New answers tagged

2

Have you read Google's TOS and PP? It says they will divulge any information they deem necessary to comply with any enforceable legal request. **We will share personal information with companies, organizations or individuals outside of Google if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably ...


1

When the FBI finally found the server it was due to the silkroad server leaking an IP address via captcha. The FBI was able to use that to track down the hosting provider. They showed up with a warrant and grabbed one of the drives. The Raid controller happily re-built the mirror onto a fresh drive and the operators never noticed. The FBI then had an ...


0

You shouldn't have been there so it doesn't matter what you found, you are currently in the wrong. Until you get permission to look, you have to stay quiet about it and hope they haven't detected your presence.


0

As drewbenn suggested in their second answer, but to put it in a slightly different way, where drewbenn said you can ask for permission, I'm saying you can also “suggest a security check or urge them to do it, with or without your help” with a reason like “I do X or engage in X communities online, and there have been reports or chatter about schools getting ...


2

Use the Socratic method. Expose the vulnerability to whoever is in charge of security as a series of questions. If they, for security reasons (or whatever), can't or don't want to answer your questions, propose hypothetical situations and ask about them.


0

Tell them anonymously, citing everything you did, e.g the penetration tests, results, etc. so that they can check it for themselves (or hire someone). Make sure the message is sent to everyone who has the authority to delve into the issue(s).


4

"Ma'am, I'd just like to let you know that if you slide a strip of metal in the deadbolt of the door to your garage, you can open it with little effort." Just don't disclose. Many of us security folk have found vulnerabilities in our universities' computer systems, but there is nothing to be gained by disclosing it. Let someone else find it and disclose it, ...


1

Can you reveal the vunerability in a permissible way? You found a the issue in a way that is apparently not allowed. Can you present the issue in a way that you do have permission? If so, trying that might be a good idea. It may not even be the original vulnerability, but a bug that, when being investigated or fixed, reveals the vulnerability. For example, ...


7

How should you tell them? You shouldn't. Let's look at the potential consequences here. Since you were poking around on their network without permission (something which is almost certainly in violation of your student agreement and whatever consent you clicked through in order to gain access to their IT system) the very best outcome you can expect is that ...


55

Another thought struck me as I re-read your question (emphasis mine): How should I tell school that they are vulnerable when I wasn't given permission to check? Could you get permission? Once you have permission, you could "discover" the issue (without telling anyone you'd found it before) and report it without worrying about being blamed for hacking ...


2

This is a rather large issue that has received a lot of attention in the past (not just on Stack Exchange). This boils down to several subtopics: Trust; Legal responsibilities of the VPN service provider; and Legal responsibilities of the VPN's hosting providers and data centers. There are many VPN services that claim to anonymize and protect your ...


77

If there is a teacher or counselor you can trust completely, that you know will keep your name secret even if the school administration starts making threats about firing people, I'd go to them first and talk to them in private. They don't need to understand computers or security (and you don't need to go into detail about the issue), they just need to be ...


3

First off "using a VPN" and "using a VPN provider" are not the same thing. The bottom line is you can't be sure that data exchanged with the public internet won't be spied on. Even if your provider doesn't spy themselves their upstreams may do so. Using a VPN provider to access services on the public internet is just trading one potential spy (your ISP ...


-5

Read the privacy policy of the VPN provider. Of course you can not know for 100% if you don't have access to the back end and look for logs yourself.


9

Short answer: You can't. Before you buy any service you should take a look at their Privacy Policy. For instance Hide My Ass: What data we collect: We will store the stamp and IP address when you connect and disconnect to our VPN service, the amount data transmitted (up- and download) during your session together with the IP address of the ...


1

We are working in this domain for some time. As you've already mentioned - there's a difference between the technical signature (so the systems/databases can rely the data integrity is ensured) and legal value of data itself, where (according the legal framework) legally can sign only a 'natural' person. Each state effectively 'validates' its own citizens ...



Top 50 recent answers are included