Questions tagged [identity]
Identity is the property of an object which allows it to be uniquely specified.
230
questions
0
votes
1
answer
23
views
OAuth 2.0 POST to Authorization Endpoint
The OAuth 2.0 specification states:
The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST&...
1
vote
1
answer
34
views
Security aspects in SAML2 using configuration with metadata URI
I have an app where I may choose to configure SAML2 login in the app with:
Public cert of IdP
IdP SAML2 login URL
IdP entity ID
I may also choose to, instead, provide an HTTPS metadata URL from ...
- 163
1
vote
0
answers
42
views
Auth0 token exchange vs Google Firebase token exchange
I'm researching our options for securing access to a single-page web app and a mobile app. The apps communicate with a REST API which, based on the authenticated user's identity, will return ...
- 111
1
vote
0
answers
87
views
Compiler that adds machine info to binary
Wanted to ask if there is any compiler (any known programming language) that is actually encoding machine data into binary, so it is possible to detect the machine where the program has been compiled (...
- 109
0
votes
0
answers
60
views
SVID vs DID: Secure Production Identity Framework for Everyone (SPIFFE) Verifiable Identity Document (SVID) vs Decentralized Identity (DID from DIF)
I am looking to secure production workloads with SPIFFE SVID. I am also looking at how workloads can be tied to decentralized identity (DID from DIF - https://identity.foundation).
Like to know if ...
0
votes
0
answers
59
views
Securing the SPIFFE (Secure Production Identity Framework for Everyone) SPIRE (the SPIFFE Runtime Environment) servers (a crown jewel)
How does one secure the SPIFFE (Secure Production Identity Framework for Everyone) SPIRE (the SPIFFE Runtime Environment) server given the importance of the SPIRE Server in authenticating and ...
0
votes
0
answers
91
views
Can a remote user (logged into my computer via LogMeIn) capture my password as I log into a website?
I work for a large company with IT support that uses LogMeIn to take control of our PCs when troubleshooting. Today while being assisted I was asked to log into an internal website during a LogMeIn ...
0
votes
0
answers
159
views
How can one avoid being identified by facial recognition in a public setting?
Facial recognition is ubiquitous and methods like disguises, surgical masks and makeup are becoming ineffective owing to the improvement in algorithms.
In light of these advances, what are some ...
- 1
0
votes
0
answers
82
views
How can you tell if an email is really from the address it claims it's from? [duplicate]
I am creating a basic website contact form. It requires entering a 'from' email address. I entered a dummy email address, which I do not control, yet the email is still sent, and, to the recipient, it ...
- 1,224
1
vote
3
answers
148
views
Use-case for decentralized identifiers (DIDs) with unique identities for each relationship
The W3C working group is working on the standardization of Decentralized Identifiers (DIDs). I watched a video presentation about DIDs and the presenter mentioned several times the possibility of ...
- 145
2
votes
0
answers
170
views
Send a Picture of my ID and a selfie of me holding it to a Questionable Website
Some website asked for the verification of my identity to make a purchase of online goods. I didn't think twice and send them a picture of both sides of my country's ID (not USA) and a selfie holding ...
- 21
1
vote
1
answer
97
views
How is identity implemented?
When I join an organization or create a Gmail account, I am given an identity.
What does the organization do to create my identity? Does it just create new pair of public key and private key?
I tried ...
- 225
1
vote
1
answer
194
views
Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?
To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
- 115
0
votes
0
answers
77
views
Can hardware identifcation be evaded/spoofed?
If I'm not wrong, one of the many ways companies track and collect data of people through the internet is by identifying their hardware. Getting the monitor resolution, figuring what CPU it is, etc. ...
- 82
6
votes
1
answer
927
views
Should or shouldn't I show a serial number, MAC address and other product ID when I sell it online?
I want to sell online some of the electronic stuff that I don't need anymore, such as my ASUS Wi-Fi router, and I'm wondering when I upload photos of it should I leave its serial number, MAC address, ...
- 61
0
votes
1
answer
96
views
Validate that Web Service is authentic
If I have a web service (REST API, RPC, etc) that I open source, how can I prove to the user that the service they are connecting with is indeed the same one whose source I published. I am envisioning ...
- 123
0
votes
2
answers
130
views
What are the risk of providing identity in my application, rather than using a provider?
In our multi tenant SaaS software application we intended to use Microsoft Identity Platform (Azure AD) for user authentication and providing the claims for authorization within the application. We ...
- 101
0
votes
0
answers
173
views
Risks of Providing a Passport Number
Company A pays company B for enterprise software. Company A hosts it internally. An employee from company B needs access to servers at company A in order to manage said software
Company A is ...
- 1,203
1
vote
1
answer
111
views
Verifying the security of SAML SSO
I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
- 237
1
vote
2
answers
116
views
Identification through digital signature. How safe is it?
Let's say I want to give some data to Bob. I have his public key. I tell him to generate a digital signature for text "{some_stuff: 1, nonce: 2}". After he does that and after I verify it's ...
- 11
4
votes
2
answers
363
views
Are there security reasons for prohibiting universal mac address modification?
Background
In a standard 48-bit MAC address, the 7th (most significant) bit specifies whether it is a universally-administered address (UAA) or a locally-administered address (LAA).
If it is 0, then ...
- 401
3
votes
1
answer
133
views
Randomly generating invoice IDs
I'm in the process of setting up a local (i.e. offline and very limited) business, and I'm thinking of generating invoice IDs randomly to avoid the clients knowing that they're customer number #...
- 933
0
votes
1
answer
147
views
Why to use username and password instead of just a long password? [duplicate]
Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user?
A simple example: On the server, we create a JSON file with user data ...
- 117
6
votes
3
answers
1k
views
What is the difference between the many identifiers in GnuPG?
GnuPG seems to have number of different ways to refer to a (sub)key(pair):
Key IDs
Fingerprints
Keygrips
Additionally, gpg --list-sigs seems to show hexadecimal identifiers for signatures and such ...
- 211
1
vote
1
answer
268
views
What is the best way to verify email address or phone number during call centre sale?
My company sells products through calls. During the calls a customers PII is collected and used to create the product. This PII includes email. After the product is created, we email the customer a ...
5
votes
2
answers
600
views
Can name and date of birth be hashed somehow to generate a secure identifier?
I'm working on a project which we intend to launch for developing countries, and, as a result, want to limit the amount of information needed for login and identification, while still maintaining ...
- 163
1
vote
1
answer
119
views
Possible to verify someone is a real person without direct connection?
I think the following is not possible, but I have no proof and would like to find out wether it is possible or not.
Let's say in a network, every participant cannot connect to each other participant ...
- 11
0
votes
1
answer
79
views
Proving a software deployment's origin sourcecode [duplicate]
Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL?
sourcecode
from commit #10020 at ...
- 267
0
votes
1
answer
255
views
Sending credit history report to potential landlord
I have a credit report from TransUnion that contains:
My real name, current and past addresses
Current and past credit card accounts, last 12 monthly balances and payments
My past mortgage
Past ...
- 103
1
vote
2
answers
309
views
Handling of 3rd party OAuth2 tokens
after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
0
votes
1
answer
189
views
How did a website make an accurate assumption of my identity in incognito mode? [duplicate]
What piece of information can websites retrieve that would allow for later identification without cookies?
Intro Out of interest I jumped into the rabbit hole of online marketing scams. The site I ...
- 101
-1
votes
2
answers
1k
views
Uniquely identify each mobile phone of Android 10 / 9 and below
Background:
I have an Android APP with millions of users, but some users are malicious users (robot, fake, privilege escaped, etc). The common solution is to detect & block those "bad" accounts ...
- 818
4
votes
2
answers
347
views
Could you store your passwords in a phone app governed by a QR code?
I had an idea a little while back to have an ID card with a QR code on it that you kept in your wallet. When you want to access your passwords (view them directly), you need your ID card and to scan ...
- 548
1
vote
2
answers
714
views
What is delegation, identity delegation, and delegated authorization, and what are the differences among them?
I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
- 121
3
votes
3
answers
215
views
Is there anything like a standard GUID to identify a PC?
I am asked about my opinion in a case as follows:
Someone visited a (totally legal, in fact US government) website A and identified themselves. At a very different point in time they - allegedly - ...
- 1,098
2
votes
0
answers
95
views
Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?
Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
- 941
1
vote
2
answers
169
views
How to Prove you created IP using a Notary
Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
- 548
1
vote
1
answer
234
views
Samba and verifying server identity
Suppose that I have two Windows 10 (Professional edition) computers, one (PC) sharing a folder and second one (notebook) copying data to the shared folder automatically. I would like to prevent ...
- 13
2
votes
2
answers
145
views
Is there any way to alter a caller's voice just enough to make voice recognition impossible?
I did search and found this post:
Is it possible to identify mobile phone user with voice recognition
It does not answer my question, however.
Is there any way to alter a person's voice just enough ...
- 21
5
votes
0
answers
328
views
Is there any privacy- or security-relevant difference between FIDO2 and SQRL
I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme.
Both seem to use the same key elements:
a private, user-resident "master key" ...
- 3,512
4
votes
1
answer
187
views
How can I challenge an attacker to reliably identify their hardware? [closed]
I distribute a client application where I would like to identify a user's hardware specifications when they begin interacting with my server. I am specifically interested in identifying the user's GPU ...
- 41
1
vote
5
answers
311
views
Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN
I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
- 1,309
0
votes
1
answer
1k
views
Identifying devices in mobile app using UUID
I have a mobile application, for Android and iOS (both native), that communicates with the backend through a REST API (over HTTPS).
The application allows users to sign in or use the app as a guest, ...
- 101
1
vote
1
answer
117
views
If only SP (or IDP) uses Shibboleth in its SAML implementation, can the systems still communicate?
I was reading about Shibboleth's metadata -- https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata#Metadata-Use(andnon-use)ofMetadata , and how it's used to identify IDPs and service ...
- 155
0
votes
0
answers
53
views
Checking authenticity of a mobile app (digital staff card) [duplicate]
I've been asked to implement a digital card for member's of our organisation, to replace the old plastic ones. Members would install our app on their phone and setup a "card" with their photo on it ...
- 101
2
votes
2
answers
127
views
What prevents an identity provider from falsifying authorization in a SAML 2.0 flow?
I'm confused about something in the SAML 2.0 flow. When the initial access to the service provider is made, the service provider must first validate that the user indeed has access and so the service ...
- 155
1
vote
2
answers
693
views
What's the point of a digital certificate for which no private key exists?
I am only using digital certificates to sign documents, and my understanding is that the correct flow is the following:
create a private key (e.g. using openssl)
create CSR using the previously ...
- 189
10
votes
1
answer
506
views
Is it possible to "reverse engineer" identicons?
As shown in this question, default user avatars (like mine) are identicons and are generated with the user's email (where provided) or the user's IP address (where the email is not provided).
Given ...
user203478
0
votes
1
answer
386
views
How is Privileged identity management (PIM) different from privileged access management (PAM)?
I am very confused about those two, I was trying to understand the difference but it all sounds the same from what I read online.
- 1,182
0
votes
1
answer
130
views
Data leakage in internet-only services
Nowadays, internet-only services became very popular, for example, direct bank and many others. The advantage of such services is you don't have to spend the time to get to the office in order to get ...
- 3