Tag Info

Hot answers tagged

54

SSL/TLS protects the email from tampering or eavesdropping as it transits between your computer and Google's server, and possibly during further relays to eventual recipient. And that's all it does. PGP does far more. If you're sending a signed email, the recipient can verify that the email was sent by you, and that it was not tampered with at any point ...


31

So IPs can in fact be considered to be PII (or personally identifiable information) in some cases, so you're right to want to consider whether you need to protect them. Generally this doesn't mean, however, going to any additional lengths beyond how you would protect other PII, say, email addresses for example. In any case, traditional hashing is likely ...


28

The two notions are actually different. Anonymous systems usually are untraceable as a side effect but the reverse isn't true. Consider, for instance, voting. The process is usually not anonymous: you have to prove you identity and rights to vote before you can do so and the system will keep track of how many votes you have cast. But it can also be ...


24

There is more at risk in using SSL/TLS than potential 0-days, because there are already known attacks that can circumvent TLS. Moxie Marlinspike has been giving Def Con presentations on it since at least Def Con 17. One of the most notable tools is sslstrip, created by Marlinspike. TLS also requires a Certificate Authority trust model, which gives ...


21

No. (with possible caveats) The risk posed by storing data depends entirely on what data you collect and how you use it. If you log IP addresses only then there should be no problem. If your log contains IP addresses and names you start getting closer to the boundary, but are still probably okay in most jurisdictions. If your log contains IP addresses, ...


17

The distinction is subtle, but in some ways, quite important. If an action is untraceable, it's impossible to determine where it came from or who did it. This implies a level of anonymity, in that you can't name the person who carried out an action. However, it may be possible to trace an action back to a certain identity without being able to name that ...


12

non-repudiation -- no one can forge your private key signature of a message, encryption at rest -- the message is encrypted not just in transit, but at rest as well. all of the benefits of mail over SSL/TLS sans a lot of the problems (e.g. Heart Bleed and POODLE) Just to name three.


9

HTTPS only protects your email between you and Google. From then on it is transferred unencrypted. That means your email can be read by: Google (and they admit that they read it!) any routers between Google and the mail service of the receiver the receivers mailserver when the receiver isn't also using https, any router between their mailserver and them. ...


7

This clearly depends on the jurisdiction! In Germany, IP addresses are considered personal information! See e.g. here or here if you speak German. It says, basically, that you are allowed to store the IP only as long as you need it to provide the service! This means on a website, you have to delete it after you sent all IP packets to the destination (which ...


6

In short, PGP protects the contents of the email, both in-flight and at rest; TLS protects the communication channel while the message is transiting a network. PGP vouches for a person and an email address; TLS vouches for a server (and optionally a client).


5

I would argue for the following definitions: Pseudonym is a fictitous name used to protect your real identity. Untraceability means that nobody is able to trace back your actions to gain any info even related to your pseudonym or real identity. Anonymity means that there is no way to identify you uniquely from any other individual (although ...


5

It depends on what you mean by "untraceable". By definition, you can't be anonymous if adversaries can trace your actions back to your identity. However, you can remain anonymous to adversaries who can trace your actions back to your location, as long as you've moved on by the time they do that, and as long as there aren't compromising records. Conversely, ...


4

Anyone who really knows the answer to this question is either prohibited from telling you or is a political refugee in Russia. I think it's pretty good bet that any data that passes through any one of the "Five Eyes" nations (GBR, USA, CAN, AUS, and NZL) could be captured. And, of course, other governments could be doing the same sort of thing.


3

A VPN or an anonymity network such as TOR can hide the details of your activity from your network's owner, although the fact that you are using TOR or a VPN is not hidden (and may in and of itself be considered suspicious activity). You need to be careful when setting this up, though, since mistakes such as DNS leakage (where your DNS queries go out over ...


2

When you connect to another computer with Team Viewer, a window appears in the bottom right hand corner of that users screen showing the connection. There are buttons for them to activate video, audio, chat, file transfer, or close the connection. If they are set up to allow you to connect (you need their ID), you will be in control of their computer, so ...


2

There are multiple possible explanations. The first one and the most likely (especially if the secret part of your url is not that long), is plain and simple bruteforce. If you're on a popular website, it really shouldn't surprise anybody that they are being scanned in order to find some juicy hidden urls. Given the fact that they are hitting your page ...


2

Unless you have been directly assigned a range of IP address from the regional internet registry (faka RIR), then you are using someone else's IP address. The vast majority of the users on the internet are in this same situation. Typically, you are using an IP address (or range of addresses) that has been assigned to their ISP and they are in turn allowing ...


2

The other address you are talking about is a MAC address, but that is only used at the local link level, not to communicate across the open internet. Only your IP address is used when talking across the internet, however there are other ways to track you. For one, the manual way is to contact whoever has the IP address and ask who was attached at the time. ...


2

You can be detected even using different network devices. If you connect from home using the Ethernet card, and on a Starbucks using the Wifi card, it's trivial to detect you. Now how: Cookies: The cookies on every site you access are independent of the IP address of your computer. So if you accessed Google from home, and accessed again from Starbucks, ...


1

Your have about 50% less violation of your privacy in this case. When you send an unencrypted email to another domain, both your mailserver and the mailserver of the receiver can read it. When you send an unencrypted email to the same domain, only the mailserver of that domain can read it. This assumes the ideal case where both sender and receiver connect ...


1

In addition to the technique Enos mentions, another common technique is to use hashes. For many testing requirements hashes will be sufficient. Couple of gotchas, though: If the space isn't big enough, collisions could cause problems If you have logic that does something like matching account types by the first 4 digits being 0123, then hashing will fail ...


1

If you must absolutely use production data in DEV, you may produce a table matching actual account IDs with random ones, then destroy or adequately protect the table after transferring data. REAL ID | FAKE ID -------------------- 0000001 | 3287638 0000002 | 5917382 etc. Beware DEV data may include other information connected to the account ...


1

Computers (more precise: their network interfaces) have MAC addresses which isn't intended change (although they also can). It has a different format as the ip, and it is invisible outside of the providers network. State spying works otherway. Practically they use multilayer watching: there are their spy boxes by the network providers, there are by the big ...


1

Also most information has to be displayed somewhere, somehow and at sometime. How would you do this without an endpoint? Maybe send it everywhere rather than to one particular host? Why not just use your byod and 4G connection for yourself. Of course, if said network operators are themselves being rather naughty, then they can do your job for you.


1

Skype is a modified P2P network. You have no guarantee that your traffic is going to them, so a sniffer wouldn't work the way you'd expect. However, you can resolve the person's username to their ip address with a tool like this while they are online. So if you can get their username from the Skype number, or the email address associated with the number (to ...


1

Yes it is possible but unnecessary in your case. People often use VMs to isolate potentially malicious applications from their main host and to have some sort of rewind button to restore the VM to a previous state in case something goes wrong in there, but looks like that's not what you want to do. To defeat forensics all you need is full disk encryption ...


1

Unluckily, although PGP is awesome in theory, the "real world" benefits of PGP are quite limited, if existent. If PGP was the default that everybody uses, it would rock. TLS gives you (ignoring the possibility of exploits) a secure connection to your mail server. You have the guarantee that the server you talk to is really your mail server, and that nobody ...


1

Logging in with their public ID number and date of birth sounds like a huge security risk. If ID is public like you say, the date of birth of the person associated with that ID can easily be discovered. It would be trivial to either know (if the potential attacker knows the victim with it being a localised system), retrieve (e.g. via social media), guess or ...


1

If you look at the disclosures from other countries, you can see that countries could/can elect to provide data in response to requests from the NSA. That places it "in scope" of PRISM, so, technically, yes, PRISM can see data outside of US Data Centers, it's just not designed to (according to the info leaked). Any data flowing through US data services ...


1

When you say sent over what do you mean? Is this information presented to you, and you then have to verify it or does it also ask for this information as well as your regular login credentials (Username, password) of which it then verifies whether the credentials (SSN, etc.) that you have entered are correct? Because there is to sides to the security coin ...



Only top voted, non community-wiki answers of a minimum length are eligible