Hot answers tagged

25

bcrypt would be a somewhat better approach because it is designed to be (programmably) slow. Using a large enough salt and a reasonable complexityFactor, bcrypt(salt + number, complexityFactor) should yield a viable hash and you avoid "rolling your own cryptography", which could possibly turn out to be a difficult sell. To increase security you just crank ...


17

There are potentially other privacy issues you're not considering yet. By design your app makes it easy to see who is connected to a certain target. So an attacker creates one contact on their phone (the activist/informant/terrorist/victim they are interested in) and then connects to many other users through your app, to create a list of the target's ...


15

As you state in the question, doing this in a foolproof way is technically impossible. For the video to be displayed on the screen it must somehow reside somewhere in the RAM on the computer, be transfered to the monitor and then displayed there. From all these points the video could be extracted. Possible ways include: Copied from RAM. Recorded with ...


13

Do not roll your own DRM scheme. The industry have tried and failed so many times that a homebrew solution will stand little chance. It would be better to "stand on the shoulders of giants" and use existing DRM solutions. Windows Media Rights Management and PlayReady are good solutions. The latter supports HDCP and are used by mainstream premium content ...


11

Yes, it is (a bit) flawed. The problem is that the space is too small, so even with the multiple rounds and salts, it's relatively easy to bruteforce. Open Whisper Systems had a witty system where they provided an encrypted bloom filter that can be queried locally using blind signatures. They explain the process (as well as providing a good discussion of ...


7

As mentioned, its impossible to prevent capture of the displayed video - even in the worst case, the user can record the video on a smartphone or using a fixed camera (as some pirate movies do when they are recorded at the cinema) What you can do then is to shift the protection from stopping copying, to prosecuting copiers. You can embed watermarks in the ...


6

How can we do this in a cryptographically secure way and respecting the users' privacy (i.e. without sharing the numbers in plain-text between them or with a server)? tldr: You can't. Hashing is great for certain uses, but this is probably not one of them. The reason is that an attacker would know that there are only 10 billion possibilities (for ...


5

Let's do some tests! I started with a naive bash implementation, and calculated 10k numbers in 33 seconds: #!/bin/bash phone="2125551212" salt="abcdefghijklmnopqrstuvwxyz" shasalt() { echo "$* $phone $salt" | sha512sum; } for f in {1..10000} do shasalt $(shasalt $(shasalt)) >/dev/null # or write to a file... ((phone++)) done echo ...


4

This is a problem of trying to protect what you want to provide. It's impossible to do, but you can make it difficult. Probably the best approach would be to encrypt the files. But at the end, you give all the data for a person to run on a computer they have full access to. Since it will play the video at some times, it means the keys will be available in ...


4

It allows to build a history. When I got five different datasets about you from five different sources which list three different addresses, I know that you seem to be someone who moves a lot, which can have various reasons. When I can pinpoint that a while ago your last name changed and shortly afterwards your address changed as well, it tells me you either ...


4

Yes, the VPN provider is able to see your data. If the data are not encrypted (i.e. HTTPS) the provider will be able to get to the clear text and will also be able to manipulate the data. The usual protections of HTTPS apply, i.e. the provider will see which site you visit but not the clear text data itself because they are encrypted. The provider will also ...


3

With Isemis mention of "probability of false positives" I thought about Zero-knowledge proof. This answer makes no claims to be secure as it was never reviewed, so others should review and comment it. I am no professional security expert either and I didn't have the time to make sure the low number of possible phone numbers might be a problem. User A and ...


3

Modern Smart phones embed GPS coordinates into pictures. http://www.howtogeek.com/211427/how-to-see-exactly-where-a-photo-was-taken-and-keep-your-location-private/ This is often how sought out individuals are found and detained because they take photos with their phones unaware the photo contains the location as well. It all depends on the ...


2

I know that many giant companies has spent billions of dollars on how to prevent the privacy of their products but still they cant prevent it... So I am not expecting that I can get 100% solution on this, but still I want to protect it as much as I can. You've already got your answer, you just don't realize it. "As much as you can" is "not at all." ...


2

I have a hypothesis that it is an identifier (non-social security number) that companies will sell to each other to track everything you do. So far I have been asked by: Vanguard, Fidelity, Bank of America, eBay, Amazon, Netflix, Yahoo, Google, LinkedIn. I think there are more, but I forget. It may be centralized because they all ask in the same manner, with ...


2

In short, No! They see the IP of the VPN service and probably log it, and all your traffic including URL's IPs to your sites are encrypted. But if the VPN service is not encrypted, then the ISP could in theory can see all your traffic. However, if you are using a split tunneling mode, then the ISP can see your DNS queries and surfing traffic. Read more ...


2

The use of redirection pages can be for multiple reasons. Issue a warning to the user that the pages is leading outside the original site network (legal requirements sometime) Counting the usage of outgoing links Filtering of addresses Data scrapping (this list is not exhaustive) The first could be seen as a security measure, which makes the user aware ...


1

It depends on what you are trying to achieve. If you are trying to prevent DNS leaks, DNSCrypt isn't what you need. DNSCrypt is intended to prevent DNS spoofing, which is quite different. You could think of it as Privacy vs Man-in-the-Middle. DNSCrypt is a protocol that authenticates communications between a DNS client and a DNS resolver. It prevents ...


1

With experience in the computer forensic field the short answer is Yes. As other people said it's called EXIF data. You can get information such as camera settings and lens used, time and date etc. On some newer camera models GPS tagging is available. Also all new smartphones have gps on them. Meaning when the photo is taken the GPS coordinates go in the ...


1

If your iphone is not jailbroken, and you did a factory reset (be sure of that) your datas are safe. For extra precaution you can also verify that all the possible accounts are deleted on the phone : google drive, dropbox, iCloud ...


1

This method should have following properties: Probability of false positives can be made as small as desired Server learns only the (approximate) number of items on each person's phone book, but not numbers themselves and cannot brute-force them Client-side brute-force attacks are impossible, as server can enforce policies against them Phones do not learn ...


1

Panopticlick is looking for things that make you different to other visitors. In this case, fewer people use canvas blockers than don't, so you become more unique if you use one. However, this only means that it is easier to tell you apart from another user - not that they can tell who you are. Think of it being like a security camera which can only see ...


1

Consult Shaw's TOS and AUP http://www.shaw.ca/terms-of-use/ He probably got two notices, one being a DMCA copyrighted material download and the other being that excess upload traffic was being used. This is common on cable systems where the upload channel involves shared resources and abuse affects everyone on the system As to Who, Shaw doesn't really ...


1

Use a VPN service for privacy. To explain how this helps, let's look at how and why your ISP is modifying your IP packets with a unique identifier: Normal internet browsing (you don't use a VPN): -Your ISP puts a unique header on all your traffic -Your ISP sees any DNS requests you make, which is the first step your browser takes whenever visiting a new ...


1

Not officially, but there was a bug that was only recently fixed as documented on http://webkay.robinlinus.com/ that could gain access to currently logged in Google+ info. I think it's safe to assume there will be other vulnerabilities both present now or in future, just like there was another in the past that has also been fixed and don't forget there's ...



Only top voted, non community-wiki answers of a minimum length are eligible