Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [identity]

Identity is the property of an object which allows it to be uniquely specified.

Filter by
Sorted by
Tagged with
1 vote
2 answers
153 views

Do predictable bank account numbers pose a vulnerability?

Let's say my significant other and I go to the bank to open our accounts and our account numbers end up 14682-4 and 14683-5. They are clearly sequential. Can this detail be used in any sort of attack?
Capi Etheriel's user avatar
0 votes
0 answers
150 views

Showing a license/id to a shopping website, worth it? [duplicate]

I'm wondering if anyone here has ever decided to show their driver's license or ID of any sort to be able to shop at a website. I was personally asked to do this along with a facial verification. I ...
skept1ca1's user avatar
1 vote
1 answer
125 views

Prove The Identity of Author Using GPG On Demand

Given a situation where I want to be anonymous by default, how can I use GPG to prove that I'm the original author once, on-demand, and for a specific user?
SReza S's user avatar
  • 13
1 vote
1 answer
100 views

interchangeable IDs for login under PCI DSS like Facebook and Twitter

Is using multiple interchangeable IDs a PCI DSS complaint? Facebook and Twitter uses the same method for sign in. multiple interchangeable IDs such as sign in with email or mobile or username.
HM107's user avatar
  • 113
0 votes
1 answer
110 views

Using fingerprints everywhere to identify at physical, ID required, places

I was wondering why people can't just use fingerprints to retrieve all necessary documents where required. What would be the problem with such form of authentication, which could be used via ...
Joselin Jocklingson's user avatar
4 votes
1 answer
214 views

Is there any benefit to normalize unicode/utf-8 names that I am overlooking?

Reading how Spotify was normalizing unicode inconsistently, and now I'm questioning if I am overlooking any issue on accepting non-normalized usernames. From what I can tell, lowercase was first used ...
gcb's user avatar
  • 233
6 votes
5 answers
3k views

Are SHA-256 hashes of user emails guaranteed to be unique?

I'm working on a website that will require users to insert a valid email address, which will work as their unique user id. This email will not be used for communicating with the user, it is only ever ...
Tommy's user avatar
  • 533
1 vote
0 answers
103 views

How can I get & keep an unauthorized user out of my network? [closed]

I have replaced hardware, equipment, and passwords. I think they are in Yahoo, Microsoft, phone, and laptop. I have changed all with no success. They use my identity as the temporary ID from Microsoft ...
Kindrea Vance's user avatar
1 vote
1 answer
108 views

What are the security risks of only using an id in the url to protect the content?

I'm building a note-taking app, when a user writes a note an id is generated and I redirect them to a page where they can see its content with a URL like /note/DXSt832pS5iLuos6uxBn. What are the ...
Hugo's user avatar
  • 123
0 votes
1 answer
95 views

Questions on user context and auditing for background job execution for SaaS application

I have some questions related with user context and auditing for background job execution for SaaS application. Let's say an admin user scheduled a background job through UI. When the job start ...
user1024888's user avatar
1 vote
1 answer
136 views

How can websites fingerprint the company I work for?

During my work day, I came upon a website that had a popup that identified the company I work for(basically saying "contact us X company"). This website was never previously visited, cookies ...
Joe's user avatar
  • 11
2 votes
1 answer
778 views

OAuth 2.0 POST to Authorization Endpoint

The OAuth 2.0 specification states: The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST&...
Cochise Ruhulessin's user avatar
1 vote
1 answer
95 views

Security aspects in SAML2 using configuration with metadata URI

I have an app where I may choose to configure SAML2 login in the app with: Public cert of IdP IdP SAML2 login URL IdP entity ID I may also choose to, instead, provide an HTTPS metadata URL from ...
fast-reflexes's user avatar
3 votes
0 answers
331 views

Auth0 token exchange vs Google Firebase token exchange

I'm researching our options for securing access to a single-page web app and a mobile app. The apps communicate with a REST API which, based on the authenticated user's identity, will return ...
DrPep's user avatar
  • 131
1 vote
0 answers
125 views

Compiler that adds machine info to binary

Wanted to ask if there is any compiler (any known programming language) that is actually encoding machine data into binary, so it is possible to detect the machine where the program has been compiled (...
Bojan Vukasovic's user avatar
0 votes
0 answers
184 views

Can a remote user (logged into my computer via LogMeIn) capture my password as I log into a website?

I work for a large company with IT support that uses LogMeIn to take control of our PCs when troubleshooting. Today while being assisted I was asked to log into an internal website during a LogMeIn ...
Michael In The Mountain's user avatar
0 votes
0 answers
245 views

How can one avoid being identified by facial recognition in a public setting?

Facial recognition is ubiquitous and methods like disguises, surgical masks and makeup are becoming ineffective owing to the improvement in algorithms. In light of these advances, what are some ...
CSLewis's user avatar
1 vote
3 answers
256 views

Use-case for decentralized identifiers (DIDs) with unique identities for each relationship

The W3C working group is working on the standardization of Decentralized Identifiers (DIDs). I watched a video presentation about DIDs and the presenter mentioned several times the possibility of ...
DurandA's user avatar
  • 127
2 votes
0 answers
354 views

Send a Picture of my ID and a selfie of me holding it to a Questionable Website

Some website asked for the verification of my identity to make a purchase of online goods. I didn't think twice and send them a picture of both sides of my country's ID (not USA) and a selfie holding ...
Figaro's user avatar
  • 21
1 vote
1 answer
141 views

How is identity implemented?

When I join an organization or create a Gmail account, I am given an identity. What does the organization do to create my identity? Does it just create new pair of public key and private key? I tried ...
pnvn's user avatar
  • 225
1 vote
1 answer
238 views

Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?

To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
Ethan's user avatar
  • 115
0 votes
0 answers
106 views

Can hardware identifcation be evaded/spoofed?

If I'm not wrong, one of the many ways companies track and collect data of people through the internet is by identifying their hardware. Getting the monitor resolution, figuring what CPU it is, etc. ...
Cipher Visor's user avatar
5 votes
1 answer
3k views

Should or shouldn't I show a serial number, MAC address and other product ID when I sell it online?

I want to sell online some of the electronic stuff that I don't need anymore, such as my ASUS Wi-Fi router, and I'm wondering when I upload photos of it should I leave its serial number, MAC address, ...
Trueman's user avatar
  • 51
0 votes
1 answer
125 views

Validate that Web Service is authentic

If I have a web service (REST API, RPC, etc) that I open source, how can I prove to the user that the service they are connecting with is indeed the same one whose source I published. I am envisioning ...
user avatar
0 votes
2 answers
177 views

What are the risk of providing identity in my application, rather than using a provider?

In our multi tenant SaaS software application we intended to use Microsoft Identity Platform (Azure AD) for user authentication and providing the claims for authorization within the application. We ...
Superman.Lopez's user avatar
1 vote
2 answers
376 views

Verifying the security of SAML SSO

I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
eden881's user avatar
  • 237
1 vote
2 answers
149 views

Identification through digital signature. How safe is it?

Let's say I want to give some data to Bob. I have his public key. I tell him to generate a digital signature for text "{some_stuff: 1, nonce: 2}". After he does that and after I verify it's ...
Tomas 's user avatar
  • 13
4 votes
2 answers
664 views

Are there security reasons for prohibiting universal mac address modification?

Background In a standard 48-bit MAC address, the 7th (most significant) bit specifies whether it is a universally-administered address (UAA) or a locally-administered address (LAA). If it is 0, then ...
ManRow's user avatar
  • 425
3 votes
1 answer
252 views

Randomly generating invoice IDs

I'm in the process of setting up a local (i.e. offline and very limited) business, and I'm thinking of generating invoice IDs randomly to avoid the clients knowing that they're customer number #...
Hashim Aziz's user avatar
1 vote
1 answer
373 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
stckvrw's user avatar
  • 127
16 votes
3 answers
3k views

What is the difference between the many identifiers in GnuPG?

GnuPG seems to have number of different ways to refer to a (sub)key(pair): Key IDs Fingerprints Keygrips Additionally, gpg --list-sigs seems to show hexadecimal identifiers for signatures and such ...
jotik's user avatar
  • 311
1 vote
1 answer
461 views

What is the best way to verify email address or phone number during call centre sale?

My company sells products through calls. During the calls a customers PII is collected and used to create the product. This PII includes email. After the product is created, we email the customer a ...
Johnny Donalistic's user avatar
5 votes
2 answers
1k views

Can name and date of birth be hashed somehow to generate a secure identifier?

I'm working on a project which we intend to launch for developing countries, and, as a result, want to limit the amount of information needed for login and identification, while still maintaining ...
Yakko Majuri's user avatar
1 vote
1 answer
148 views

Possible to verify someone is a real person without direct connection?

I think the following is not possible, but I have no proof and would like to find out wether it is possible or not. Let's say in a network, every participant cannot connect to each other participant ...
Marvin's user avatar
  • 11
0 votes
1 answer
106 views

Proving a software deployment's origin sourcecode [duplicate]

Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL? sourcecode from commit #10020 at ...
Daniel W.'s user avatar
  • 267
0 votes
1 answer
2k views

Sending credit history report to potential landlord

I have a credit report from TransUnion that contains: My real name, current and past addresses Current and past credit card accounts, last 12 monthly balances and payments My past mortgage Past ...
yurnero's user avatar
  • 103
1 vote
2 answers
1k views

Handling of 3rd party OAuth2 tokens

after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
johannespartin's user avatar
0 votes
1 answer
256 views

How did a website make an accurate assumption of my identity in incognito mode? [duplicate]

What piece of information can websites retrieve that would allow for later identification without cookies? Intro Out of interest I jumped into the rabbit hole of online marketing scams. The site I ...
M.G.Poirot's user avatar
-1 votes
2 answers
2k views

Uniquely identify each mobile phone of Android 10 / 9 and below

Background: I have an Android APP with millions of users, but some users are malicious users (robot, fake, privilege escaped, etc). The common solution is to detect & block those "bad" accounts ...
TJCLK's user avatar
  • 838
4 votes
2 answers
563 views

Could you store your passwords in a phone app governed by a QR code?

I had an idea a little while back to have an ID card with a QR code on it that you kept in your wallet. When you want to access your passwords (view them directly), you need your ID card and to scan ...
Lance's user avatar
  • 632
1 vote
2 answers
2k views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
Jerreck's user avatar
  • 121
3 votes
3 answers
300 views

Is there anything like a standard GUID to identify a PC?

I am asked about my opinion in a case as follows: Someone visited a (totally legal, in fact US government) website A and identified themselves. At a very different point in time they - allegedly - ...
Hagen von Eitzen's user avatar
2 votes
0 answers
138 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
Basj's user avatar
  • 953
3 votes
3 answers
451 views

How to Prove you created Intellectual Property (IP) using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
Lance's user avatar
  • 632
2 votes
1 answer
409 views

Samba and verifying server identity

Suppose that I have two Windows 10 (Professional edition) computers, one (PC) sharing a folder and second one (notebook) copying data to the shared folder automatically. I would like to prevent ...
oldium's user avatar
  • 23
2 votes
2 answers
205 views

Is there any way to alter a caller's voice just enough to make voice recognition impossible?

I did search and found this post: Is it possible to identify mobile phone user with voice recognition It does not answer my question, however. Is there any way to alter a person's voice just enough ...
Paranoidone's user avatar
7 votes
1 answer
630 views

Is there any privacy- or security-relevant difference between FIDO2 and SQRL

I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme. Both seem to use the same key elements: a private, user-resident "master key" ...
Marcel's user avatar
  • 4,083
4 votes
1 answer
221 views

How can I challenge an attacker to reliably identify their hardware? [closed]

I distribute a client application where I would like to identify a user's hardware specifications when they begin interacting with my server. I am specifically interested in identifying the user's GPU ...
Tim Clancy's user avatar
1 vote
5 answers
385 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
TroySteven's user avatar
  • 1,339
1 vote
1 answer
3k views

Identifying devices in mobile app using UUID

I have a mobile application, for Android and iOS (both native), that communicates with the backend through a REST API (over HTTPS). The application allows users to sign in or use the app as a guest, ...
blejzz's user avatar
  • 111

1
2 3 4 5