Questions tagged [identity]

Identity is the property of an object which allows it to be uniquely specified.

Filter by
Sorted by
Tagged with
40
votes
5answers
7k views

Should usernames be kept secret?

Help me settle an discussion among colleagues and guide future design: Even in a high impact scenario: e.g. protecting payment application or government gateway but in an Internet accessible ...
84
votes
5answers
26k views

Are GUIDs safe for one-time tokens?

I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification. Presumably they are appealing because they are easy to generate, unique, non-...
8
votes
6answers
2k views

Secure Internet Polling

In the United States, there has been a lot of talk about creating a secure polling system that would operate over the internet. I have also heard that Securing a poll over the Internet is impossible. ...
6
votes
4answers
18k views

Bank account number and account holder in check exposed?

I'm not sure if this is standard practice in all banking institutions but almost all banks where I've received checks the account number of the issuer is exposed (some even the account name). Isn't ...
12
votes
11answers
13k views

Besides IP addresses, how else could one be identified? [closed]

OP: I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the ...
3
votes
0answers
355 views

Ensuring an HTTP request is coming from my program

Is there a way to ensure that an HTTP request to my REST server is coming from my application? I'm guessing no because whatever I do on the client side, as people have access to that code, they can ...
19
votes
6answers
13k views

How to verify that someone is who they say they are online?

I am working on an online job application web app and the question has come up about how we will verify that someone submitting an application is who they say they are. For example, we don't want ...
20
votes
2answers
14k views

Best Practice: “One per-user ssh key” or “multiple per-host ssh keys” [duplicate]

Possible Duplicate: What’s the common pragmatic strategy for managing key pairs? I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when ...
8
votes
6answers
2k views

Should I use a cryptograpically secure random number generator when I generate IDs?

It is common to generate random identifiers to expose through an API instead of using a simple auto incrementing primary key. The reasons are many: Prevents easy enumeration. Does not give away order ...
12
votes
2answers
5k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
3
votes
5answers
13k views

Is it possible for someone to see under the “blacked out” part of this image (see below)?

Ok, so I sent some pictures to a journalist to report something I thought was noteworthy. However, one of the images contained my date of birth and other personal information so I blacked it out ...
3
votes
2answers
294 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
3
votes
2answers
353 views

How to secure a digital ID from being faked?

We're trying to create a digital ID to replace UK Passport/driving licences for entry into licensed premises, but need to ensure it cannot be faked (or failing that, the barrier to faking it needs to ...
1
vote
5answers
224 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
1
vote
1answer
557 views

Is it safe to recycle unshredded credit card receipts?

Is it safe to recycle unshredded paper credit card receipts? Can identity theft be helped by data disclosed on most vendor's receipts?
24
votes
3answers
2k views

A Different Approach to PKI

After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
34
votes
2answers
19k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
31
votes
3answers
37k views

Why do I need to hide my phone's IMEI

If it is a secret then why is it visible on the box, invoice and the back of the phone? If it is not a secret then why does it have to be blurred when it gets posted online?
22
votes
1answer
13k views

Ways to sign gpg public key so it is trusted?

I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they ...
13
votes
2answers
88k views

Why do some companies ask last 4 digits of my SSN or a scan of my ID? What are my risks?

Yesterday I found out that some major service provider (online rentals) that I use now requires proof of my identity if I want to continue and make a booking. I was offered 2 options: Enter last 4 ...
13
votes
3answers
4k views

Best practices for GPG user ids

What is the best practice for choosing GPG user id(s)? I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because ...
5
votes
5answers
7k views

Can we have https without certificates?

I apologize in advance if I am fundamentally misunderstanding something, but is it possible to have encrypted communication protocols (https, I suppose) without resorting to a certificate system? ...
15
votes
3answers
1k views

How to secure identity after someone dies?

How would you go about securing the online identity(ies) of someone as best you can after they've died, when they haven't put anything in place ahead of time for this event? Assume we don't know how ...
11
votes
1answer
2k views

How to prepare for protecting identity after death?

In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
11
votes
3answers
8k views

How secure can IP based login be?

From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. One of the reasons is obvious, multiple actual users ...
9
votes
2answers
485 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
21
votes
1answer
387 views

What's this kind of authentication scheme called?

In the past I've heard about a scheme to prove your identity online in places like forums, without having to create an account. When posting, the user would enter a password which is then heavily ...
18
votes
2answers
171k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
0
votes
1answer
590 views

Site asking for driver's license when buying items

I recently made a purchase on a website that asked for my Drivers license or government ID. I gave them a Drivers license photo I covered my license number and DD number but the license number can be ...
6
votes
1answer
191 views

Can windows domains be faked?

Without the equipment and software (and knowledge yet) readily available to test myself, I've been wondering about the relationship between computers and domains in a Windows environment. Some ...
5
votes
1answer
2k views

UPS my choice — How can I access my public records?

I was signing up for UPS my choice and they asked me some security questions. It asked me questions that signified that it was able to figure out: Who my father is and when my father was born. My ...
4
votes
4answers
3k views

Can SMS text messages be used to verify a person's unique identity through a short code system?

We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: https://ux.stackexchange.com/questions/15980/ways-...
2
votes
1answer
114 views

How would a nation-state provide an API for its citizens to verify their legal identity online? [closed]

An official nation-state institution, like the Swedish Skatteverk, could easily let their citizens verify themselves online. O-auth tokens could be created by the nation-state institution, generated ...
2
votes
1answer
7k views

How WhatsApp identifies a specific user

How does WhatsApp identify a specific user in order to forward the messages to him? Here is what I did: I backed up my iOS App from my old device Restored the backup to the new device Opened ...
2
votes
3answers
1k views

Why do file storage sites have a long unique id for their download links?

I'm creating a file storage site and what I would do is just have the download links format as: https://www.domain.com/[id]/[file name] //id would just be 1, 2, 3 etc. Dropbox and many others have ...
7
votes
1answer
96 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
5
votes
1answer
333 views

Why would a stranger keep signing up to trading sites with my email address?

I have read the answer below and understand that there is not much I can do about the basic problem of somebody signing up for newsletters and online services using my email address: Someone used my ...
2
votes
2answers
723 views

Should every SAML identity provider provide a unique public certificate to the service provider?

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
1
vote
2answers
99 views

How to Prove you created IP using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
1
vote
2answers
435 views

Having a consistent “don't reveal email addresses of members” policy [duplicate]

Developers are dogmatic on having "invalid username or password" on login screens; our applications should not reveal if somebody is a member given an email address. But there are two other ways our ...
0
votes
2answers
350 views

Verifying users location & authenticity

I am builduing a business to business website, and users are able to sign up with a personal profile and create a business (like linkedin). I need to verify the following: Business Name ...