Tag Info

New answers tagged

8

Connecting to VPN and using the Internet in the scenario you described is actually very secure. In the case you're talking about (mutual authentication), it is safe to say that ISPs aren't able to intercept and eavesdrop on the connection to know what the user is doing. However, in the example you made about war situations, government agencies don't just ...


3

It mostly depends on the type of VPN you use, how it is setup and how you use it. Generally speaking, if your VPN is setup to process all your connections then the attacker will see the initial handshake and then only encrypted data (and some management traffic, from time to time). So, someone sniffing the network between you and the VPN host will not be ...


2

Not if you are still using your ISP DNS Below is very good answer that explains how to force all the traffic to leave your PC to the VPN http://security.stackexchange.com/a/13907/31356 If you configured the above correctly no one will be able to find out which sites you visit even if they were listening to your traffic unless your PC itself is bugged


0

If you have admin privileges you should be able to see what processes are running. You can find out if they are spying on you by looking at the processes running on your machine. How I would do it? Get random snapshots of the processes running at a given point in time and analyse what's going on. When you have more snapshots you can compare then and you ...


1

The short answer is yes, technically speaking. They will have another admin account on the computer that they can access. By policy, though, access to this account is (hopefully) tightly controlled and will only be accessed if necessary. Also, there is no such thing as your computer legally speaking if it is a work issued asset. They can look at anything at ...


0

I think it is worth noting that even if the network was password protected it would not help much as the thousands of others would be on the same network. Most important is how the network people setup the segmentation of the wireless. "Don't allow wireless clients on same AP to see each other" for example. Really the bottom line is to make certain the ...


4

If you are on unsecured WiFi, all of your internet traffic is broadcasted for everybody nearby to see. This means that any traffic to/from your computer that is not encrypted at another layer (such as SSL/TLS or SSH) will be visible, which can expose sensitive data, such as usernames and passwords, or authentication cookies. In addition to passive ...


1

The main risk of using a proxy solution such as Browsec or any of the TOR clients is that they push your trust from your local network neighborhood (your employer, your ISP, your government) to an unknown remote network neighborhood (Russia? Finland? Black hats? GCHQ?). The exit node effectively controls how your browser (or other client) sees the network, ...


0

My two cents: The write-up focuses too much on physical security and not enough on hacking. I would worry more about exploits in the browser and email application, mitigating those by using a more secure browser (cough), sandboxes, and virtual machines.


0

if they're going to the trouble of tampering with hardware, they could just as easily install a hardware keylogger under your keyboard. Lock the laptop in a case when it's out of your sight. I always do this in hotels, because it helps prevent theft too. I also suggest investing in a decent Kensington lock, which can be attached around pipes and various ...


1

The short answer is yes, there are a variety of ways to achieve this, if I'm understanding your question correctly. A basic example would be that a user could set-up Team viewer on their home PC, then connect to it from anywhere in the world. they could then use VNC into the office over the Team Viewer connection and appear (from an IP address perspective) ...


1

This organisation should have a specific landing point for customers to receive/verify/modify their PIN code, which does not depend on departments, and department staff should be trained to not give this information just as they would not give other sensitive personal information. The reason is you can't ask departments to reason about the sensitivity of ...


2

Depends....easy way is to simply ask the I.T. department: You: hi, I'm curious if our IM chats and emails are backed up or stored for compliance reasons. If I need to recover a chat from google hangouts for legal reasons, is it possible? I worked in finance where 100% of all communication was recorded in our office as per government regulations including ...


7

If your company has a product named "Google Vault" installed then yes your IT department, or anyone granted access to Vault, can read your unencrypted Hangouts messages and pictures. Google Vault is an eDiscovery platform - https://support.google.com/vault/answer/2462365?hl=en The only way they would not be able to read your Hangouts messages is if you ...


10

While it's certainly possible, the more applicable question is "how likely is it that my IT department cares?" (Unless you're doing something that could get you fired or arrested, naturally.) In addition to that, the other consideration is that it costs a lot of money to actually store everyone's web traffic, so the content of messages and web requests is ...


3

Yes - you really should assume that anyone can read anything you do online anywhere, anytime. If they own the network then doubly so. If they own the computer you're using, triply-so-with-knobs-on. From another angle, if you are doing stuff on the work computer or in the work environment that you don't want work to know about, you probably shouldn't be ...


18

Yes if your Google Hangouts data has synced onto your work computer the IT department could view it. However don't freak out yet, unless they are looking for it, it's extremely unlikely that they will see it. There are three places that the IT Department could see it: In Transit When syncing your hangout data if your IT Department monitors traffic over ...


86

You should assume that they can. There are various ways they can do it, but whether they actually do it depends on company's standards and practices. Some of the options: It's possible to install additional root certificates on company's machines and use that to MITM all the traffic (traffic goes through company's gateway/proxy anyway, and having friendly ...


0

Social networking sites often allow users to find friends via email address search. This may be a privacy concern for some users as another user can verify whether they have an account on a particular site. It is often an option to disable this functionality: Privacy options screen from Facebook. Allowing this lookup from anyone can lead to a username ...


1

If you are concerned that some site is going to spam you or (worse yet) sell your email address, then you will want to use a unique address for that site. If you're worried about a site being hacked, well, your email address is mostly public anyway; a hack just makes it a little bit more public. What you must not do is use the same password across sites. ...


0

I can certainly state that it is not only phone numbers. It is also your email conversations from past and i mean way back. More than 10 years ago and im still suprised that they would got his far. Everybody is traced and stored along with you mails, internet history etc so there is no need to hide cause you can't especially with the new phones and surf ...


0

The base concept to do this is sniffing on the traffic , you can do that as follows . create an access point from your Laptop , and than connect to that access point by your mobile , and start wireshark on that point you created , if there is data passing that the phone is spying on you , that data maybe encrypted and you may never know if it is really ...


1

Wireshark will show you any network traffic for any device on your wifi network, provided it goes across your wifi network. If it's encrypted, though, you won't see the content, just the destination IP and a blob of meaningless bytes. If it's sent over the mobile data network, you won't see it at all.


1

TOR also maintains a directory of exit nodes, which is public. So, it's easy to detect that a user is coming in via a TOR proxy by simply checking if their origin IP is listed as a TOR exit node.


0

As you appear to be talking about a forum, an easy option would be to change the usernames of other users, or possibly join dates, or some element that can be used to subtly alter the screen in a way they couldn't correct for. Note that this doesn't help any if they simply start copy/pasting the content out of the site though, since they could strip that ...


0

In general I would recommend against (except in the relatively rare set of circumstances in which you have no legal or practical means to avoid doing so), using your real name on-line. The reasons for this have been quite well-described above, but I would also add a couple of other ones : (1.) While -- today -- in the so-called "democratic" countries, we ...


1

While there is much potential harm possible when you use your real name, one thing you should not neglect is others using your name. And while some sites offer means to remove content that seems or seeks to harm your reputation, many don't. So my take on this is, instead of (passively) fearing for your reputation, actively make sure it is a good one e.g. by ...


0

After reading about this problem and finding out about Bicoin timestamping, I came up with a relatively simple way to make yourself a way to prove that you are the owner of a pseudonymous ID using a PGP key and a Bitcoin address in your ownership. This system relies on the fact that in order to unlock these two things you require a secret which, in ...


6

If you delete your TOR data directory, TOR will randomize how it builds new circuits and picks new entry nodes. However, the behavior you are seeing is intentional. TOR has affinity to a small set of entry nodes, called entry guards. These guards help reduce the chance that you are assigned an entry node which is malicious, because your computer is only ...


2

As quoted from this page: Secure erase overwrites all user data areas with binary zeroes. Enhanced secure erase writes predetermined data patterns (set by the manufacturer) to all user data areas, including sectors that are no longer in use due to reallocation. This sentence makes sense only for spinning disks, and without encryption. On such a disk, ...


1

The compromised tor you were mentioning was tor-browser, which was a browser a couple of version older than its bleeding edge counterpart but came with some privacy plugins installed. Always use updated browser and software if you want to be more safe. Regarding rogue exit nodes, it would require a lot of luck (there are way more exit nodes than what they ...


1

Just some ideas: Using a radio broadcasting device of any sort will allow signal finding to identify the source location. I would not use a cell phone regardless of its origin. By implementing a private VPN service prior to entering the TOR network you can shift point of origin and further muddy the path. Make sure you update Tails to get the fix to the ...


6

This looks like a classical Canary Trap. Basicly I would suggest to hide encrypted information about the user in different ways: obvious QR-Code (as suggested by slugster) different colors (as suggested by Nick Wilde) page viewed as username - footer on each page replacing certain words with synonyms code information in spaces and interpunction within the ...


2

There is no way that you can ensure that. There are a couple of other methods you can use to attempt to fingerprint it but any reasonably adept user can easily avoid it really. (as slugster said) QR Code. Use a unique sequence of colours on a border - Better than text since tiny text is often not legible in a compressed jpeg even when a colour sequence is. ...


1

Would embedding user specific information into a discrete QR code using two different colours that produce enough contrast but are still complementary to your page theme do the trick? I would use CSS to place it behind the text of any post so that it's difficult to remove from a screenshot. If the dots are chunky enough you should still be able to read it ...



Top 50 recent answers are included