Tag Info

Hot answers tagged

39

Google has access (obviously). The police will have access if they have a valid search warrant. A national security letter will give the FBI secret access. Various three-letter agencies may have access, depending on how they're doing at circumventing Google's encryption. (Google started encrypting its internal traffic after it was revealed that the NSA was ...


19

The answer is generally it depends. This is really based on the security of your system. Users can create new accounts without restriction If so, it is kind of meaningless to not tell them. You can't have intersecting usernames or email addresses, so you have to inform a new user if their username or email has already been used. An attacker would then be ...


13

Not instantly. Although, that's what I want to believe. What you could do is the following. Download the Truecrypt version 7.1a and create an encrypted storage file (option 1 from the wizard) and choose 3 algorithm based encryption with a SHA-512 key. Put all your sensitive files in here and upload the encrypted file to Google Drive. When you want to work ...


10

A virtual machine is an operating system installed on a virtualization software such as VirtualBox and VMware Player. It emulates the existing hardware of the host machine on which it runs. This means a software running on a virtual machine will "think" it is running on a "normal" computer resources. You can do on it all what you do on a usual computer with ...


7

iPhones default to "Chuck's iPhone" as their network name. You change that by changing your device's name. Same with any iOS device.


7

Any data you upload to Google Drive (or Skydrive, or Dropbox for that matter) should be considered duplicated by the NSA. Apart from arbitrary queries from the aforementioned secret service, law enforcement agencies from any country may gain access to them through legal means (subpoenas and so on). And of course, Google engineers could in theory browse your ...


7

There is an old tradition of not distinguishing between "that username does not exist" and "that username exists but the password is wrong". It comes from older times, when both attackers and defenders were new at the job, and the context was different. At that time, the attacker was "outside" and he wanted to guess a username+password pair in order to enter ...


5

How to get noticed in a professional network Your network admin is able to see that "chuck" is connecting to an internal E-mail server from the Mac address "00:05:02:11:22:33" and that this iPhone address is connected through the access point on first floor of the library. This is just a practical example. There are many other ways. Notwithstanding the ...


5

First, a word on security: Security does not exist in a vacuum; it is completely dependent on the circumstance. Defending against an unrealized threat is wasteful. Not defending against a trivial attack renders your system useless. As such, blindly adding security measures is an exercise in futility. One must have a well-defined set of goals for a system, ...


5

What about hosting those files on other hosting services which have client side encryption like: Tarsnap, which has open source client and does client side encryption. Tahoe-LAFS SparkleShare, which has GUI clients for all operating systems. more on https://prism-break.org/


4

It depends. Untangle has the capability of intercepting HTTPS using a man in the middle proxy (https://www.untangle.com/store/https-inspector.html). If this is enabled, the HTTPS inspector can see all HTTPS traffic. This however requires that all desktop client install a root certificate issued by the Untangle device.


4

There's any number of ways that your company's network administrator may have identified you. The principal thing you need to realize is that, while you may be using your own device, you are on your company's network. That grants the company a lot of visibility to the traffic your device generates, should they choose (as it appears they have) to examine it. ...


3

What matters the most in terms of security is what does an attacker gain from knowing whether a specific ID or email address has an account with your site? For instance, if you're doing any kind of business that can be seen as a privacy issue, or whether accounts on your site can be used to spend money or have any intrinsic value (in other words whether I ...


3

No, you should not let them know if the username doesn't exist as it would let an attacker discover account names which they could then attempt to crack. If you send a generic "A reset email has been sent, please check your inbox." even when the account doesn't exist an attacker gains gives nothing from trying.


3

Blurring removes high-frequency detail from an image (by applying a convolution that is essentially a weighted average of some kind). It is not possible to restore the original image from the blurred version, However, it may be (usually is!) possible to restore a similar picture which has enough detail to be recognizable, and even if that is isn't possible, ...


3

Use a clean PC or VM for your VPN connection and never ever use that system outside of the VPN. A VM will only work if your host is clean. If you install free games or random software then you SHOULD NOT trust your PC anymore. Never login to accounts that you use outside of the VPN !!! Create separate accounts for any service you use over the VPN. Never ...


3

If you delete your TOR data directory, TOR will randomize how it builds new circuits and picks new entry nodes. However, the behavior you are seeing is intentional. TOR has affinity to a small set of entry nodes, called entry guards. These guards help reduce the chance that you are assigned an entry node which is malicious, because your computer is only ...


2

In short, yes and no. You can't completely remove blur but you can definitely revert some of the changes. If you have a choice between blurring and blacking/whiting something out, go with the latter. Blurring essentially rounds and moves things around, and with the right algorithm for certain blurs information can be revealed. By adding a layer that can't ...


2

I think the traceability of your connections will be recorded on the log file of untangle server but not the content of your conversations .


2

Cryptography is a form of smart obfuscation, it does not make things "secure", just "secure enough, for now". If someone REALLY is out to get you, he would store your encrypted data until a later date when encryption can be broken - anything from stronger computers to software vulnerabilities like "heartbleed" will do the trick to decrypt your stuff in the ...


2

This sounds like a Zombie Cookie. There are a large number of places a web site can store state: cookies, Flash local storage, ETags, etc. When you clear your cookies, you do not necessarily clear all these places. Web sites can store an identifier in some of these other places, and track users despite them clearing their cookies. If you use a dedicated ...


2

Most of the time, scammers aren't technical people, and they won't look for your IP address in mail headers (since they sometimes leave theirs). Find a mail provider that doesn't forward it, just to be on the safe side. This extremely entertaining resource, 419eater.com, should give you the basics. As far as safety is concerned, it boils down to not giving ...


2

One aspect I have not seen mentioned is the fact that many login difficulties arise because a user's preferred name was taken before he tried to register for a given site. If "JSmith" tries to log in and can't, what he really wants to know is not whether the site has an account named "JSmith", but rather whether the site has an account for him named JSmith. ...


2

Almost all software of significant complexity, especially software dealing with network communications, contain vulnerabilities. A subset of those vulnerabilities are known to some bad actors who will use them in various ways (0-days). Whether you build the distribution yourself or use an off-the-shelf distro, some of these vulnerabilities may exist in ...


2

Your browsing history is basically a file on the computer's disk. Depending on your attack scenario, many things are possible: For someone who has access to your computer, through a remote-controlled malware or just sitting at your desk while you're away, it is entirely possible to get that history file and read it "without a browser". If, however, you ...


1

Something you build yourself may be more secure or it may not be. You don't know how secure a system is until it is tested and looked at by lots of people. This is why the saying "don't roll your own" is very common in security. Your own system would have the advantage of not being vulnerable to out of as many out of the box attacks as a larger system, ...


1

Not just IP/pings, but if your computer is "discoverable", it means it will allow requests for other things such as public/shared files, remote control/access, any printer resources that may be shared, and DLNA/streaming, homegroup, etc. - any one of those may have a vulnerability that can now be exploited


1

To answer one of your questions: any Google employee who has administrative access to the hosts (file servers) on which the drive data is stored will have read-access to your data: this includes the operations engineers, service engineers, system administrators: these type of employees are typically the ones with that type of access. The answer to your ...


1

I did some research on this in 2012 for a blog I was working on at the time. However, my research was more tailored to what a webmaster can see after a user clicks the +1 button. The conclusion I came to was this: http://analytics.blogspot.com/2011/06/1-reporting-in-google-webmaster-tools.html "Finally, the Audience report shows you aggregate geographic ...


1

This is more of a comment than an answer, but apparently I'm not allowed to comment yet. If you're concerned about the privacy of your cloud storage, you may want to consider Tresorit as an alternative to Google Drive. It offers client-side encrypted storage & syncing, so the Tresorit engineers aren't even supposed to be able to tell what files you're ...



Only top voted, non community-wiki answers of a minimum length are eligible