Identity is the property of an object which allows it to be uniquely specified.
2
votes
1answer
100 views
Someone keeps using my email address. What to do?
I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
2
votes
3answers
72 views
Way for two parties to establish that they are not previously known to each other
(Sorry if this isn't in the right SE / is not relevant for security.stackexchange - seemed like the best choice)
Is there a way for two anonymous parties to establish that they are not previously ...
2
votes
2answers
99 views
Is it possible to make a “proof of anteriority” for sites content?
Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
2
votes
2answers
167 views
When using private browsing can a website view data stored before private browsing was turned on?
If a browser has been used to visit a few sites and has active logins and then the user turns on private browsing, can the sites still access data such as cookies and cached files that were created ...
0
votes
2answers
486 views
How to prevent other hosts on the same LAN from seeing my IP and host name?
I want to hide my computer IP dan hostname when I am online on the same LAN on which other computers running netcut and other network tools. I have installed netcut defender but it seems not to hide ...
6
votes
2answers
727 views
Role Based Authorization vs. Claim Based Authorization
What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
1
vote
3answers
286 views
Can Paypal be used to verify a user's identity?
As I use my Paypal account for various online services, I noticed that vendors integrate differently with Paypal for on-demand payment, and scheduled payments.
I also noticed that Paypal offers a ...
1
vote
1answer
118 views
How does IIS persist identity credentials? Does it create any security issues?
We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
1
vote
0answers
98 views
pro and cons of having 2 Identity providers
My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and ...
16
votes
1answer
286 views
What's this kind of authentication scheme called?
In the past I've heard about a scheme to prove your identity online in places like forums, without having to create an account.
When posting, the user would enter a password which is then heavily ...
6
votes
2answers
336 views
Best Practices for verifying a users identity for helpdesk
I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted I know these ...
8
votes
11answers
2k views
Besides IP addresses, how else could one be identified? [closed]
OP:
I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the ...
1
vote
2answers
6k views
Spam that comes from names in my address book, but not their email addresses
I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be.
Specifically, the names -- but not the email ...
2
votes
1answer
87 views
Where can I find articles about identity disclosure attack?
Where can I find more details about identity disclosure attack and it's prevention?
If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
5
votes
1answer
297 views
Are there risks of using the same OpenID provider for sites with different security levels?
I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
13
votes
3answers
10k views
Can law enforcement track a criminal through dynamic IP address?
I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
24
votes
3answers
916 views
A Different Approach to PKI
After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
5
votes
2answers
249 views
Single vs multiple personas? What are the security implications?
I have two email addresses, one for work and one for home. I have have two cellphone numbers, one for work and one for home. But I am just one individual (and only have one social security number ...
-1
votes
1answer
2k views
how to trace the IP address of gmail account sender via browser [duplicate]
Possible Duplicate:
How to trace email?
i wanted to know the location of sender email which sent us the threat email the header of email is mentioned below
Analysis:
Received: from ...
7
votes
1answer
151 views
How can I limit the consequences of a possible future identity theft?
I am curious about how I can limit the consequences of an identity theft. I see a lot of discussion and advice about managing passwords securely or blocking malware. But what if it happens?
What if ...
4
votes
1answer
702 views
UPS my choice — How can I access my public records?
I was signing up for UPS my choice and they asked me some security questions.
It asked me questions that signified that it was able to figure out:
Who my father is and when my father was born.
My ...
3
votes
3answers
172 views
How to know if its the same User?
I asked a question awhile ago asking how to make an efficient encrypted chatroom. What I ended up doing was Making each user generate a 4096 bit RSA KeyPair, share their public Keys, and then one of ...
3
votes
1answer
145 views
What are the benefits of federated identity management over bare bones public key encryption?
What are the main reasons for having a federated identity system such as OpenID over having identities based purely on a public key?
OpenID uses an Identity Provider to confirm that a user owns a ...
17
votes
6answers
2k views
How to verify that someone is who they say they are online?
I am working on an online job application web app and the question has come up about how we will verify that someone submitting an application is who they say they are.
For example, we don't want ...
9
votes
2answers
5k views
Best Practice: “One per-user ssh key” or “multiple per-host ssh keys” [duplicate]
Possible Duplicate:
What’s the common pragmatic strategy for managing key pairs?
I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when ...
2
votes
2answers
1k views
How Is It Possible For Hackers To “Dig Up The Dirt” On People?
Like the title says, I was wondering how its possible for hackers to "dig up the dirt" and get peoples personal information such as address, credit cards, bank accounts, social insurance number, etc? ...
4
votes
2answers
131 views
What bad things could an “attacker” do with my stolen ID's?
So if someone steals my (ex.: I didn't teared up a piece of paper that had these and I throwed it away on the street) ID's like my:
Full name
Permanent address
Birth date/place
My mothers name
...
2
votes
3answers
220 views
Verify if person belongs to the claimed university through his university email id
I need to allow users access to an application after verifying that they belong to the claimed institute through university email id. So that if a person claims that he belongs to Stanford University, ...
2
votes
4answers
4k views
Bank account number and account holder in check exposed?
I'm not sure if this is standard practice in all banking institutions but almost all banks where I've received checks the account number of the issuer is exposed (some even the account name). Isn't ...
0
votes
4answers
975 views
Does Facebook merge accounts? In what circumstances? [closed]
I have two different Facebook accounts with two different passwords and two distinct online personalities, one as myself and one as someone else. Since the last one week, to my horror, both accounts ...
3
votes
3answers
1k views
How secure can IP based login be?
From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. Our idea is not new: we want a one-time validation and ...
0
votes
1answer
885 views
What are the potential vulnerabilities in a SAML-based SSO approach?
What level of access would an attacker need to obtain to compromise a SAML-based SSO system?
Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
0
votes
2answers
161 views
Verifying users location & authenticity
I am builduing a business to business website, and users are able to sign up with a personal profile and create a business (like linkedin).
I need to verify the following:
Business Name
...
10
votes
3answers
3k views
Why would someone register a Facebook account with a stolen email address?
I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
3
votes
4answers
854 views
Can SMS text messages be used to verify a person's unique identity through a short code system?
We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: ...
0
votes
1answer
92 views
Encrypting important context vs data sets associated with context
I am looking for an example in the real world where only a portion of the entire data set is encrypted even though the entire data set is considered sensitive. Specifically the portion that gives ...
10
votes
2answers
250 views
How to protect against exploitation using a lapsed domain
Consider a domain that had been in active use for some time but is no longer desired — perhaps the company is out of business or a name change took place years ago, or whatever. The domain ...
11
votes
1answer
803 views
What encryption prevents the tampering of Windows Identity Foundation (WIF) FedAuth cookies?
It occurred to me that the WIF FedAuth cookies contain identity information, that if tampered with, could permit someone to assume the identity of another user. Fortunately, WIF does ...
1
vote
1answer
299 views
What does a Yadis / XRDS discovery session “look like” to the end user? How does it work? Is it relevant?
I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me ...
8
votes
2answers
1k views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
5
votes
2answers
522 views
Length of CSRF Token
Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
6
votes
1answer
2k views
Ways to sign gpg public key so it is trusted?
I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they ...
4
votes
3answers
418 views
Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]
Recently while trying to log-in to Facebook this notification starts to appear:
At first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website!
I ...
8
votes
5answers
293 views
How to verify new accounts against a known persons database?
I need to (try to) solve the problem of new account creation for a patient portal for a medical records system (electronic health record). That is, a way to activate a patient online and match her ...
6
votes
6answers
703 views
Secure Internet Polling
In the United States, there has been a lot of talk about creating a secure polling system that would operate over the internet. I have also heard that Securing a poll over the Internet is impossible. ...
8
votes
7answers
314 views
Aren't permanantly logged in accounts inherently insecure?
The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...
19
votes
5answers
1k views
Should usernames be kept secret?
Help me settle an discussion among colleagues and guide future design:
Even in a high impact scenario: e.g. protecting payment application or government gateway but in an Internet accessible ...
6
votes
1answer
483 views
How to prepare for protecting identity after death?
In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
12
votes
3answers
489 views
How to secure identity after someone dies?
How would you go about securing the online identity(ies) of someone as best you can after they've died, when they haven't put anything in place ahead of time for this event?
Assume we don't know how ...
14
votes
3answers
204 views
Are malicious relying parties able to abuse OpenID logins?
if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me?
Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
