Questions tagged [identity]

Identity is the property of an object which allows it to be uniquely specified.

Filter by
Sorted by
Tagged with
3
votes
2answers
60 views

What is the difference between the many identifiers in GnuPG?

GnuPG seems to have number of different ways to refer to a (sub)key(pair): Key IDs Fingerprints Keygrips Additionally, gpg --list-sigs seems to show hexadecimal identifiers for signatures and such ...
4
votes
2answers
104 views

Are there security reasons for prohibiting universal mac address modification?

Background In a standard 48-bit MAC address, the 7th (most significant) bit specifies whether it is a universally-administered address (UAA) or a locally-administered address (LAA). If it is 0, then ...
3
votes
1answer
66 views

Randomly generating invoice IDs

I'm in the process of setting up a local (i.e. offline and very limited) business, and I'm thinking of generating invoice IDs randomly to avoid the clients knowing that they're customer number #...
0
votes
1answer
76 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
1
vote
1answer
60 views

What is the best way to verify email address or phone number during call centre sale?

My company sells products through calls. During the calls a customers PII is collected and used to create the product. This PII includes email. After the product is created, we email the customer a ...
2
votes
2answers
7k views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
5
votes
2answers
169 views

Can name and date of birth be hashed somehow to generate a secure identifier?

I'm working on a project which we intend to launch for developing countries, and, as a result, want to limit the amount of information needed for login and identification, while still maintaining ...
7
votes
2answers
6k views

Best practices for verifying a users identity for helpdesk

I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted, I know ...
45
votes
10answers
29k views

Why use usernames and not just email addresses to identify users?

Why use usernames, and not just email addresses, to identify users? - What is the main concern or the main case when a security expert (which I'm not) should recommend inserting another layer of ...
0
votes
2answers
83 views

Handling of 3rd party OAuth2 tokens

after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
4
votes
4answers
142 views

What is a simple and secure method to transfer virtual assets?

Consider a MMORPG where users own virtual assets like magical swords or rings that can be used by the player. This system needs a safe method for transferring assets from Alice to Bob. One ...
1
vote
1answer
87 views

Possible to verify someone is a real person without direct connection?

I think the following is not possible, but I have no proof and would like to find out wether it is possible or not. Let's say in a network, every participant cannot connect to each other participant ...
0
votes
1answer
40 views

Proving a software deployment's origin sourcecode [duplicate]

Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL? sourcecode from commit #10020 at ...
0
votes
1answer
93 views

Sending credit history report to potential landlord

I have a credit report from TransUnion that contains: My real name, current and past addresses Current and past credit card accounts, last 12 monthly balances and payments My past mortgage Past ...
4
votes
2answers
130 views

Could you store your passwords in a phone app governed by a QR code?

I had an idea a little while back to have an ID card with a QR code on it that you kept in your wallet. When you want to access your passwords (view them directly), you need your ID card and to scan ...
0
votes
1answer
133 views

How did a website make an accurate assumption of my identity in incognito mode? [duplicate]

What piece of information can websites retrieve that would allow for later identification without cookies? Intro Out of interest I jumped into the rabbit hole of online marketing scams. The site I ...
-1
votes
2answers
555 views

Uniquely identify each mobile phone of Android 10 / 9 and below

Background: I have an Android APP with millions of users, but some users are malicious users (robot, fake, privilege escaped, etc). The common solution is to detect & block those "bad" accounts ...
5
votes
4answers
3k views

How to verify personal information (identity)?

I've been trying to find this information but all I can find are answers saying to use a credit card for verification, not real answers. I am trying to figure out how/where companies get information ...
0
votes
0answers
120 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
3
votes
3answers
168 views

Is there anything like a standard GUID to identify a PC?

I am asked about my opinion in a case as follows: Someone visited a (totally legal, in fact US government) website A and identified themselves. At a very different point in time they - allegedly - ...
0
votes
1answer
697 views

Identifying devices in mobile app using UUID

I have a mobile application, for Android and iOS (both native), that communicates with the backend through a REST API (over HTTPS). The application allows users to sign in or use the app as a guest, ...
2
votes
0answers
56 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
1
vote
2answers
101 views

How to Prove you created IP using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
1
vote
1answer
74 views

Samba and verifying server identity

Suppose that I have two Windows 10 (Professional edition) computers, one (PC) sharing a folder and second one (notebook) copying data to the shared folder automatically. I would like to prevent ...
2
votes
2answers
102 views

Is there any way to alter a caller's voice just enough to make voice recognition impossible?

I did search and found this post: Is it possible to identify mobile phone user with voice recognition It does not answer my question, however. Is there any way to alter a person's voice just enough ...
3
votes
5answers
22k views

Is it possible for someone to see under the “blacked out” part of this image (see below)?

Ok, so I sent some pictures to a journalist to report something I thought was noteworthy. However, one of the images contained my date of birth and other personal information so I blacked it out ...
3
votes
0answers
119 views

Is there any privacy- or security-relevant difference between FIDO2 and SQRL

I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme. Both seem to use the same key elements: a private, user-resident "master key" ...
0
votes
2answers
383 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
13
votes
2answers
89k views

Why do some companies ask last 4 digits of my SSN or a scan of my ID? What are my risks?

Yesterday I found out that some major service provider (online rentals) that I use now requires proof of my identity if I want to continue and make a booking. I was offered 2 options: Enter last 4 ...
4
votes
1answer
139 views

How can I challenge an attacker to reliably identify their hardware? [closed]

I distribute a client application where I would like to identify a user's hardware specifications when they begin interacting with my server. I am specifically interested in identifying the user's GPU ...
1
vote
5answers
229 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
10
votes
7answers
527 views

Aren't permanantly logged in accounts inherently insecure?

The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...
1
vote
1answer
82 views

If only SP (or IDP) uses Shibboleth in its SAML implementation, can the systems still communicate?

I was reading about Shibboleth's metadata -- https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata#Metadata-Use(andnon-use)ofMetadata , and how it's used to identify IDPs and service ...
0
votes
0answers
50 views

Checking authenticity of a mobile app (digital staff card) [duplicate]

I've been asked to implement a digital card for member's of our organisation, to replace the old plastic ones. Members would install our app on their phone and setup a "card" with their photo on it ...
2
votes
2answers
79 views

What prevents an identity provider from falsifying authorization in a SAML 2.0 flow?

I'm confused about something in the SAML 2.0 flow. When the initial access to the service provider is made, the service provider must first validate that the user indeed has access and so the service ...
2
votes
1answer
3k views

Spoofing the identity of another user in Telegram

In telegram you can setup a unique public username which is available to anyone in the search option, but if you choose not to do that, the only way someone can identify you is by the name you set (ex....
3
votes
1answer
762 views

Why is callerID spoofing not possible when using short codes?

The question is already in the headline: Why is callerID spoofing not possible when the destination number is a short code? Here for example the answer to the question if callerID spoofing is still ...
1
vote
2answers
218 views

What's the point of a digital certificate for which no private key exists?

I am only using digital certificates to sign documents, and my understanding is that the correct flow is the following: create a private key (e.g. using openssl) create CSR using the previously ...
10
votes
1answer
324 views

Is it possible to “reverse engineer” identicons?

As shown in this question, default user avatars (like mine) are identicons and are generated with the user's email (where provided) or the user's IP address (where the email is not provided). Given ...
0
votes
1answer
311 views

How is Privileged identity management (PIM) different from privileged access management (PAM)?

I am very confused about those two, I was trying to understand the difference but it all sounds the same from what I read online.
8
votes
6answers
2k views

Should I use a cryptograpically secure random number generator when I generate IDs?

It is common to generate random identifiers to expose through an API instead of using a simple auto incrementing primary key. The reasons are many: Prevents easy enumeration. Does not give away order ...
0
votes
1answer
89 views

Data leakage in internet-only services

Nowadays, internet-only services became very popular, for example, direct bank and many others. The advantage of such services is you don't have to spend the time to get to the office in order to get ...
2
votes
0answers
261 views

How to defend against adblock detection/adblock subscription leaks?

Is there a best practice (or useful extension) for defending against adblock fingerprinting techniques? I'm not asking about how to bypass adblock detection as such, but rather how one might appear ...
0
votes
1answer
582 views

Requiring e-mail from user when using ASP.NET Identity password reset features

I am implementing ASP.NET Core Identity with IdentityServer4. One feature is password reset, and I found that all the examples (e.g. the IdentityServer4 quick start and the ASP.NET Identity example) ...
4
votes
3answers
1k views

Drivers license required for online purchases

Problem I tried to buy a few things from a particular industry, and the sellers are independently all asking for a copy of my drivers license to verify that it matches the details on the card because ...
0
votes
1answer
805 views

Site asking for driver's license when buying items

I recently made a purchase on a website that asked for my Drivers license or government ID. I gave them a Drivers license photo I covered my license number and DD number but the license number can be ...
3
votes
1answer
2k views

Why do websites ask for the last four digits of your social security number?

Quite a few websites, Coinbase and Stripe most notably, ask for the last four digits of your social security number to 'verify your identity'. Assuming these websites are not trying to fraud you, how ...
1
vote
3answers
630 views

How can apps deal with phone number recycling/reassignment when sending password resets?

Instagram lets users sign up with their phone number (verified by a pin sent via text), a username and password. Should you forget your password, you can request a link sent via text to your phone, to ...
50
votes
21answers
20k views

Are there unphotographable, but scannable ID cards?

We have a client who hosts an event, with a tight budget, that uses lanyarded Photo-ID cards with barcodes on them. The barcodes are used to gain access to various areas at the event. We were ...
1
vote
1answer
88 views

How is AWS app identity verified?

So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...

1
2 3 4 5