Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [identity]

Identity is the property of an object which allows it to be uniquely specified.

3
votes
2answers
158 views

Should things like project IDs, cloud region IDs etc be kept secret on an open source project?

All my side project are open source - just using the free Github account. I'm wondering about how security conscious I need to be about keep things like: Google Cloud Platform Project IDs Log ...
1
vote
2answers
145 views

Can your cell phone transmissions reveal your identity?

Is it feasible for hackers sitting near you to have some sort of RF listening device that uses your phone's transmissions to identify your name or other information that could be used to determine who ...
1
vote
1answer
41 views

How is AWS app identity verified?

So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
0
votes
0answers
36 views

What is the best way to track a logged in user?

We have a client/server app where the client is the browser running our JavaScript app and the server side is an ASP.NET app presenting a RESTful API. We presently have 1 instance of the server, but ...
1
vote
1answer
204 views

VoIP service requires a scanned copy of my passport

In the process of registering to Callcentric, they asked me a scanned copy of my passport. I already gave them my mobile number, where they could possibly make an interview, and of course they have ...
1
vote
2answers
78 views

Best practice on Windows domains: To have a separate admin account or not?

On Linux, we enforce least privilege through sudo. This gives the best of both worlds: Passwords and accounts are for a person, as they should be, not a role. But we lower risk and exposure by only ...
1
vote
0answers
40 views

Security concerns in cookie exporting between browsers

I'm wondering why Facebook is not handling the cookie export between browsers and related security concerns. This will be worst when they are using the "remember me" option as the cookies will be ...
0
votes
0answers
18 views

Open ID Connect: Second ID-Token only has “sub” attribute

I am implementing a customer-IAM solution using WSO2 Identity Server 4.5.1. One of the (few) applications integrating with me via Open ID connect has discovered an unexpected behaviour, and I need ...
44
votes
10answers
17k views

Why use usernames and not just email addresses to identify users?

Why use usernames, and not just email addresses, to identify users? - What is the main concern or the main case when a security expert (which I'm not) should recommend inserting another layer of ...
2
votes
2answers
67 views

Is my (Chrome) email address available to websites when I'm logged into Chrome?

When I'm logged into Chrome (e.g. with my Gmail account) can websites view/obtain the email address associated with my Google/Chrome account? For example, as a means to "recognize" me?
0
votes
2answers
122 views

Someone is pretending to be me

Need some help! Someone has opened up an email account and is sending emails pretending to be me, to my office. They are asking for large invoices to be paid into a specific account. We realised ...
0
votes
0answers
58 views

Where is the ID chip in this card?

I recently attended a Salesforce World Tour. As part of being identifiable and being marketable you get this ID card that the exhibitors scan, so that they can get your name, company, email and ...
1
vote
1answer
656 views

Implicit flow login from SPA

Looking at the implicit flow to login with https://github.com/IdentityModel/oidc-client-js and https://github.com/IdentityServer/IdentityServer4.Samples/tree/release/Quickstarts/7_JavaScriptClient . ...
3
votes
2answers
105 views

Should passwords and challenge questions & answers be migrated?

I am currently working on the migration of a user Identity and Access Management tool from a legacy platform (product + solution) to a new one (same product but upgraded + updated solution) My team ...
0
votes
0answers
37 views

Multi-factor authentication for web requests that preserves identity

I'm trying to determine how multi-factor authentication (e.g., fingerprints, iris scans, voice recognition, etc.) can be used to authenticate users to web servers within an organization while ...
0
votes
0answers
87 views

Requiring e-mail from user when using ASP.NET Identity password reset features

I am implementing ASP.NET Core Identity with IdentityServer4. One feature is password reset, and I found that all the examples (e.g. the IdentityServer4 quick start and the ASP.NET Identity example) ...
5
votes
1answer
207 views

Why would a stranger keep signing up to trading sites with my email address?

I have read the answer below and understand that there is not much I can do about the basic problem of somebody signing up for newsletters and online services using my email address: Someone used my ...
1
vote
0answers
160 views

Mobile Device identification best practices

When mobile app connects to back-end and requests the data, back-end should be sure that requestor is one it pretends to be. So, we need some way to securely identify the app on a device. While ...
4
votes
1answer
140 views

Accessing over a VPN both sites that know your real identity and sites you want to stay private from

Goal 1: access certain "anonymous" sites that you don't want to provide your real identity, IP or location to. Goal 2: access "regular" sites that do require or have your real identity, such as your ...
-1
votes
1answer
120 views

Site asking for driver's license when buying items

I recently made a purchase on a website that asked for my Drivers license or government ID. I gave them a Drivers license photo I covered my license number and DD number but the license number can be ...
-4
votes
1answer
112 views

How to verify the identity of a person with 100% certainty? [closed]

Nowadays there are lots of security things, eg: Digital signatures Certificates One Time Password devices like those used in home banking system But no one gives you the possibility to verify ...
7
votes
5answers
2k views

How to protect myself online from the government? [closed]

I need something trusted and secure. I need to make “onion layers security” with the most secure and hard to hack/crack software. How to protect yourself from the government on the internet? I’m ...
3
votes
1answer
21k views

What can be done with the last 4 digits of one's SSN [closed]

If a hacker were to get the last 4 digits of your SSN (and maybe some other info like name, etc), what could they do? To avoid the possibility that they could guess the other digits from date/...
1
vote
2answers
68 views

Are Amazon AWS instanceIds security sensitive?

For troubleshooting, it's useful to include HTTP response headers that indicate proxy and backend EC2 instance ids, such as: X-Backend: i-8af67c92e0f3d89b6b X-Via: i-5b8146e7102940c75b-us-east-2b Is ...
0
votes
1answer
45 views

How do I get unique users signed up? [Canada or US] [closed]

Clients can win prizes on service and our team has to check their identity before giving prizes to them. Is there any way to collect photo ID while people signing up? Is it legal? Or there is some ...
1
vote
2answers
173 views

What is the safest way to identify a device without human action please?

I want to allow users of our website to restrict access to their account from devices they have explicitly authorized. This will be checked at the connection and each time the IP address changes. To ...
1
vote
2answers
93 views

Job Website Identity Verification

I signed up for work at a Job Website so I can do some freelance web development. They have an option where you can verify you are a US citizen so you can apply for jobs that people asked for US ...
5
votes
1answer
410 views

Can a Bitcoin Seller steal my Identity?

I was trying to buy some bitcoins on https://localbitcoins.com. However, the seller was looking for a copy of my ID and a photo of my debit card (long number covered). I'm curious as to how open ...
4
votes
2answers
403 views

Examples of Federated Identity Management, Third Party Identity Services and Single Sign-On

I am studying the domain of Identity and Access Management in CISSP, and I come across the three terms Federated Identity Management (FIM), Third Party Identity Services (3PIS) and Single Sign-On (SSO)...
1
vote
1answer
2k views

Gave scammers my name, date of birth, … What now? [duplicate]

I was contacted on a world wide exchange and chat site, on which the contactor (disguised as a normal, friendly person) wanted to be friends. They gave me their mail address. In their first e-mail ...
4
votes
1answer
176 views

Gravatar - Is it a security risk for medical forums?

If site forums use Gravatar, and the users are predominantly posting personal information about mental health issues, is this a security risk? Should the site consider turning off, or allowing opt ...
2
votes
0answers
71 views

Security implications of owning a German electronic ID card

I am German and about to renew my ID card. Since around 2010, the new ID cards contain an electronic chip that can be used for e.g. online authentication. If I understood the documentation correctly,...
2
votes
1answer
310 views

Is there a risk with making my Device ID public?

When making a mobile app with ads, I am required to register my test phones as test devices by providing the Device ID. These Device IDs are unique to an individual phone. Is there any risk with ...
1
vote
4answers
1k views

Is it possible for someone to see under the “blacked out” part of this image (see below)?

Ok, so I sent some pictures to a journalist to report something I thought was noteworthy. However, one of the images contained my date of birth and other personal information so I blacked it out ...
3
votes
3answers
201 views

How to prove a user is actually the perpetrator of certain actions?

TL;DR : What is the best and most "by the book" way to accheive non repudiation of origin. I have a system in which users can perform actions (register/unregister/...) Those actions are signed by my ...
3
votes
1answer
246 views

Why is callerID spoofing not possible when using short codes?

The question is already in the headline: Why is callerID spoofing not possible when the destination number is a short code? Here for example the answer to the question if callerID spoofing is still ...
1
vote
2answers
285 views

How can apps deal with phone number recycling/reassignment when sending password resets?

Instagram lets users sign up with their phone number (verified by a pin sent via text), a username and password. Should you forget your password, you can request a link sent via text to your phone, to ...
1
vote
2answers
96 views

How to Verify the identity of another computer

So I'm building an application that is designed for sharing files across a local network, and eventually across the Internet. I want to have a system for verifying the identities of computers, ...
1
vote
0answers
111 views

What is the target hash for a certain security level in TeamSpeak 3? [closed]

In the VoIP software TeamSpeak 3 there are "security levels" to proof someone's identity. According to [this question][1], it is based on the proof-of-work algorithm Hashcash, generating hashes of a ...
2
votes
3answers
219 views

How to prove my identity by GPG signature on a file?

It's a common need to prove that a file is truly created by someone, and I think GnuPG did the job. However, anyone can generate a gpg key with an unverified email. GPG key servers doesn't verify my ...
0
votes
1answer
1k views

Could revealing your full name on the internet be dangerous? [duplicate]

Apparently I can't find an answer to this on the internet, maybe because it's an obvious answer but still. Is there a reason to keep your full name disclosed on the internet?
4
votes
2answers
268 views

Passing user identity to an internal REST service

I have two services - A and B - which both expose a HTTP/REST API. Service A is exposed to the public and authenticates its users. It delegates part of the workload to service B which also has to know ...
1
vote
1answer
44 views

Verification methods of IDP in SAML2 IDP initiated login

What are the methods we can use to verify Identity Provider in Identity Provider initiated login in SAML2 Single sign on (SAML2 SSO)? Can any one who has access to IDP private key are able to create a ...
0
votes
0answers
218 views

How to verify identity of a person and prevent fake identities from being accepted?

I have a question regarding how to best identify a person/customer, verifying that who they say they are is really that person. I work for an insurance organization, where customers purchase insurance ...
3
votes
3answers
571 views

Why doesn't a cookie persist across different machines?

I am running Chrome with a specific --user-data-dir on removable storage that allows me to maintain a single browser session on different machines throughout the day (history, bookmarks, extensions, ...
3
votes
1answer
86 views

Computer identity still recognised after reinstall

I bought a second hand laptop from a guy called Marcus. It had Win 10 on it but I immediately installed a new SSD drive and loaded Linux Mint. I was surprised when I visited a cafe to find that it ...
3
votes
2answers
304 views

How to secure a digital ID from being faked?

We're trying to create a digital ID to replace UK Passport/driving licences for entry into licensed premises, but need to ensure it cannot be faked (or failing that, the barrier to faking it needs to ...
0
votes
1answer
19 views

Preventing unauthorized key-listings

I just noticed that anyone who has root access to my computer can list the keys in my keyring. He would not be able to use any of my private keys without knowing the passphrase, but he could examine ...
2
votes
1answer
1k views

Spoofing the identity of another user in Telegram

In telegram you can setup a unique public username which is available to anyone in the search option, but if you choose not to do that, the only way someone can identify you is by the name you set (ex....
35
votes
7answers
7k views

Could governments and banks become CAs?

When you apply for a passport, driver's license, home mortgage, bank account, credit card, etc., the issuing organization must verify your identity. In the course of doing so, would it be feasible for ...