Tag Info

New answers tagged

11

What is so private about your CV, besides perhaps your phone number? A scam might arise if the professor subjects you to a foot-in-the-door technique and later asks for "fees" to submit your application. So be mentally prepared to pull out of the deal the second you're asked for anything you're not fully comfortable with. But sending a CV shouldn't be a ...


8

You seem to be confusing secrecy with security. Secrecy is only related to security when sensitive information is revealed. I don't believe there's anything on a CV that anyone would consider secret. Identity theft normally requires somewhat private information, like Social Security numbers. Consider that many people post their CV/Resume online ...


21

As a professor, he has surely access already to most of the personal information you may provide in a CV. So I do not see any problem inherent to identity theft. Linkedin is an example where you can read the careers of known and unknown people to you. However, in general, an attacker may use personal information for some social engineer procedure to get ...


10

As the product is not opensource, one can legitimately think of the worse. But to keep the answer as objective as possible, I prefer to quote from Windows 10 feedback, diagnostics, and privacy: FAQ: As you use Windows, we collect performance and usage information that helps us identify and troubleshoot problems as well as improve our products and ...


5

In the context you provide, it has to do with a backdoor that changes or moves over time. There might be a backdoor on port 8000, then it switches to port 8001, etc. The idea is that once a backdoor is discovered, the hacker must re-discover it to use it again. See also the concept of "port knocking" in real life, where the backdoor only opens once you ...


3

In surveillance I believe the concept of 'roving' is down to the court order placed on an individual. For example; If an authority, be it the police, intelligence or security services is issued a roving surveillance order by a court to tap your phone, then they tap your phone, but then you dispose or make inactive that phone, then the order will allow ...


0

If this is a typical WiFi installation, chances are that the DHCP leases still hold, and you can verify which of the five computers submitted the rogue enquiry by checking its IP address. You just need to check the DHCP assignment table on the router itself. If it was a passersby, then you can perhaps still recover some information if the router has some ...


1

To answer your question, there are a number of elements that I will try to discuss as briefly as possible in order to have a better grasp of the whole issue. Note that I exclude totally any Adobe Flash vulnerabilities that may be a threat to the user's privacy as it is not what you are asking about. Can I get hardware and operating system information with ...


3

WhatsApp uses a client/server architecture based on Jabber(XMPP) http://en.wikipedia.org/wiki/Jabber For the recipient(s) to see your IP addresses, the application will have to include your IP address in the metadata of the message. But this has no functional role in the design of such an application. Your packet capture will likely show IP addresses ...


0

A properly secured flash app (that is none of the common exploits) which is included in a web page you got from remote system is contained in a sandbox and has no access to the system except for some limited place where it can write and read its own data. It can also interact with script on the local page, make network connections to exchange data etc. If ...


1

As WhatsApp isn't a peer to peer application , in order for this to occur WhatsApp would have to be logging the sender's IP address and attaching it to the message object delivered to the recipient. This has massive privacy and security implications and I sincerely doubt they would be doing this.


0

The site works (most likely- I haven't visited it either) by requesting YOUR permissions to see and record what YOU do. It then looks in its database to see if your friends also use it- if they do, it can show you what THEY have done. It can't show you what anyone who is not a member of their site is doing, which is why it is so insistent that you get your ...


1

Yes, for sure: WebRTC relies on JavaScript that can leak your actual IP address even from behind your VPN. The members involved in the peer-to-peer communication using this protocol can not see each other's IP but there are two cases where this is possible: you as te owner of the web application, and an attacker who compromises your website. There are ...


0

In Canadian privacy regulation, public bodies are not able to transfer or store PII of citizens outside of Canadian borders (it should cross border, because data exchanged to US can be monitored). Therefore, none of government or crown organizations in Canada use AWS for any purpose. The restriction is so strict that apparently Microsoft is planning to open ...


0

Confidentiality is a set of rules that limits access to a certain data. Privacy is the ability of an individual/group to choose which data about himself/themselves is shared and given access to. Therefore, privacy is obtained through confidentiality. Anonymity is the ability of an individual/group to keep their identity secret. Note that confidentiality ...


4

Confidentiality is about a data, whereas privacy is about a person/group of people/organization. Every data belongs to a person. Every person is identified by his data. So these 2 notions extend each others. Interpreting one of them as being a sub-characteristic of an other is correct at your will.


1

You must always clear your cookies. Except in one case. A cookie is just a text file where some information in plaintext format is stored. But you can not get an answer if you do not know the type of cookies that exist: Transient Cookies (called also session cookies, non-persistent cookies or in-memory cookies): they are stored in the RAM and they are ...


2

Cookies by themselves do not create any vulnerability. The goal to delete cookies is merely to improve privacy by keeping websites from tracking your activity. A common way to track users, for instance, is when you visit several websites which include contents from some defined third-party tracking service (this content may be advertisement for the ...


3

Yes, there is a point. To be clear, "opting out" merely stops the targeting of ads. It does not eliminate ads, or reduce them in number, or vastly reduce the more insidious Tracking aspect of ads. In a broader context than just Chrome, it varies by platform and ad system, but some ad networks will not collect as much information knowing that they can't ...


1

Those extensions and similar ones do exactly what it claims to do (and they are opensource): reduce targeted ads from companies tracking you online and as you concerned about the privacy issues, the IBA Opt-out extension you linked to for example states: Stops interest-based ads on some of the websites that partner with Google In the Protect My ...


2

The only thing I can think of at the moment is: some companies use these ads networks to remind you of things you have lately browsed in their site to push you forward to buy them. So imagine you are looking for some sexy underwear for your wife in your device and later at your work they show up while showing some sites to your customer (fake situation but ...


1

Did I perform the right steps? Have I exposed myself to more risk by contacting these services? Yes and No. The fact the link you clicked on looked legit on Google with a valid certificate does not necessarily mean it is an innocuous one (you can set a certificate to your website and run any malicious script to target your visitors), and scammers ...


3

I would have performed the same actions. Confirm the validity of the website, and request the account be removed. I don't believe you've exposed yourself to more risk at all by contacting these services. The key to performing the above is to not actually click the link in the email. Go to the service's webpage separately where you can verify the ...


2

In theory, yes, the webrtc standard let's a website determine your local ip address, so it can create a direct connection for you to a another web-browser, allowing direct connections between browsers to set up video streaming for example. This website has a proof of concept showing you your internal and external ip address: ...


3

The same software library that Superfish uses is present in other products beside those found in Lenovo products last year: http://www.tripwire.com/state-of-security/latest-security-news/researchers-reveal-evidence-of-other-superfish-style-attacks-in-the-wild/ Then there are the 2011 Comodo and DigiNotar breaches, which may be the most famous, early root ...


2

First of all, it is important to keep enough bits from the start of the address that it will still be clear which class of address it is. How many bits are needed in order to know that does however depend on which class of address it is. Here are a few examples: 2001:0:xxxx:xxxx:: a Teredo address - 32 bits (two groups of digits) is enough to know it is a ...


2

Twitter seems to have a complicated history with Tor's users. The linked article seems to doubt of Twitter explaining they do not put any specific restriction against Tor's IP: Twitter does not block or force Tor users to phone verify in order to sign up. Occasionally, signups and logins may be asked to phone verify as they may exhibit behavior ...


20

This is because Skype displays Google Ads. So Skype isn't getting information from Google about you. They are displaying Google hosted ads which are based on your Google search history. The search based ads shown are not based off your overall history but recent history by design as it is likely you are currently exploring the market for the product. Where ...


0

In general, a browser cannot detect your local IP or any information about your LAN. Thus any javascript code running in your browser cannot communicate to the web site any information about your computer or your LAN. HOWEVER... most browser plug-ins and Flash or Active-X controls can access data that is normally restricted by the browser. For that reason, ...


3

An easy way? Pehaps, but it depends on your own experiance with Android penetration testing or relatable systems; Linux. And what level of perinoa you're willing to advance to. If you're command line savy then install no-root BusyBox and run netstat -plant with auto sync off on the target device to list the ports and addresses and process IDs that it is ...


6

I believe they already have if this article is correct: http://community.skype.com/t5/Security-Privacy-Trust-and/How-to-protect-your-IP-from-skype-resolvers/td-p/3874291 Skype uses peer-to-peer instead of traditional client/server connections to make the calls happen though. Since there's no sole middleman the data needs to know where it's going between ...


1

You cannot verify someone's age by their IP address. What probably happened was your daughter filled out one of those quick age verification checks when she went to the site. The site admins probably linked her IP to that age verification request.


1

Short answer: they can't. Long answer: An IP address does not carry any information about the ages of any users behind them. The only thing they can do is correlate different activities from that IP address, hoping to find accesses to a service that does some kind of age verification, and then boldly deduce that since one user behind that IP address was ...


2

An IP address is definitely not the best source of information to match an individual's age. What I could imagine is that the forum could have an interface to a social network (such as Facebook) and if she has authorized the forum (for example by using Facebook as Iaas [Identity as a Service]) they could retrieve basic information from your daughter such ...


0

Developers get the MINIMUM VERSION and TARGET VERSION confused. The minimum version acts as a filter in the play store to show only compatible apps. The target version is a measuring stick to how up to date it is with newer operating systems. Here is the problem: Android OS will automatically grant additional permissions to an application if it hasn't ...


0

Android Permissions are a tricky subject - there are a range of reasons why an App might require some fishy sounding permission to private data: Intent to steal you data and use it for advertsising or selling it Lazy coding / incompetent coding ( I'm not sure what exactly we need, so let's just get this general permission to all files ) Bad Android Design ...


1

Is there any prior research that describes how a cookie, or cookie alternative would be used to provide such a guarantee? I don't think you can provide such a guarantee, except by perhaps saying so in your privacy policy and then following that policy. The scope would be restricted to a one, or a very limited set of URLs, Setting scope can be ...


1

When "Limit Ad Tracking" is turned on, apps are still allowed to collect the IDFA, but they are supposed to (honor system) not use it to Target ads. Nothing stops servers from continuing to Track your device (i.e., collect, store, and aggregate personal, device, or behavioral data along with the IDFA). It is a usage recommendation (enforced only by Apple ...


0

If I understand it right, some of you are using WhatsApp. WhatsApp is owned by Facebook, and is allowed to look in your Contacts. So as soon as two people use WhatsApp, Facebook may know that they are connected. Other apps have access to your Contacts list as well. You may want to carefully consider which apps you use. There are tools which allow you to ...


2

You can post your unique local unicast address since they are pretty much the same as a IPv4 private address. It has the prefix fc00::/7 (fd00::/8). However I don't suggest you to post your IPv6 public address, especially in a network expert forums. You can try to abstract your question by making reference to its components (Network Identifier or EUI - ...


0

Look on Phoronix.com for Purism reviews, Michael has done a few blog posts on topic, including some controversy about what Purism is doing with their firmware. Traditional IBVs (Independent BIOS Vendors) like AMI/Phoenix/Insyde have closed source codebases. Intel has Firmware Support Package (FSP) and AMD has ASGEA(sp) which contain the necessary blobs that ...


1

I don't think this will provide any benefit. On a secure web application, the less you depend on client data, the better. I can see some issues: This will surely create a vulnerability named Session Fixation: an attacker can create a session, lure your client to a special page, and have the session data on his hands. The server has no means to know if a ...


2

IMO, the only way to be sure about your firmware is if you build it and flash it yourself, and don't let system out of your hands. Intel Tunnel Mountain and MinnowBoard are the Intel dev platforms for UEFI. You can build your own firmware on these boxes. If you are concerned about this sort of thing, you might want to use a Novena or perhaps a Purism laptop ...


2

The only way to get control over your computer, that works always, is to physically replace the infected BIOS flash chip with a non-infected one (provided that only the BIOS is infected). It is possible that the flashing utilities aren't infected by the government, so you can perhaps even flash a non-infected BIOS from inside a system, which comes with its ...


3

Your question here is basically the question every steganalysts are asking. Reading from wikipedia page: The goal of steganalysis is to identify suspected packages, determine whether or not they have a payload encoded into them, and, if possible, recover that payload. The usual way to go is to have a set of known not-steganographed data to extrapolate ...


-1

In case of hidden partitions, copy the materials to a different media. Don't clone it though. Also don't allow compressed or encrypted attachments. One of my clients doesn't allow compressed files beyond 99% compression for instance. In the case of images, you can resize an image by reduction, which will typically remove any altered binary info in the ...


0

Based on the information which I've found on-line so far, the following statements are true: Passwords are always encrypted source. Chrome uses your Google Account to encrypt your synced passwords source. Whether or not you use a passphrase, your synced data is protected by encryption in transit. Your Chrome sync passphrase is stored on your computer and ...


1

Probably not enough context to make any accurate determinations. But here is a shot at it. What frequently used law does does the Government rely on to search private property? The supreme court is pretty clear on this that they require a warrant. Even with a warrant, there is some discussions that if your data (hard drive, as an example) is ...


1

I start off by giving general cases, but then use specific examples for each case. Protecting Personal Information: Virtual Private Networks ("VPNs") and proxies are most commonly used to encrypt traffic and hide one's IP address. There are two main reasons why others would want to use them: To access or use a service that would not normally be ...



Top 50 recent answers are included