Identity is the property of an object which allows it to be uniquely specified.
0
votes
2answers
21 views
Is there any mail service accepting real id?
Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address.
If there is a security breach, user may lost important information on that address. They may add phone ...
1
vote
1answer
42 views
Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?
Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
1
vote
2answers
34 views
Should every SAML identity provider provide a unique public certificate to the service provider?
When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
0
votes
2answers
46 views
Is there a way to prevent software from accessing hardware IDs?
I think this is related to this question, but I would like to know if there's also a way to prevent "third party" applications from seeing hardware IDs (motherboard, hard disks, and others), or giving ...
0
votes
1answer
40 views
Is it safe to recycle unshredded credit card receipts?
Is it safe to recycle unshredded paper credit card receipts? Can identity theft be helped by data disclosed on most vendor's receipts?
2
votes
1answer
206 views
Someone keeps using my email address. What to do?
I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
3
votes
3answers
79 views
Way for two parties to establish that they are not previously known to each other
(Sorry if this isn't in the right SE / is not relevant for security.stackexchange - seemed like the best choice)
Is there a way for two anonymous parties to establish that they are not previously ...
2
votes
2answers
103 views
Is it possible to make a “proof of anteriority” for sites content?
Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
2
votes
2answers
231 views
When using private browsing can a website view data stored before private browsing was turned on?
If a browser has been used to visit a few sites and has active logins and then the user turns on private browsing, can the sites still access data such as cookies and cached files that were created ...
0
votes
2answers
844 views
How to prevent other hosts on the same LAN from seeing my IP and host name?
I want to hide my computer IP dan hostname when I am online on the same LAN on which other computers running netcut and other network tools. I have installed netcut defender but it seems not to hide ...
8
votes
2answers
1k views
Role Based Authorization vs. Claim Based Authorization
What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
1
vote
3answers
338 views
Can Paypal be used to verify a user's identity?
As I use my Paypal account for various online services, I noticed that vendors integrate differently with Paypal for on-demand payment, and scheduled payments.
I also noticed that Paypal offers a ...
1
vote
1answer
141 views
How does IIS persist identity credentials? Does it create any security issues?
We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
2
votes
0answers
114 views
pro and cons of having 2 Identity providers
My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and ...
16
votes
1answer
291 views
What's this kind of authentication scheme called?
In the past I've heard about a scheme to prove your identity online in places like forums, without having to create an account.
When posting, the user would enter a password which is then heavily ...
6
votes
2answers
421 views
Best Practices for verifying a users identity for helpdesk
I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted I know these ...
8
votes
11answers
2k views
Besides IP addresses, how else could one be identified? [closed]
OP:
I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the ...
1
vote
2answers
8k views
Spam that comes from names in my address book, but not their email addresses
I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be.
Specifically, the names -- but not the email ...
2
votes
1answer
98 views
Where can I find articles about identity disclosure attack?
Where can I find more details about identity disclosure attack and it's prevention?
If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
5
votes
1answer
336 views
Are there risks of using the same OpenID provider for sites with different security levels?
I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
13
votes
3answers
12k views
Can law enforcement track a criminal through dynamic IP address?
I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
24
votes
3answers
934 views
A Different Approach to PKI
After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
5
votes
2answers
253 views
Single vs multiple personas? What are the security implications?
I have two email addresses, one for work and one for home. I have have two cellphone numbers, one for work and one for home. But I am just one individual (and only have one social security number ...
-1
votes
1answer
2k views
how to trace the IP address of gmail account sender via browser [duplicate]
Possible Duplicate:
How to trace email?
i wanted to know the location of sender email which sent us the threat email the header of email is mentioned below
Analysis:
Received: from ...
7
votes
1answer
156 views
How can I limit the consequences of a possible future identity theft?
I am curious about how I can limit the consequences of an identity theft. I see a lot of discussion and advice about managing passwords securely or blocking malware. But what if it happens?
What if ...
4
votes
1answer
783 views
UPS my choice — How can I access my public records?
I was signing up for UPS my choice and they asked me some security questions.
It asked me questions that signified that it was able to figure out:
Who my father is and when my father was born.
My ...
3
votes
3answers
172 views
How to know if its the same User?
I asked a question awhile ago asking how to make an efficient encrypted chatroom. What I ended up doing was Making each user generate a 4096 bit RSA KeyPair, share their public Keys, and then one of ...
3
votes
1answer
150 views
What are the benefits of federated identity management over bare bones public key encryption?
What are the main reasons for having a federated identity system such as OpenID over having identities based purely on a public key?
OpenID uses an Identity Provider to confirm that a user owns a ...
17
votes
6answers
2k views
How to verify that someone is who they say they are online?
I am working on an online job application web app and the question has come up about how we will verify that someone submitting an application is who they say they are.
For example, we don't want ...
10
votes
2answers
6k views
Best Practice: “One per-user ssh key” or “multiple per-host ssh keys” [duplicate]
Possible Duplicate:
What’s the common pragmatic strategy for managing key pairs?
I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when ...
2
votes
2answers
1k views
How Is It Possible For Hackers To “Dig Up The Dirt” On People?
Like the title says, I was wondering how its possible for hackers to "dig up the dirt" and get peoples personal information such as address, credit cards, bank accounts, social insurance number, etc? ...
4
votes
2answers
133 views
What bad things could an “attacker” do with my stolen ID's?
So if someone steals my (ex.: I didn't teared up a piece of paper that had these and I throwed it away on the street) ID's like my:
Full name
Permanent address
Birth date/place
My mothers name
...
2
votes
3answers
223 views
Verify if person belongs to the claimed university through his university email id
I need to allow users access to an application after verifying that they belong to the claimed institute through university email id. So that if a person claims that he belongs to Stanford University, ...
4
votes
4answers
4k views
Bank account number and account holder in check exposed?
I'm not sure if this is standard practice in all banking institutions but almost all banks where I've received checks the account number of the issuer is exposed (some even the account name). Isn't ...
0
votes
4answers
998 views
Does Facebook merge accounts? In what circumstances? [closed]
I have two different Facebook accounts with two different passwords and two distinct online personalities, one as myself and one as someone else. Since the last one week, to my horror, both accounts ...
3
votes
3answers
1k views
How secure can IP based login be?
From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. Our idea is not new: we want a one-time validation and ...
0
votes
1answer
978 views
What are the potential vulnerabilities in a SAML-based SSO approach?
What level of access would an attacker need to obtain to compromise a SAML-based SSO system?
Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
0
votes
2answers
165 views
Verifying users location & authenticity
I am builduing a business to business website, and users are able to sign up with a personal profile and create a business (like linkedin).
I need to verify the following:
Business Name
...
10
votes
3answers
4k views
Why would someone register a Facebook account with a stolen email address?
I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
3
votes
4answers
912 views
Can SMS text messages be used to verify a person's unique identity through a short code system?
We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: ...
0
votes
1answer
92 views
Encrypting important context vs data sets associated with context
I am looking for an example in the real world where only a portion of the entire data set is encrypted even though the entire data set is considered sensitive. Specifically the portion that gives ...
10
votes
2answers
255 views
How to protect against exploitation using a lapsed domain
Consider a domain that had been in active use for some time but is no longer desired — perhaps the company is out of business or a name change took place years ago, or whatever. The domain ...
11
votes
1answer
849 views
What encryption prevents the tampering of Windows Identity Foundation (WIF) FedAuth cookies?
It occurred to me that the WIF FedAuth cookies contain identity information, that if tampered with, could permit someone to assume the identity of another user. Fortunately, WIF does ...
1
vote
1answer
318 views
What does a Yadis / XRDS discovery session “look like” to the end user? How does it work? Is it relevant?
I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me ...
8
votes
2answers
1k views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
5
votes
3answers
598 views
Length of CSRF Token
Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
6
votes
1answer
2k views
Ways to sign gpg public key so it is trusted?
I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they ...
4
votes
3answers
483 views
Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]
Recently while trying to log-in to Facebook this notification starts to appear:
At first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website!
I ...
8
votes
5answers
296 views
How to verify new accounts against a known persons database?
I need to (try to) solve the problem of new account creation for a patient portal for a medical records system (electronic health record). That is, a way to activate a patient online and match her ...
6
votes
6answers
742 views
Secure Internet Polling
In the United States, there has been a lot of talk about creating a secure polling system that would operate over the internet. I have also heard that Securing a poll over the Internet is impossible. ...
