Tag Info

New answers tagged

1

TL;DR, you can't. The protocol behind email is quite primitive, and in many ways very closely mimics the meatspace postal system. Nothing stops me from dropping a letter in the mailbox pretending to be from someone else (although the postmark might indicate that the letter wasn't actually picked up from where the return address specifies). That said, the ...


2

Bear in mind that if you and your friends all have each other as contacts the email could have been sent from one of their systems and simply masqueraded as you. The from address in an email is very easy to spoof, so just because it says it is from you (or a made up address that has your name so that it looks like you) it does not necessarily mean it was ...


0

There is a magazine about that type of security(especially against NSA and others). The Tech Active Series - The Hacker's Manual 2015. In the first chapter, it talks about Privacy; how to protect your privacy, how prevent agencies or black hats to track your data, open source alternatives for daily-use services, how to secure you smart-phone and encrypting ...


2

If he knows the admin password to the WiFi router or network switch he can monitor every URL that you access. Many routers even come with monitoring facilities built into them to support monitoring of one's kids' internet activities. Using SSL prevents your friend form knowing the contents of what is transmitted over the pages but the sites you access are ...


1

Well it depends. If your friend is using Wireshark or similar software that allows capture the packets, then yes he will be able to intercepts the HTTP traffic in WiFi network. So put it simple: If you and your friends are browsing HTTP web pages, then "computer wizard" will be able to see what you and your friends are doing.


4

Incognito mode does not provide any protection from Wi-Fi snooping; it merely stops your browser from saving your browsing history locally. If you're using unsecured Wi-Fi (or secured Wi-Fi where the attacker knows the password), there is no way to detect if your friend has been recording your web traffic. Any http sites you visited have potential to have ...


2

Actually visiting your browser history is not possible as long as he doesn't has acces to your computer. Assuming your computer is not infected by him and he has no physical access to your computer. Although inspecting the network traffic, monitoring or saving it, is possible. What you can do is. Just ask him from man-to-man. Secondly, if you have something ...


1

You can never know for certain if your cryptosystem is still safe. But there are few classical ways of going about this. If you are the one whose cryptosystem may be broken: Use your cryptosystem to send false information and see if the enemy responds to the false information. If they do, they've read your message. Note that that indicates that your ...


1

I agree that most Europeans will see their IBAN as private data and want them to be encrypted. But there is another compelling reason to encrypt and sign the IBANs: A man-in-the middle attacker may maliciously alter them to receive the money you want to pay off. So you should protect any IBAN against this threat.


5

There are encryption techniques like the One Time Pad that are provably non-compromisable when employed properly (but the one-time pad as single encryption technology has other problem like the possibility to change the encrypted message unnoticed). Otherwise, it is often good enough to know that there are no publically known breaks to the encryption ...


1

First of all, anyone who stores data unencrypted on your behalf can read it. This is the simple physics of information, and there's no way around it. If you don't want it to be read, you encrypt it and don't give away the key. That's literally your only option. As for what does happen, the larger and more established the company, the better their technical ...


2

Sure they can but reputable providers typically don't. Google's Terms of Use are pretty specific about sharing. They'll share your info When you opt-in to something (eg: a purchase). With your admin if you are using a Google Apps domain. With a Google affiliate (ie: a different Google company). When required to by law. In the US this is likely a warrant. ...


0

In order for the site of a search result to know your IP address, somebody has to give them that IP address. And in theory, there are two ways that could happen: You visit the site, which requires you to share your IP address in order to make the connection The search engine sends the site your IP address In practice, I'm fairly certain method #2 does ...


0

It's not the ip address that is important to advertisers. It's the unique individual that visits the site. Dynamically assigned ip addresses a la dialup/broadband, don't give the full picture, and the industry is concerned with definitive eyeballs. With that in mind, they probably don't do it.


3

"Foolproof" does not necessarily means "NSA-proof" or whatever. A foolproof security system is meant to be a system usable by non-technical users and lowering as much as possible the risk of a misconfiguration impacting the security. Browser's, for instance, involve a lot of "foolproof" security technology against phishing sites, etc.. In case of ...


2

As far as Google is concerned, they only share non-personally identifiable information with their partners (publishers, advertisers or connected sites). From Google's Privacy Policy: We may share aggregated, non-personally identifiable information publicly and with our partners – like publishers, advertisers or connected sites. For example, we may ...


1

No, they wouldn't. That would be a serious breach of privacy. Of course if you click through on a link then at that point the site can tell your IP address and the search term that you used on Google, from their own logs.


0

There's no such thing as a foolproof tool. A VPN can have "leaks" if compromised, which is fairly easy for an experienced person. And Anonymizer and TOR can "leak," because your IP is visible when you connect through the first layer of VPN. That's what TOR is, chained together VPNs. It is, however a lot more secure, because you have other addresses using it ...


1

Another possibility is the forum you're using used an OpenID account to sign you into the forum. Similar to what Armani was saying, at the point you login with that OpenID you'll set the cookie that lets Google know you're a user on that machine. The login on the page itself was for your mother, but the map picked up the cookie and read your profile. When ...


0

If you have ever signed in to any Google service (Google+, Gmail, YouTube [ever had to watch a video that required age verification?]), then your login cookie stayed in the browser. It sounds like, since your mother uses Verizon for email, she never had a reason to sign you out in order to sign herself in, since she doesn't use a Google service (or not one ...


0

The real question is whether you're using a signing/authentication GPG subkey as your SSH key, or an encryption one. The former is fine, the latter is not: an RSA key must never be used to both encrypt and sign! (Authentication uses digital signatures.)


0

It is unwise to post link-only answers, yet I'll point interested readers at https://github.com/pyllyukko/user.js. A metric tonne of security- and privacy-related settings are there, waiting to be implemented in your Firefoxes. I also link to permanent webarchived version of the main script in case the repo gets deleted or lost: ...


1

It depends on what you're trying to defend against. If you're trying to prevent a site operator from identifying who you as a user are, multiple VPNs won't gain you anything. The operator will see the traffic as coming from the endpoint of the final VPN regardless of how many there are in the chain. You're still vulnerable to being identified through ...


0

Not really. Your question is about security and privacy of your data in transit, but you don't trust the endpoints. You can secure the route all you want, but it's difficult to force all applications to use it, especially those that compromise you from the other end of the VPN.


3

As explained here: Script Surrogates replace a blocked script or complements existing scripts which would not work as expected because of NoScript. This means they provide just replacements for functionality some applications want to call, so that these function calls do not result in errors. These hooks only provide the minimal necessary ...


3

Assuming that you have already totally blocked access to the trackers then it doesn't matter to your privacy. However, it may matter to your usability of some web sites. The scripts are there to allow sites to work that otherwise rely on the scripts being blocked. If all your sites work, you don't need them.


2

It appears that secure DNSSec recursive queries are not possible to enforce. According to the notes in this IETF draft: DNSSEC is not an enforcement mechanism, it's a resource. When I see folks voice opinions that DNSSEC's recommended operation has to strictly followed, my gut reaction is that these folks have forgotten the purpose of all of our ...


1

If you're an android user and this "someone" has access to your Google account the answer is yes, with Google location history: https://maps.google.com/locationhistory/b/0 If the threat is a law enforcement or intelligence agency you can be also triangulated passively as your phone "pings" cell towers consistently even when you're not making a call. As ...


0

I give them grief over the hypocrisy of calling me and trying "to verify information", explaining the situation, and then tell them I have no way of verifying who they are. Sometimes they understand, sometimes they have no idea what I am talking about. If I thought the call was important, I would call back on the published number and carry on my business. ...


0

The app (server side) could encrypt the mail content before storing it, using an encryption key derived from the login password (which is of course unknown to the developer). (if you are concerned about the developer changing the server software to bypass encryption or save a copy of the encryption key, he can do that with the client based encryption too. ...


0

I could hash the IP to 16 bits and store those 16 bits. Then there'd be 65 536 possible hashed values, and for each one of those hashes, there'd be roughly 65 536 possible IPs that maps to that value. Or hash the IP to only 8 bits, so that there'd be only 256 possible hashes, each one stemming from any one of roughly 2^(32 - 8) = 16 777 216 IPs. This would ...


1

If I understand you question correctly, you could encrypt the email before it leaves your computer and only allow it to be decrypted by the recipient. Take a look at a product called Virtru (http://www.virtru.com). I am not affiliated with the company but am a happy user. The recipient doesn't have to be a Virtru user to be able to read your email securely ...


1

I think the linked Wikipedia article covers it quite simply. Consider how many home users like to use a Dynamic DNS service to be able to reach their computer no matter what IP it has. The one computer reports its IP address on a regular basis, to a service which updates the DNS entry whenever the address changes. That way the DNS entry will always point to ...


0

A firewall is a device that sits between the Local Area Network (LAN) and Wide Area Network (WAN). I stole this picture from the Firewall wiki page. Rules are setup on the firewall based on IP and port numbers. You can restrict subnets of IPs from using certain ports. Rules for both incoming and outgoing communication is generally necessary. There can ...


2

Short answer: you can't, because they are two different and incompatible key+certificate systems. Longer answer: Windows Certificate Manager uses X.509 certificates, each of which must be signed by a Certification Authority whose root certificate is considered valid by Windows. Thunderbird will use the public key stored in your recipient's certificate to ...


1

As said above, even cyber criminals struggle with this. The best solution would be an in house solution, by using friends and family you can trust (more effort than a paid service but better result). This is difficult though if you need maildrop on otherside of the world It does also depend on what you are using the address for. For example if you just ...


1

Might be a dup, see this answer: http://android.stackexchange.com/questions/6541/can-a-factory-reset-fix-malware-problem. The short answer is that factory reset may not be enough to unroot your system if it has been rooted.


1

I'm surprised that nobody has mentioned the invincible Red Scorpion in Serious Sam 3 as an example. Pirated versions of the game had this unkillable enemy that would appear and attack the player. A product key that is found not to belong to you, when it "calls home" to activate, could trigger some unwanted feature in the software. Red Scorpion in Serious ...


0

In some circumstances, yes. The software silently downloads an update and the update sees the key is blacklisted--and quits working at an inopportune time. (Say, in front of clients or prospective clients.)



Top 50 recent answers are included