Tag Info

New answers tagged

0

In addition to the technique Enos mentions, another common technique is to use hashes. For many testing requirements hashes will be sufficient. Couple of gotchas, though: If the space isn't big enough, collisions could cause problems If you have logic that does something like matching account types by the first 4 digits being 0123, then hashing will fail ...


0

If you must absolutely use production data in DEV, you may produce a table matching actual account IDs with random ones, then destroy or adequately protect the table after transferring data. REAL ID | FAKE ID -------------------- 0000001 | 3287638 0000002 | 5917382 etc. Beware DEV data may include other information connected to the account ...


2

The other address you are talking about is a MAC address, but that is only used at the local link level, not to communicate across the open internet. Only your IP address is used when talking across the internet, however there are other ways to track you. For one, the manual way is to contact whoever has the IP address and ask who was attached at the time. ...


2

You can be detected even using different network devices. If you connect from home using the Ethernet card, and on a Starbucks using the Wifi card, it's trivial to detect you. Now how: Cookies: The cookies on every site you access are independent of the IP address of your computer. So if you accessed Google from home, and accessed again from Starbucks, ...


1

Computers (more precise: their network interfaces) have MAC addresses which isn't intended change (although they also can). It has a different format as the ip, and it is invisible outside of the providers network. State spying works otherway. Practically they use multilayer watching: there are their spy boxes by the network providers, there are by the big ...


0

If the local network management has control over your client machine, you have no sure way (you can't guarantee, what type of watching software will they use). If they don't: practically, you have to Hide your traffic (to protect from watching on the routers) Hide your browsing history. For (1) the best solution if you have a remote "helper", ...


1

Also most information has to be displayed somewhere, somehow and at sometime. How would you do this without an endpoint? Maybe send it everywhere rather than to one particular host? Why not just use your byod and 4G connection for yourself. Of course, if said network operators are themselves being rather naughty, then they can do your job for you.


3

A VPN or an anonymity network such as TOR can hide the details of your activity from your network's owner, although the fact that you are using TOR or a VPN is not hidden (and may in and of itself be considered suspicious activity). You need to be careful when setting this up, though, since mistakes such as DNS leakage (where your DNS queries go out over ...


1

Skype is a modified P2P network. You have no guarantee that your traffic is going to them, so a sniffer wouldn't work the way you'd expect. However, you can resolve the person's username to their ip address with a tool like this while they are online. So if you can get their username from the Skype number, or the email address associated with the number (to ...


1

Yes it is possible but unnecessary in your case. People often use VMs to isolate potentially malicious applications from their main host and to have some sort of rewind button to restore the VM to a previous state in case something goes wrong in there, but looks like that's not what you want to do. To defeat forensics all you need is full disk encryption ...


2

Unless you have been directly assigned a range of IP address from the regional internet registry (faka RIR), then you are using someone else's IP address. The vast majority of the users on the internet are in this same situation. Typically, you are using an IP address (or range of addresses) that has been assigned to their ISP and they are in turn allowing ...


0

This will depend on the type of VPN. Cisco anyconnect normally uses strong cryptography to create a tunnel through which all your traffic is routed. This means that the person who has control of the VPN end-point will be able to view what you are visiting. Most likely when you are using the Wifi, there is either deep packet inspection or a proxy which is ...


0

The VPN operator can track and record what websites you visit while you're using the VPN if they want to, and you'd have to check their policies to see what they actually do. If everything is set up properly, your wifi provider can only see that you're sending encrypted data to and from the VPN, but can't see what pages you're visiting. If you're connected ...


0

see http://xkcd.com/195/ for of map of the internet. First of all, the IP address that is guessed on the internet may not be yours at all. E.g. unless you own some public infrastructure and have machines out there, you are using Network Address Translation (NAT). If there are several machines at your company and one of them is connected to an uplink (= the ...


0

The typical example scenario is, that a Network Provider in Munich have a subsidiary in Nuremberg, too. (These cities are around 180 km from eachother.) When they got and registered their IP subnet, it was registered by their official addresse, which is Nuremberg. If you are in Nuremberg, it is possible that the whois database signs you from Munich, but ...


0

could you recommend what I should do to keep someone in computer forensics from finding any deleted files or files for that matter? Securely delete files, and erase over the empty space on your hard disk with a three-pass algorithm. There's a great guide for that here, on AskUbuntu. Technically you can recover stuff that has been passed with less than ...


1

Unluckily, although PGP is awesome in theory, the "real world" benefits of PGP are quite limited, if existent. If PGP was the default that everybody uses, it would rock. TLS gives you (ignoring the possibility of exploits) a secure connection to your mail server. You have the guarantee that the server you talk to is really your mail server, and that nobody ...


0

If you have a VPN tunnel between A and B, that will allow those two servers to have a conversation private from others on the LAN. It does not prevent access to other resources on the LAN by A or B. For that you'd want to look into VLAN tagging or other router based access controls.


9

HTTPS only protects your email between you and Google. From then on it is transferred unencrypted. That means your email can be read by: Google (and they admit that they read it!) any routers between Google and the mail service of the receiver the receivers mailserver when the receiver isn't also using https, any router between their mailserver and them. ...


2

When you connect to another computer with Team Viewer, a window appears in the bottom right hand corner of that users screen showing the connection. There are buttons for them to activate video, audio, chat, file transfer, or close the connection. If they are set up to allow you to connect (you need their ID), you will be in control of their computer, so ...


0

There are several harmless possible explanations for this. If your website recently got a new IP address, it's possible that some misconfigured DNS or browser is set to cache the name for too long and is redirecting a website that used to be in your IP address to you. The visitor from that area probably tries to visit another website, and their browser ...


6

In short, PGP protects the contents of the email, both in-flight and at rest; TLS protects the communication channel while the message is transiting a network. PGP vouches for a person and an email address; TLS vouches for a server (and optionally a client).


24

There is more at risk in using SSL/TLS than potential 0-days, because there are already known attacks that can circumvent TLS. Moxie Marlinspike has been giving Def Con presentations on it since at least Def Con 17. One of the most notable tools is sslstrip, created by Marlinspike. TLS also requires a Certificate Authority trust model, which gives ...


54

SSL/TLS protects the email from tampering or eavesdropping as it transits between your computer and Google's server, and possibly during further relays to eventual recipient. And that's all it does. PGP does far more. If you're sending a signed email, the recipient can verify that the email was sent by you, and that it was not tampered with at any point ...


12

non-repudiation -- no one can forge your private key signature of a message, encryption at rest -- the message is encrypted not just in transit, but at rest as well. all of the benefits of mail over SSL/TLS sans a lot of the problems (e.g. Heart Bleed and POODLE) Just to name three.


2

There are multiple possible explanations. The first one and the most likely (especially if the secret part of your url is not that long), is plain and simple bruteforce. If you're on a popular website, it really shouldn't surprise anybody that they are being scanned in order to find some juicy hidden urls. Given the fact that they are hitting your page ...


0

Logging in with their public ID number and date of birth sounds like a huge security risk. If ID is public like you say, the date of birth of the person associated with that ID can easily be discovered. It would be trivial to either know (if the potential attacker knows the victim with it being a localised system), retrieve (e.g. via social media), guess or ...


1

If you look at the disclosures from other countries, you can see that countries could/can elect to provide data in response to requests from the NSA. That places it "in scope" of PRISM, so, technically, yes, PRISM can see data outside of US Data Centers, it's just not designed to (according to the info leaked). Any data flowing through US data services ...


4

Anyone who really knows the answer to this question is either prohibited from telling you or is a political refugee in Russia. I think it's pretty good bet that any data that passes through any one of the "Five Eyes" nations (GBR, USA, CAN, AUS, and NZL) could be captured. And, of course, other governments could be doing the same sort of thing.


1

When you say sent over what do you mean? Is this information presented to you, and you then have to verify it or does it also ask for this information as well as your regular login credentials (Username, password) of which it then verifies whether the credentials (SSN, etc.) that you have entered are correct? Because there is to sides to the security coin ...


1

You can construct an empty From: header by using the special address <>, which is normally used for the source of bounce messages. This may be clobbered by anti-spam. The more usual solution to this is an Anonymous Remailer. That results in a message "From" the remailer, with a time delay. You need to find a remailer you can trust that isn't ...


0

If you are storing medical information, the be aware that in the United States, the Health Insurance Portability and Accountability Act (HIPAA) defines an IP address as "Protected Health Information"


7

This clearly depends on the jurisdiction! In Germany, IP addresses are considered personal information! See e.g. here or here if you speak German. It says, basically, that you are allowed to store the IP only as long as you need it to provide the service! This means on a website, you have to delete it after you sent all IP packets to the destination (which ...


31

So IPs can in fact be considered to be PII (or personally identifiable information) in some cases, so you're right to want to consider whether you need to protect them. Generally this doesn't mean, however, going to any additional lengths beyond how you would protect other PII, say, email addresses for example. In any case, traditional hashing is likely ...


20

No. (with possible caveats) The risk posed by storing data depends entirely on what data you collect and how you use it. If you log IP addresses only then there should be no problem. If your log contains IP addresses and names you start getting closer to the boundary, but are still probably okay in most jurisdictions. If your log contains IP addresses, ...


5

I would argue for the following definitions: Pseudonym is a fictitous name used to protect your real identity. Untraceability means that nobody is able to trace back your actions to gain any info even related to your pseudonym or real identity. Anonymity means that there is no way to identify you uniquely from any other individual (although ...


17

The distinction is subtle, but in some ways, quite important. If an action is untraceable, it's impossible to determine where it came from or who did it. This implies a level of anonymity, in that you can't name the person who carried out an action. However, it may be possible to trace an action back to a certain identity without being able to name that ...


5

It depends on what you mean by "untraceable". By definition, you can't be anonymous if adversaries can trace your actions back to your identity. However, you can remain anonymous to adversaries who can trace your actions back to your location, as long as you've moved on by the time they do that, and as long as there aren't compromising records. Conversely, ...


28

The two notions are actually different. Anonymous systems usually are untraceable as a side effect but the reverse isn't true. Consider, for instance, voting. The process is usually not anonymous: you have to prove you identity and rights to vote before you can do so and the system will keep track of how many votes you have cast. But it can also be ...


0

Normally educational networks use webfilters. And to keep the network bandwith at normal rate ,it should be blocked


0

If you are interested in obfuscation techniques between yourself and the Tor network I would suggest you look at the pluggable transports "extensions": https://www.torproject.org/docs/pluggable-transports.html.en


2

Your college would be able to know that you used Tor and can fairly easily block Tor if they wanted to. But what data goes through the Tor network is most likely out of bound for them. If your college runs a Tor exit node, and by chance Tor happen to pick the college's exit node, it is possible that they could do some sort of timing attack. But mounting ...


1

The short answer is that any internet connection you access that is also tied to you personally (e.g. the login credentials on a college network) can be traced back to you. Therefore it is not suitable for full anonymity online. You enter your login credentials to access the network, the network admins can trace your connections through their network to a ...


0

There is no such thing possible till day. as Graham Hill said that you can use two layer authentication, mean when u login a code will be sent to you on mobile and than you have to enter that code and than you can see the inbox. Well apart from this Gmail is continuously capturing the location from where u loggged in. And benefit of this is if someone have ...



Top 50 recent answers are included