Two possible scenarios that pop into my mind: Since we can assume the attacker probably had access to his email, he probably had access to his address-book as well and he could have requested friendship (search for friends by email address) from all the people that had a facebook account registered to one of the email addresses from that address-book (some ...


9

This is what I'm hearing you say: You have a medical facility with computerized records for the full set of patients. You want to allow web users to try and set up accounts with a one-to-one mapping between actual patient and their own records. Your goal is to allow this to be done online without resorting to out-of-band methods such as snail mailing ...


9

First of all, I need to emphasize that IP address can never be used to authenticate a user, it can only be used to (attempt to) validate a host. Even if IP address were perfectly tied to an exact computer on an exact network port, we'd still have no guarantee that a particular user was at the console of that computer at that time. So if you are trying to ...


9

Claims are a method of providing information about a user, and roles are a description of a user by way of which roles they belong. Claims are generally more useful because they can contain arbitrary data -- including role membership information. E.g. whatever is useful for the given application. Claim Based identities are more useful, but tend to be ...


8

When you use a google OpenID to sign in to a site (which is thus an OpenID "relying party" or RP), the RP requests various forms of information, and gets it if you agree to provide it. Google tells you what they asked for. So yes, the RP can get contact info, with your permission. But the design of OpenID is intended to protect the most important stuff - ...


8

If you authenticate to another website with Google's OpenID system, it will tell them that the person authenticating is in control that particular GMail address. Unless they get in-line between you and another site, they can't perform a MITM attack. They can only effectively take advantage of your credentials if they pretend to be your identity provider and ...


7

Conventional Wisdom re: Brute-Force Attack or Enumeration There are a few ways to look at this. One should start with http://thedailywtf.com/Articles/The-Phantom-Password.aspx before trying to really think about it, though. There are varying degrees in which passwords are disclosed. My username at Slashdot is known by everybody who reads a post of mine. My ...


7

Basically the problem is a matter of trust. When you sign a file, someone needs to retrieve your public key to check the signature, but how can they be sure that this is really your signature? GPG provide a way to do that called the Web of trust. For example, let's say you are Bob and want to discuss with Alice. You already know Ted, which is a friend of ...


7

Going to have another go at this one, to try and address the many excellent comments... A cheque is an instruction to a bank to take money from Alice's account and give it to Bob. In order to act on it, the bank need to know Alice's account details; they must be written on the cheque in some form when it arrives for clearing. A pre-printed cheque in ...


7

I recommend you adopt the "one ssh key per user" model. It is easy to use for end users, simple to explain to users, and is likely to meet the security requirements. Ease of use is very important. If a security mechanism is too hard to use, people will find a way to bypass your security mechanism. An easy-to-use, pretty good security mechanism is far ...


7

Based on the feedback you provided via comments, those being so far: @blunders we might have way more phone #s than email, and I'm having a report generated. and @blunders No, I believe a good deal of patients would have a phone number in the chart. Home number more likely than cell/text number. So, let me see if I'm able to dig myself out ...


7

Here's my off the top of my head common sense thoughts: Assemble a list of accounts - email, social networking, bill paying, online shopping, etc. Use the physical machines you have to do a search, check the history in any way you can, OS logs, browser history, bookmarks, correspondence in any email account you know about. Contact the sites for any of ...


7

The technology is pretty simple, your system and your browser sends lots of interesting information with http requests. All the server has to do is capture and log those attributes. Some combination of those could be use to correlate requests. Here's a starting point: TCP stack attributes Browser capabilities Browser cookies Flash cookies (managed ...


6

Internet Voting from home or office computers for high-stakes elections is pretty far off the scale of "unsolved problems". It is particularly important to voters who are overseas and/or in the armed forces and have no fast, reliable way to return a voter-verified paper ballot (think submarines :). It was nominated as worthy of an X-PRIZE at DESSEC: ...


6

The trick is too make the "eventually" go beyond the predicted lifetime of the Universe. That's pretty easy because of exponentials: just use a long-enough cookie. Each added bit doubles the number of possible cookie values. For instance, assume that you get 16 billions of users (i.e. each human being, including babies, creates two or three accounts). ...


6

The trick here is to use "multi-factor" authentication. The cookie, plus the IP address, plus any other information in the HTTP header provides some "continuity" of the user. The accept language and user agent, for example, don't change much if you use the same computer from the same location all the time. A little JavaScript can return the ...



Only top voted, non community-wiki answers of a minimum length are eligible