Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [fingerprint]

In information security, a fingerprinting algorithm uniquely identifies the hardware, software or data. Just as human fingerprints uniquely identify people for practical purposes. This fingerprint may be used in penetration tests or for vulnerability management.

6
votes
1answer
191 views

Will two smartphones (identical hardware and software) generate the same canvas fingerprint?

When using Canvas Fingerprint (like on this website) to distinguish users, does two smartphones (same model, same OS version, and no browser/plugin customization) will share the same fingerprint?
0
votes
1answer
22 views

How are these transaction fingerprints colored?

For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
0
votes
1answer
44 views

How to defend against adblock detection/adblock subscription leaks?

Is there a best practice (or useful extension) for defending against adblock fingerprinting techniques? I'm not asking about how to bypass adblock detection as such, but rather how one might appear ...
1
vote
2answers
192 views

How secure is the fingerprint sensor in the Pixel 3?

As far as I understand different fingerprint scanners have different security levels. Old fingerprint print scanners could be fooled quite easily as the CCC (Chaos Computer Club) demonstrated. How ...
1
vote
1answer
66 views

When first connecting via SSH to my server, the reported fingerprint does not match that given to me when I generated the SSH key

When I used ssh-genkey on macOS to generate the pair of key files (one named with .pub), that tool reported a SHA256 hash as a public key fingerprint. When first connecting to my server, a Digital ...
0
votes
1answer
29 views

Enumerating hosts running Elastic Stack

I am currently working on a project where I need to find a host running a SIEM solution. From my research I am fairly confident that the host is running Elastic Stack, probably within another solution ...
0
votes
3answers
84 views

When should TouchID/Fingerprint log-in expire?

I couldn't find such a standard which mention about TouchID or fingerprint log in expiration date. Suppose I have an application and allow users to log in using the fingerprint. I would like to know ...
3
votes
1answer
115 views

Is there a way to find out what information website queries about us? [closed]

What tool or software should I look for to find out what "fingerprinting" data a website is tracking? Like, I want to know, if website looks for a cache and/or fonts installed in system, or Canval, ...
3
votes
1answer
157 views

Will disabling WebGL make me more or less unique on the internet?

I have wondered whether disabling WebGL will make me more or less unique, I fiddled around with https://panopticlick.eff.org/ to see what would happen. If I keep it enabled I am 1/205.66, with me ...
1
vote
1answer
90 views

Preventing OS fingerprinting

I am working on a project and I need to hide my Linux OS from nmap or other OS identification tools. I read many articles about TCP/IP stack and changed many properties such as TTL and packet size but ...
0
votes
2answers
156 views

How does google know if I am logging in from a new machine(using web browser)? [duplicate]

Every time i sign into my google account on a web browser on a new machine, it warns me of suspicious activity. How does google know its a new machine? I am trying to implement a similar thing for my ...
1
vote
1answer
129 views

Browser Fingerprinting to secure login

Is it a good Idea to identify if the user logging in is the actual user who created the account by using Browser fingerprinting? Basically do a bunch of checks just as they click sign in and if it ...
1
vote
0answers
55 views

IRC client with ability to verify server's self-signed cert fingerprint [closed]

I'm playing around with UnrealIRCd on CentOS. Just went through the config and compiling and got the ircd up and running. When I go to connect to it via HexChat I can only get through by checking the ...
3
votes
1answer
90 views

Self-signed certs on LAN shared with others [duplicate]

My WiFi is shared with my family, and my siblings have friends come over sharing the WiFi password carelessly. Anyone of those guests could have a rogue device and not even know it. My brother has ...
2
votes
0answers
108 views

How does biometric authentication work from a technical perspective?

Together with a colleague, we discussed the way of biometric authentication and how this works out. Both of us are only interested in security but far from being an expert on the technical side. ...
3
votes
1answer
319 views

Google's Certificate Fingerprint doesn't match with the Fingerprints in the Chrome's “net-internals” configurations

As you may know, you can query chrome's HSTS/PKP sets for a domain in the page chrome://net-internals as below: As you see above, there are four SHA256 hash values (in the middle of page and in ...
0
votes
1answer
65 views

What is ScriptSafe's “Client Rectangles” and what information does it leak?

Just wondering how this one affects the privacy and security because it breaks a lot of sites displaying images for example.
1
vote
0answers
59 views

How can I fingerprint Yii framework version?

I am currently testing in a black box manner an application written in Yii framework. How can I fingerprint Yii framework exact version? It's there a public file or function that I can use to perform ...
2
votes
1answer
150 views

How can Telegram find my phone number on iOS 11 after uninstall?

I wanted to sign in Telegram on my iPod Touch running iOS 11 with another account. I deleted the app and install it again. On the sign up screen Telegram filled the phone number field with the number ...
1
vote
0answers
544 views

How to verify certificate fingerprint? [closed]

I downloaded Veracrypt and its sig file. I go ahead and import it into Kleopatra to verify it (using Windows gpg4win). Now i reach this step: It asks me whether i have verified the fingerprint. How ...
1
vote
0answers
28 views

GPG RSA Authenticity Mechanism Minimum Requirement

The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity: the public key the signature the fingerprint of the public key Assuming that the author keeps his ...
0
votes
0answers
24 views

Any one know the flow of android hw_auth_token?

I want to know the flow of Android's enrol/authenticate hw_auth_token. In every enrol time, generated g_challenge in fingerprint TA, but who use this g_challenge, and who fulfils the struct member (...
2
votes
1answer
1k views

How secure is the new MacBook Pro's Touch ID?

I'm afraid that if I will lose my laptop while turned on, somebody might take the fingerprint off the screen or somewhere else and unlock my laptop with the fingerprint sensor. Is this a valid ...
1
vote
2answers
5k views

How to verify SHA256 fingerprint of APK

I have downloaded the signal app from https://signal.org/android/apk/. To verify the download, there is a fingerprint provided. But how can I verify this fingerprint with the file? I know that I can ...
0
votes
1answer
88 views

Re-run nmap OS fingerprint match with existing subject fingerprint

I have a collection of nmap subject fingerprints (described here), but have updated my local (private) reference fingerprint database since they were collected. Is there any existing way to re-match ...
0
votes
1answer
768 views

How much more secure is fingerprint compared to text passwords? [duplicate]

Mathematically, how much more secure is fingerprint compared to textual passwords? Like is there any detailed mathematical analysis?
0
votes
1answer
450 views

Best practices for storing and submitting browser fingerprints to secured endpoints

I have a large API and JSON Web Tokens (JWT) used for user authorization. These tokens are validated on frontend (nginx proxy) with Lua code. Now I want to secure my API a little more with browser ...
1
vote
2answers
510 views

Is it possible to disable the fingerprint scanner but not the button it's on?

I'm looking to get a new android phone, but many seem to have fingerprint scanners, often as part of the main button. I don't want a fingerprint scanner, because I don't want to have to worry about ...
0
votes
2answers
294 views

Is there a coordinated Firefox user-agent for anonymous browsing?

One fingerprinting element is the browser's user-agent string. If we consider one browser, Firefox, we can see that it has different strings across different OSes, distros, forks (Tor, IceCat) and ...
5
votes
2answers
807 views

Face ID vs Touch ID [duplicate]

While unveiling iPhone X, Apple made a statement to this end: With Touch ID, it stated that there was a 1 in 50,000 chance that someone would be able to open your phone with their fingerprint. ...
0
votes
1answer
443 views

How much does disabling JavaScript restrict browser fingerprinting?

According to EFF's Panopticlick web browser fingerprinting test canvas & WebGL fingerprinting require JavaScript and (at least) screen size, color depth, browser plugins, time zone, language, ...
7
votes
2answers
2k views

gpg --fingerprint prints out completely different fingerprint

When displaying the full fingerprint of an OpenPGP key, it get a completely different one compared to the ID. For this specific key: $ gpg --list-keys --fingerprint D72AF3448CC2B034 pub rsa4096 ...
11
votes
4answers
3k views

How secure is the use of fingerprints (like Apple's TouchID) for authentication in banking apps? [closed]

We are working on the development of a banking app and for customers. We need to implement TouchID in Apple's iOS and a fingerprint check in Android. Firstly, what are the possible security risks ...
3
votes
1answer
163 views

Combating Networks of Forged OpenPGP Keys on Public Keyservers

I recently noticed that someone has created an elaborate forgery of my OpenPGP key. Specifically, they orchestrated a short key (32-bit) fingerprint collision, and also forged additional keys to match ...
1
vote
2answers
367 views

Updating the SSL fingerprint on an IoT device

I'm currently in the process of designing the security model for an IoT product my company is developing. The device will be connected to the internet via WiFi and shall communicate with our company'...
3
votes
1answer
2k views

What are the security risks of USB fingerprint scanners in Windows 10?

Hi I have a Lenovo laptop encrypted with Bitlocker, which I also use a fingerprint scanner with. Bear in mind I'm not working with super-secure information, more the level that a developer/manager for ...
1
vote
0answers
64 views

How Travel Site like Tripadvisor, Airbnb track their user [duplicate]

How Travel Site like Tripadvisor, Airbnb track their user browser fingerprint, ip address and block them to make a second account from the same computer? Using a Socks/Proxy service, VPN would work to ...
-1
votes
3answers
346 views

Biometric fingerprint as salt for hash function

Sorry, might be a stupid question: But is there any hash function, which use the biometric fingerprint as salt? First, the User enters his plaintext password, second he use his fingerprint - some ...
1
vote
2answers
182 views

Can I detect OS and browser spoofing on webserver side?

My questions refer detecting fake User-Agent, in sense of spoofing user OS, web-browser and other info sent in headers from users browsing resources on my server. Is there a way to detect if user is ...
4
votes
4answers
194 views

Could it be possible to hijack physical finger prints in digital form and use them to gain access to other devices and locations?

With more and more devices accepting finger prints in place of passwords, could it be possible to "keylog" these finger prints on mobile devices, for example, by installing a rogue application and ...
2
votes
0answers
457 views

What encryption type does Windows Hello use for fingerprint information on Windows 10 latest build?

I've contacted Microsoft support and they said they don't support encryption, which is why I'm posting here. Basically, what I'm wondering is, if a modern laptop has TPM 2.0 enabled and hardware ...
1
vote
3answers
128 views

Consequence of using SSH when Fingerprint has Changed?

I got the following error connecting to my server via ssh: The authenticity of host '[ip address]:port ([ip address]:port)' can't be established. ECDSA key fingerprint is SHA256:[...
3
votes
2answers
452 views

Will the OpenPGP key fingerprint change if the certificate is extended?

Should the fingerprint of a renewed (extended) OpenPGP Key be the same? Is there any documentation on it (RFC)? Quoting from RFC 4880: There are many ways possible for two keys to have the same ...
2
votes
1answer
162 views

Adobe Flash Inside Whonix Workstation

It's known that Flash can give away your real IP address to web services if you use it in Tor Browser directly run by your computers OS. But what if you use flash inside a Whonix workstation (either ...
61
votes
4answers
10k views

Why do mobile devices force user to type password after reboot?

Nowadays, many mobile phones have supported unlocking through fingerprint recognition. However, both iOS and Android require users to enter the password after the device is rebooted, even though an ...
2
votes
2answers
203 views

Accuracy of Iris Biometric Authentication

I understand that the iris is the most accurate biometric modality since it has a false acceptance rate of about 1 in 1,000,000. Fingerprint on the other had is about 1 in 1000. These error rates ...
3
votes
1answer
349 views

What are the NIST/FBI requirements for Fingerprint readers, and Iris scans?

Background I'm trying to locate the US government standard for fingerprint readers and mobile devices. I heard in passing that the iOS fingerprint reader only scans 9 points, where the FBI ...
7
votes
1answer
3k views

Why do certificates need thumbprints?

I recently learned mechanism of certificates. But I can't understand why a "thumbprint" is included in a certificate. For intermediate and end-user certificates, it is verified by its issuer. so it ...
14
votes
4answers
4k views

What are the risks of providing my fingerprint to a theme park?

I recently visited Epcot Center and was surprised that they asked to scan one of my fingerprints before I entered the park, even though I already had my ticket in hand. I don't believe they require a ...
4
votes
2answers
5k views

Verify my own self signed SSL certificate

I have generated my own SSL certificate for a web server on the internet, however this was for three reasons: Fun Not wanting to buy an SSL certificate Trying to get an A rating (excluding trust ...