Hot answers tagged identity
24
Mapping the public key to an IP address is easy (just hash it and keep the first 80 bits) and you have listed the ways to make this somehow robust (i.e. make the transform slow). It has the drawback that it does not solve the problem at all: it just moves it around.
The problem is about binding the cryptographically protected access (namely, the server ...
19
Identity is a malleable concept with an irksome tendency to morph whenever you look at it too closely. What I understand from your description is that you want to be able to track back some actions (i.e. "applying for a job") from a random network user back to the actual individual, in such a way that, should the job application be fake in some way, you have ...
12
The first big flaw of your idea is that it doesn't really solve much. Once you want meaningful names like they're currently in use, you need DNS or a similar system. So your point of failure is back, except that it's now DNS and not CAs.
Putting the fingerprint into the IP offers little advantage over putting it into DNS alongside the IP, but has the ...
12
It depends on how smart the thief is. We work with police to catch criminals based on their IP address on a regular basis. We've got a high success rate, but we can't catch them all.
Usually, the IP address is enough to trace the connection back to the ISP (Internet Service Provider). Generally, ISPs will work with law enforcement in cased of known fraud ...
10
Are they safe enough for the purposes you described? In my opinion, generally yes. Are they safe enough in applications where security is a significant concern? No. They're generated using a non-random algorithm, so they are not in any way cryptographically random or secure.
So for an unsubscribe or subscription verification function, I really don't ...
10
Voting in a polling booth definitely has advantages as you can enforce that a voter is isolated. That makes internet voting difficult, but not impossible. In general we want some of five properties:
Ballot Secrecy - That each voter's choices remain secret.
Integrity - That each voter's choice is included unmodified in the final tally.
Untrustworthy ...
9
There are two (four technically, see link below) basic problems that need to be solved:
How do you prevent false voting (coerced, bought, multiple votes, etc)?
How do you protect the person's right to voter privacy?
To solve problem one you need to secure the voting station (the website), the connection to the website, the computer browsing the website, ...
9
This is what I'm hearing you say: You have a medical facility with computerized records for the full set of patients. You want to allow web users to try and set up accounts with a one-to-one mapping between actual patient and their own records. Your goal is to allow this to be done online without resorting to out-of-band methods such as snail mailing ...
9
The UUID specification details several "versions" which are methods for generating the UUID. Most are aimed at ensuring uniqueness (that's the main point of UUID) by using, e.g., the current date. This is efficient but means that while the generated UUID are unique, they are also predictable, which makes them inadequate for some security usages.
The ...
8
Two possible scenarios that pop into my mind:
Since we can assume the attacker probably had access to his email, he probably had access to his address-book as well and he could have requested friendship (search for friends by email address) from all the people that had a facebook account registered to one of the email addresses from that address-book (some ...
7
Conventional Wisdom re: Brute-Force Attack or Enumeration
There are a few ways to look at this. One should start with http://thedailywtf.com/Articles/The-Phantom-Password.aspx before trying to really think about it, though.
There are varying degrees in which passwords are disclosed. My username at Slashdot is known by everybody who reads a post of mine. My ...
7
Based on the feedback you provided via comments, those being so far:
@blunders we might have way more phone #s than email, and I'm having a
report generated.
and
@blunders No, I believe a good deal of patients would have a phone
number in the chart. Home number more likely than cell/text number.
So, let me see if I'm able to dig myself out ...
7
Basically the problem is a matter of trust.
When you sign a file, someone needs to retrieve your public key to check the signature, but how can they be sure that this is really your signature?
GPG provide a way to do that called the Web of trust. For example, let's say you are Bob and want to discuss with Alice. You already know Ted, which is a friend of ...
7
First of all, I need to emphasize that IP address can never be used to authenticate a user, it can only be used to (attempt to) validate a host. Even if IP address were perfectly tied to an exact computer on an exact network port, we'd still have no guarantee that a particular user was at the console of that computer at that time. So if you are trying to ...
6
Internet Voting from home or office computers for high-stakes elections is pretty far off the scale of "unsolved problems". It is particularly important to voters who are overseas and/or in the armed forces and have no fast, reliable way to return a voter-verified paper ballot (think submarines :). It was nominated as worthy of an X-PRIZE at DESSEC: ...
6
Here's my off the top of my head common sense thoughts:
Assemble a list of accounts - email, social networking, bill paying, online shopping, etc.
Use the physical machines you have to do a search, check the history in any way you can, OS logs, browser history, bookmarks, correspondence in any email account you know about.
Contact the sites for any of ...
6
When you use a google OpenID to sign in to a site (which is thus an OpenID "relying party" or RP), the RP requests various forms of information, and gets it if you agree to provide it. Google tells you what they asked for. So yes, the RP can get contact info, with your permission.
But the design of OpenID is intended to protect the most important stuff - ...
6
The trick is too make the "eventually" go beyond the predicted lifetime of the Universe. That's pretty easy because of exponentials: just use a long-enough cookie. Each added bit doubles the number of possible cookie values.
For instance, assume that you get 16 billions of users (i.e. each human being, including babies, creates two or three accounts). ...
6
The trick here is to use "multi-factor" authentication.
The cookie, plus the IP address, plus any other information in the HTTP header provides some "continuity" of the user. The accept language and user agent, for example, don't change much if you use the same computer from the same location all the time.
A little JavaScript can return the ...
6
If you authenticate to another website with Google's OpenID system, it will tell them that the person authenticating is in control that particular GMail address. Unless they get in-line between you and another site, they can't perform a MITM attack. They can only effectively take advantage of your credentials if they pretend to be your identity provider and ...
6
You can piggyback off someone else's identity verification.
For example, to piggyback off banks verification procedures, you can ask the user for a Credit Card number that has their name and billing address, then credit a small randomly chosen amount to that credit card in the local currency, and ask them to tell you how much was credited as proof that they ...
5
The most important thing is to secure the connection with TLS/SSL. Without it, you're vulnerable to attacks like FireSheep, as documented at Can you secure a web app from FireSheep without using SSL?.
At that point other big risks come into play, like someone compromising the machine that is logged in, or gaining physical access to it.
Back to the ...
5
I would consider a 128 bits of entropy in a token to be the de-facto standard. OWASP and CWE both recommend this as a minimum. 20 characters of Base64 (capable of 120 bits) is also handy for something in the URL. I would also note that in many cases poor seeding for those tokens creates problems. For one bit of reference, see the (kind of tastelessly ...
5
They can gain access to such information through a combination of techniques.
First of all, they can easily do online searches about a person. You will be surprised how much information can be glimpsed about a person just from his Facebook, Twitter or other social networking sites. Google, and other dedicated "people-finder" search engines like Pipl can ...
5
Actually an interesting question for that type of site. I was reviewing a similar application where there was the option to submit resumes online - including references. A profile had to be created to register for the site - but as all this required was an email address, the controls around it were very limited. The point was made that malicious person 'A' ...
5
The risk here is the online persona itself and what would result in social engineering attacks. Let's say that you use google as the openid authenticator and have linked it to the stack exchange sites along with a collection of other sites. Prior to this, you may have used the same username and everything else across all sites but it was all a loose ...
4
(Glad to see others have posted answer, don't really have the time to give a detailed reply. Hope my questions where of some value.)
Here's a nice article covering major issues: Death and social media: what happens to your life online?
Main thing is your legal right to take actions on behalf of the deceased user's digital afterlife, and how delays in that ...
4
No they are not secure. Your vulnerability & risk depends on how the GUID is generated. If you're on a Windows 2000 or newer box, then you're likely using version 4 of the GUID
http://stackoverflow.com/questions/2757910/how-are-net-4-guids-generated
These Guid's aren't cryptographically secure, but they do work as an identifier.
I think this GUID ...
4
You could work on a Single Sign On protocol to initiate the account creation.
You record a card number into your system (this card shall have a secret password on it, potential with those "to scracth" areas on it to hide the password)
You send the card through the best authentication mode you can find (standard mail, face-to-face meeting, eventually you ...
Only top voted, non community-wiki answers of a minimum length are eligible
