Questions tagged [identity]

Identity is the property of an object which allows it to be uniquely specified.

Filter by
Sorted by
Tagged with
1
vote
1answer
84 views

Possible to verify someone is a real person without direct connection?

I think the following is not possible, but I have no proof and would like to find out wether it is possible or not. Let's say in a network, every participant cannot connect to each other participant ...
0
votes
1answer
38 views

Proving a software deployment's origin sourcecode [duplicate]

Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL? sourcecode from commit #10020 at ...
0
votes
1answer
86 views

Sending credit history report to potential landlord

I have a credit report from TransUnion that contains: My real name, current and past addresses Current and past credit card accounts, last 12 monthly balances and payments My past mortgage Past ...
0
votes
2answers
68 views

Handling of 3rd party OAuth2 tokens

after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
0
votes
1answer
130 views

How did a website make an accurate assumption of my identity in incognito mode? [duplicate]

What piece of information can websites retrieve that would allow for later identification without cookies? Intro Out of interest I jumped into the rabbit hole of online marketing scams. The site I ...
-1
votes
2answers
310 views

Uniquely identify each mobile phone of Android 10 / 9 and below

Background: I have an Android APP with millions of users, but some users are malicious users (robot, fake, privilege escaped, etc). The common solution is to detect & block those "bad" accounts ...
4
votes
2answers
124 views

Could you store your passwords in a phone app governed by a QR code?

I had an idea a little while back to have an ID card with a QR code on it that you kept in your wallet. When you want to access your passwords (view them directly), you need your ID card and to scan ...
0
votes
0answers
65 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
3
votes
3answers
164 views

Is there anything like a standard GUID to identify a PC?

I am asked about my opinion in a case as follows: Someone visited a (totally legal, in fact US government) website A and identified themselves. At a very different point in time they - allegedly - ...
2
votes
0answers
51 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
1
vote
2answers
99 views

How to Prove you created IP using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
1
vote
1answer
57 views

Samba and verifying server identity

Suppose that I have two Windows 10 (Professional edition) computers, one (PC) sharing a folder and second one (notebook) copying data to the shared folder automatically. I would like to prevent ...
2
votes
2answers
100 views

Is there any way to alter a caller's voice just enough to make voice recognition impossible?

I did search and found this post: Is it possible to identify mobile phone user with voice recognition It does not answer my question, however. Is there any way to alter a person's voice just enough ...
3
votes
0answers
102 views

Is there any privacy- or security-relevant difference between FIDO2 and SQRL

I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme. Both seem to use the same key elements: a private, user-resident "master key" ...
4
votes
1answer
138 views

How can I challenge an attacker to reliably identify their hardware? [closed]

I distribute a client application where I would like to identify a user's hardware specifications when they begin interacting with my server. I am specifically interested in identifying the user's GPU ...
1
vote
5answers
225 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
0
votes
1answer
516 views

Identifying devices in mobile app using UUID

I have a mobile application, for Android and iOS (both native), that communicates with the backend through a REST API (over HTTPS). The application allows users to sign in or use the app as a guest, ...
1
vote
1answer
79 views

If only SP (or IDP) uses Shibboleth in its SAML implementation, can the systems still communicate?

I was reading about Shibboleth's metadata -- https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata#Metadata-Use(andnon-use)ofMetadata , and how it's used to identify IDPs and service ...
0
votes
0answers
48 views

Checking authenticity of a mobile app (digital staff card) [duplicate]

I've been asked to implement a digital card for member's of our organisation, to replace the old plastic ones. Members would install our app on their phone and setup a "card" with their photo on it ...
2
votes
2answers
77 views

What prevents an identity provider from falsifying authorization in a SAML 2.0 flow?

I'm confused about something in the SAML 2.0 flow. When the initial access to the service provider is made, the service provider must first validate that the user indeed has access and so the service ...
1
vote
2answers
180 views

What's the point of a digital certificate for which no private key exists?

I am only using digital certificates to sign documents, and my understanding is that the correct flow is the following: create a private key (e.g. using openssl) create CSR using the previously ...
10
votes
1answer
295 views

Is it possible to “reverse engineer” identicons?

As shown in this question, default user avatars (like mine) are identicons and are generated with the user's email (where provided) or the user's IP address (where the email is not provided). Given ...
0
votes
1answer
248 views

How is Privileged identity management (PIM) different from privileged access management (PAM)?

I am very confused about those two, I was trying to understand the difference but it all sounds the same from what I read online.
0
votes
1answer
86 views

Data leakage in internet-only services

Nowadays, internet-only services became very popular, for example, direct bank and many others. The advantage of such services is you don't have to spend the time to get to the office in order to get ...
2
votes
0answers
250 views

How to defend against adblock detection/adblock subscription leaks?

Is there a best practice (or useful extension) for defending against adblock fingerprinting techniques? I'm not asking about how to bypass adblock detection as such, but rather how one might appear ...
4
votes
3answers
873 views

Drivers license required for online purchases

Problem I tried to buy a few things from a particular industry, and the sellers are independently all asking for a copy of my drivers license to verify that it matches the details on the card because ...
50
votes
21answers
20k views

Are there unphotographable, but scannable ID cards?

We have a client who hosts an event, with a tight budget, that uses lanyarded Photo-ID cards with barcodes on them. The barcodes are used to gain access to various areas at the event. We were ...
4
votes
4answers
141 views

What is a simple and secure method to transfer virtual assets?

Consider a MMORPG where users own virtual assets like magical swords or rings that can be used by the player. This system needs a safe method for transferring assets from Alice to Bob. One ...
3
votes
2answers
188 views

Should things like project IDs, cloud region IDs etc be kept secret on an open source project?

All my side project are open source - just using the free Github account. I'm wondering about how security conscious I need to be about keep things like: Google Cloud Platform Project IDs Log ...
1
vote
2answers
196 views

Can your cell phone transmissions reveal your identity?

Is it feasible for hackers sitting near you to have some sort of RF listening device that uses your phone's transmissions to identify your name or other information that could be used to determine who ...
1
vote
1answer
87 views

How is AWS app identity verified?

So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
1
vote
1answer
235 views

VoIP service requires a scanned copy of my passport

In the process of registering to Callcentric, they asked me a scanned copy of my passport. I already gave them my mobile number, where they could possibly make an interview, and of course they have ...
1
vote
2answers
333 views

Best practice on Windows domains: To have a separate admin account or not?

On Linux, we enforce least privilege through sudo. This gives the best of both worlds: Passwords and accounts are for a person, as they should be, not a role. But we lower risk and exposure by only ...
1
vote
0answers
45 views

Security concerns in cookie exporting between browsers

I'm wondering why Facebook is not handling the cookie export between browsers and related security concerns. This will be worst when they are using the "remember me" option as the cookies will be ...
45
votes
10answers
27k views

Why use usernames and not just email addresses to identify users?

Why use usernames, and not just email addresses, to identify users? - What is the main concern or the main case when a security expert (which I'm not) should recommend inserting another layer of ...
2
votes
2answers
76 views

Is my (Chrome) email address available to websites when I'm logged into Chrome?

When I'm logged into Chrome (e.g. with my Gmail account) can websites view/obtain the email address associated with my Google/Chrome account? For example, as a means to "recognize" me?
0
votes
2answers
146 views

Someone is pretending to be me

Need some help! Someone has opened up an email account and is sending emails pretending to be me, to my office. They are asking for large invoices to be paid into a specific account. We realised ...
1
vote
0answers
70 views

Where is the ID chip in this card?

I recently attended a Salesforce World Tour. As part of being identifiable and being marketable you get this ID card that the exhibitors scan, so that they can get your name, company, email and ...
2
votes
1answer
1k views

Implicit flow login from SPA

Looking at the implicit flow to login with https://github.com/IdentityModel/oidc-client-js and https://github.com/IdentityServer/IdentityServer4.Samples/tree/release/Quickstarts/7_JavaScriptClient . ...
3
votes
2answers
138 views

Should passwords and challenge questions & answers be migrated?

I am currently working on the migration of a user Identity and Access Management tool from a legacy platform (product + solution) to a new one (same product but upgraded + updated solution) My team ...
0
votes
1answer
553 views

Requiring e-mail from user when using ASP.NET Identity password reset features

I am implementing ASP.NET Core Identity with IdentityServer4. One feature is password reset, and I found that all the examples (e.g. the IdentityServer4 quick start and the ASP.NET Identity example) ...
5
votes
1answer
334 views

Why would a stranger keep signing up to trading sites with my email address?

I have read the answer below and understand that there is not much I can do about the basic problem of somebody signing up for newsletters and online services using my email address: Someone used my ...
2
votes
0answers
393 views

Mobile Device identification best practices

When mobile app connects to back-end and requests the data, back-end should be sure that requestor is one it pretends to be. So, we need some way to securely identify the app on a device. While ...
4
votes
1answer
186 views

Accessing over a VPN both sites that know your real identity and sites you want to stay private from

Goal 1: access certain "anonymous" sites that you don't want to provide your real identity, IP or location to. Goal 2: access "regular" sites that do require or have your real identity, such as your ...
0
votes
1answer
602 views

Site asking for driver's license when buying items

I recently made a purchase on a website that asked for my Drivers license or government ID. I gave them a Drivers license photo I covered my license number and DD number but the license number can be ...
-4
votes
1answer
129 views

How to verify the identity of a person with 100% certainty? [closed]

Nowadays there are lots of security things, eg: Digital signatures Certificates One Time Password devices like those used in home banking system But no one gives you the possibility to verify ...
8
votes
5answers
2k views

How to protect myself online from the government? [closed]

I need something trusted and secure. I need to make “onion layers security” with the most secure and hard to hack/crack software. How to protect yourself from the government on the internet? I’m ...
4
votes
1answer
49k views

What can be done with the last 4 digits of one's SSN [closed]

If a hacker were to get the last 4 digits of your SSN (and maybe some other info like name, etc), what could they do? To avoid the possibility that they could guess the other digits from date/...
2
votes
2answers
110 views

Are Amazon AWS instanceIds security sensitive?

For troubleshooting, it's useful to include HTTP response headers that indicate proxy and backend EC2 instance ids, such as: X-Backend: i-8af67c92e0f3d89b6b X-Via: i-5b8146e7102940c75b-us-east-2b Is ...
0
votes
1answer
46 views

How do I get unique users signed up? [Canada or US] [closed]

Clients can win prizes on service and our team has to check their identity before giving prizes to them. Is there any way to collect photo ID while people signing up? Is it legal? Or there is some ...

1
2 3 4 5