Tag Info

New answers tagged

4

What you describe here is called a known-plaintext attack. The attacker has at least part of the plaintext, and tries to use it to figure out the key. AES and all other modern encryption algorithms must be able to withstand this type of attack. So the answer is no.


0

Remember that when you use a VPN service, that service will be able to collect all the information which could usually be collected by your internet service provider. That means using a VPN service for privacy is only reasonable when you trust the VPN provider more than you trust your ISP. I usually would recommend you to look into the privacy policy of ...


4

There's no way to be 100% certain, but bear in mind that it's entirely possible for your VPN provider to see ALL of your traffic. Personally I do not sign into any personal account when using a VPN, particularly a free one. I'm guessing that you want something to bypass country specific law? The safest way is to purchase your own VPS (which you can find for ...


0

Using a system-wide proxy would give Apple an alternate (and possibly changing) IP address, but would not address the cookies. I have noticed that Safari will register cookies from other system services, iTunes being a likely suspect. To address cookies and data sent to Apple, it would take a bit of work, but you could determine where cookies are placed ...


1

In response to the first question, One way to avoid the privacy risks you mentioned, AFAIK, could be to employ the use of a system-wide proxy wherein all traffic 'has to' pass through, say, the TOR network. Pertinently, this would depend heavily on the anonymity offered by TOR and any inherent weaknesses or vulnerabilities in TOR would thereby affect the ...


2

Yes, most commercial RSS feeds do place beacons in RSS articles. They track your IP, and transfer it to their analytics service providers. You can test for yourself, by going to a feed by Feedburner, and examining all the tiny images that are loaded. You can also read the source code of the RSS feed to see for yourself that the link to "Full article" often ...


1

I can answer that for Germany only (caveat below). In German data protection law, it's basically forbidden to collect, process or use data that can be linked to a natural person and that's not publicly available unless you're explicity allowed by law or by the affected person. By sending the message, I'd assume (IANAL though) that you implicitly give your ...


0

When software "phones home" for licensing, it is exposing its own internal data to its developer, it's not exposing the data you created with it. The data you create are in separate files that are opened with the software. If, on the other hand, you suspect that the software is intentionally also sending your private data to an off-site location, that's a ...


0

The most intuitive answer is to do your online checks before any sensitive data is present, and then to air gap the computer immediately. This is easily achieved on an ongoing basis by keeping the most sensitive data on a removable hard drive. Even if the software is spyware, it will be much harder for it to exfiltrate your data without an internet ...


9

The Background The general situation was Snowden entering his password at that time, and he wanted to mitigate visual surveillance, let it be by observation or (hidden) cameras. It seems, Snowden didn't trust anything but his own laptop (if at all) during these first day(s) of contact with the journalists. He also offered the blanket to the others in the ...


0

The only way tracking could be done is by having a software loaded on the system, there's no way to do it only through a VPN connection. If the system have been reinstalled with factory settings and all the programs were loaded by you, and they have not installed any tracking programs, they cannot track the usage.


0

As can be understood by Davids excellent answer, the idea of actually verifying that the proprietary firmware of device such as a phone is not/never taking your information or capable of doing so at request is such a massive undertaking as to be nearly a ludicrous proposition. The 'Stallman solution' would make this verification easier as source code is ...


3

Well, even if Google was vulnerable to XSS, this still wouldn't be a breach. Why? Because of the HTTPOnly flag. It is the big reason for XSS's downfall. You can say there are two kinds of cookies: those that your browser gets when it recieves an HTTP response from a remote server (like google.com). They are in the Set-Cookie part of the response. ...


0

They can log in pretending to be you, your cookie is basically the token that the server gave you so that you can stay logged. So that means accessing all the google services logged in with your account. If those are your real cookie values, you should log out from you google account as soon as possible.. EDIT: I didn't notice you said you dumped the ...


6

A MAC address more-or-less* uniquely identifies a network card, and is only accessible to other devices on the local (non-routed) network. So yes, the Starbucks network can and does know your MAC address, and certainly could be sending it up into their database somewhere. Concern #1: That doesn't mean they're "recording traffic" (although, of course, they ...


1

You can use Tails with Mac OS by using a virtual machine! Think about it this way: in a situation where you want to preserve your privacy, you want to set up your operating system so that it can be wiped/thrown away quickly. That's why so many folks like to do their private operations off live USBs or virtual machines. Here are a few ideas: Use a live ...


0

It looks like the site is supposed to analyze all your Facebook activity, including what you send, so it needs access to all those things. Their website doesn't really explain what they are trying to do, so I'm not sure what the risk/reward is.


1

There is no chance for fingerprint attack. The first point here is there is no unique certs as you can create and if you try to make it , you need to add digital signature in the certificate( self signed or not ), then you require private key. Its available only with the particular person. The second point here is you can't establish a secure ...


0

No, this is a user enumeration vulnerability. As an attacker if I can use your login or forgotten password page to narrow my list from 10000 targets to 1000 targets, I will. The best implementation to solve this I have seen is that both the sign up and the forgotten password forms are a multistep process (exactly the same back-end/process after the ...


8

The short answer is in comments and @msw's response. There is, literally, no way that you can use the library's (or anyone else's) systems and/or infrastructure and have a 100% guarantee of anonymity. If the system and/or network owner is determined to be able to monitor and log your activity, there is nothing you can do to prevent it except simply not use ...


3

Nope. They own the machine and the network, they can log anything you do if they wish to.


1

As soon as you download something, the site will know, and you have no control over who they share this information with. However, as @AJAr points out, the privacy policy of the site may affect it - as may the law. However, both the law, and a violation by a site of it's privacy policy, cannot change the damage that has already been done. You can try to ...


1

The answer to this is limited by the extents of sharing and personality one might deem significant to their own privacy. Most websites like these are legally obligated to reference a privacy policy linked at the foot of every page to describe what information is collected, how it may be shared and with whom (in terms of the content provider's relationship ...


4

In the case of Facebook, their SDK allows a website to determine whether a user is logged in: FB.getLoginStatus() allows you to determine if a user is logged in to Facebook and has authenticated your app. There are three possible states for a user: the user is logged into Facebook and has authenticated your application (connected) the user is ...


15

I think what you are noticing is a client-side acknowledgement of your sessions with Facebook, Gmail, etc. If a sharing script originates from facebook.com and you have an active session with that hostname, they will present a streamlined share button (for example) for your account. The website linking you to the script on Facebook cannot see who you are ...


1

Tor was originally created by the US Navy and DARPA in the 90s to protect online communications abroad. So there is certainly a legal use. On the other hand, it is used to break the law in many countries, like in Iran and China. Where do you live? Do you have a western viewpoint? If so, do you mind that people in Iran break the law using Tor to ...


0

Anonymity networks are designed to withstand any outside censorship or surveillance. That's their primary purpose and how well they do this is the criteria they are judged by. However, most anonymity networks theoretically allow self-censorship by blacklisting on individual nodes. Networks need to identify resources by some kind of identifier like a hash ...


14

Officially, they are pushed forward to allow people in dictatorships to break laws restricting their freedom of information and/or expression. Because, the problem with the law is, that you need some people to make it, and wherever people are involved, they try to get their beliefs into the law. As such, laws, even in so-called "democracies", are not always ...



Top 50 recent answers are included