Identity is the property of an object which allows it to be uniquely specified.
-3
votes
0answers
57 views
MAC spoofing is considered legal - But why IMEI/MEID spoofing isn't? [closed]
I see many people spoofing MAC address for personal use.
But when I search for spoofing IMEI/MEID of a device there are so many people screaming that I should not do it whatever the reason is. What ...
0
votes
1answer
41 views
Drawbacks of using ADFS for SSO for external users
Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
3
votes
1answer
67 views
Generating token for email validation and registration security
My boss gave me a list of 8K users in csv format and asking me to create accounts for them. The list have users with gmail, hotmail, and organization email addresses.
I am using MVC 5 and ASP.NET ...
2
votes
1answer
37 views
SAML Assertion to Windows Identity (Kerberos token?) transformation
This is the scenario I need to cover:
A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
-1
votes
1answer
115 views
Gmail disclosing your account name to recipients? [closed]
My Gmail setting has forever been set to send emails with just my Gmail address as the identifier, so it should not send out my account name (first or last name)... or so I thought!
Recently I got a ...
2
votes
0answers
24 views
What are proper security precautions when enabling multiple connected social accounts or login/authorization methods?
It is popular today for frameworks and social sites to enable multiple authorization options when creating websites. For example, allowing a user to login with GitHub, Twitter, Facebook, etc. In ...
0
votes
0answers
19 views
How does WebID fit in the SAML picture?
How does WebID fit in the SAML picture? Are they related or completely unrelated? Can they work together? If yes, what are the benefits?
3
votes
5answers
208 views
Can we have https without certificates?
I apologize in advance if I am fundamentally misunderstanding something, but is it possible to have encrypted communication protocols (https, I suppose) without resorting to a certificate system?
...
5
votes
1answer
72 views
User IDs containing URIs
When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional).
This format (Name (Comment) ...
23
votes
2answers
4k views
Why do I need to hide my phone's IMEI
If it is a secret then why is it visible on the box, invoice and the back of the phone?
If it is not a secret then why does it have to be blurred when it gets posted online?
1
vote
5answers
132 views
Is there a term for Authorizing before Authenticating? Is it even common?
In most scenarios a person identifies who they are (authentication/AuthN) via something like a username and password. Afterwards a system would likely evaluate what that validated identity can perform ...
-7
votes
2answers
131 views
Person has no persona on the internet yet runs a business [closed]
Original Question:
There is this older person (60+yrs) who is runs a business with internet presence yet when I do am internet search on him nothing pops up, not even photos!! How do I find out if he ...
3
votes
4answers
148 views
Lock a website login to a certain computer
I've got a web based system where a specific site only shall be available on a certain computer. On that computer I have a desktop application. The desktop application and the website communicate ...
3
votes
2answers
53 views
What is the name for “imperfect” verification options?
Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the ...
1
vote
2answers
67 views
Having a consistent “dont reveal email addresses of members” policy [duplicate]
Developers are dogmatic on having "invalid username or password" on login screens; our applications should not reveal if somebody is a member given an email address.
But there are two other ways our ...
4
votes
0answers
220 views
Ensuring an HTTP request is coming from my program
Is there a way to ensure that an HTTP request to my REST server is coming from my application? I'm guessing no because whatever I do on the client side, as people have access to that code, they can ...
3
votes
3answers
194 views
Best practices for GPG user ids
What is the best practice for choosing GPG user id(s)?
I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because ...
0
votes
2answers
110 views
Encrypting using the private key in Identity-Based Cryptography
In normal asymmetric crpyto like RSA, if Alice encrypts something using her private key, Bob can decrypt it using Alice's public key. Is the same possible in Identity-Based Cryptography, where the ...
4
votes
5answers
111 views
How can I verify that an organization is what they say they are online?
I'm creating a website that only allows nonprofits and government organizations (parks, etc) to sign up and post service project listings. The accounts posting the listings must be verified to protect ...
5
votes
2answers
857 views
Appropriate response to 2014 Russian Security Breach (CyberVor)
The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
3
votes
2answers
148 views
How to prove flyer was (not) authored by specific person?
Let's say we create a flyer in some desktop publishing software (e.g., InDesign, Illustrator), physically print it and post it somewhere.
We don't want inauthentic claims of authorship.
Is there a ...
0
votes
4answers
96 views
Recommendation for identity system
I want to develop a system, something like a comment system for a website, that ensures I know who is posting comments. The content that is exchanged is not valuable and does not need to be encrypted, ...
3
votes
3answers
851 views
What are some cards that are vulnerable to RFID theft?
I heard that some credit cards are vulnerable to RFID scanning and thus identity theft. I am concerned about my cards and I would like to learn which cards are vulnerable to such abuse? Are any of ...
6
votes
4answers
1k views
Is 'Bring your own Identity' as the only authentication option a valid practice?
This question is mainly aimed at OpenID Connect, when it is fully realized.
I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
1
vote
2answers
62 views
A manual function for hasing identity?
I hope you won't close the question. Even though there are no computers involved, it is still about information and security, and I think that security experts are the ones who will be able to help ...
0
votes
2answers
162 views
Why do file storage sites have a long unique id for their download links?
I'm creating a file storage site and what I would do is just have the download links format as:
https://www.domain.com/[id]/[file name] //id would just be 1, 2, 3 etc.
Dropbox and many others have ...
1
vote
1answer
178 views
Passport copy is being used to defraud others - what can I do?
I was an idiot and sent my passport and address to a scam artist I was hoping to rent an apartment from abroad. Luckily, I realized the trickery before sending anything else or any money. ...
43
votes
3answers
8k views
Paypal sent an email addressing me with one of my old passwords as my name
I got this email from service@intl.paypal.com, with the title:
Your account has been limited until we hear from you.
I think this is a scam / spoof email because I don't see any notification in my ...
0
votes
2answers
41 views
Is there any mail service accepting real id? [closed]
Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address.
If there is a security breach, user may lost important information on that address. They may add phone ...
1
vote
1answer
76 views
Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?
Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
1
vote
2answers
126 views
Should every SAML identity provider provide a unique public certificate to the service provider?
When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
0
votes
2answers
67 views
Is there a way to prevent software from accessing hardware IDs?
I think this is related to this question, but I would like to know if there's also a way to prevent "third party" applications from seeing hardware IDs (motherboard, hard disks, and others), or giving ...
0
votes
1answer
155 views
Is it safe to recycle unshredded credit card receipts?
Is it safe to recycle unshredded paper credit card receipts? Can identity theft be helped by data disclosed on most vendor's receipts?
2
votes
3answers
7k views
Someone keeps using my email address. What to do?
I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with.
Since I'm not going to post my email address ...
3
votes
3answers
89 views
Way for two parties to establish that they are not previously known to each other
(Sorry if this isn't in the right SE / is not relevant for security.stackexchange - seemed like the best choice)
Is there a way for two anonymous parties to establish that they are not previously ...
2
votes
2answers
128 views
Is it possible to make a “proof of anteriority” for sites content?
Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
3
votes
2answers
453 views
When using private browsing can a website view data stored before private browsing was turned on?
If a browser has been used to visit a few sites and has active logins and then the user turns on private browsing, can the sites still access data such as cookies and cached files that were created ...
0
votes
2answers
2k views
How to prevent other hosts on the same LAN from seeing my IP and host name?
I want to hide my computer IP dan hostname when I am online on the same LAN on which other computers running netcut and other network tools. I have installed netcut defender but it seems not to hide ...
12
votes
2answers
4k views
Role Based Authorization vs. Claim Based Authorization
What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
1
vote
3answers
757 views
Can Paypal be used to verify a user's identity?
As I use my Paypal account for various online services, I noticed that vendors integrate differently with Paypal for on-demand payment, and scheduled payments.
I also noticed that Paypal offers a ...
1
vote
1answer
189 views
How does IIS persist identity credentials? Does it create any security issues?
We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
3
votes
1answer
220 views
pro and cons of having 2 Identity providers
My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and ...
17
votes
1answer
311 views
What's this kind of authentication scheme called?
In the past I've heard about a scheme to prove your identity online in places like forums, without having to create an account.
When posting, the user would enter a password which is then heavily ...
6
votes
2answers
1k views
Best Practices for verifying a users identity for helpdesk
I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted I know these ...
9
votes
11answers
5k views
Besides IP addresses, how else could one be identified? [closed]
OP:
I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the ...
2
votes
2answers
22k views
Spam that comes from names in my address book, but not their email addresses
I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be.
Specifically, the names -- but not the email ...
2
votes
1answer
115 views
Where can I find articles about identity disclosure attack?
Where can I find more details about identity disclosure attack and it's prevention?
If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
5
votes
1answer
483 views
Are there risks of using the same OpenID provider for sites with different security levels?
I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
13
votes
3answers
27k views
Can law enforcement track a criminal through dynamic IP address?
I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
25
votes
3answers
1k views
A Different Approach to PKI
After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
