Questions tagged [identity]

Identity is the property of an object which allows it to be uniquely specified.

Filter by
Sorted by
Tagged with
0
votes
1answer
797 views

Site asking for driver's license when buying items

I recently made a purchase on a website that asked for my Drivers license or government ID. I gave them a Drivers license photo I covered my license number and DD number but the license number can be ...
-4
votes
1answer
132 views

How to verify the identity of a person with 100% certainty? [closed]

Nowadays there are lots of security things, eg: Digital signatures Certificates One Time Password devices like those used in home banking system But no one gives you the possibility to verify ...
8
votes
5answers
2k views

How to protect myself online from the government? [closed]

I need something trusted and secure. I need to make “onion layers security” with the most secure and hard to hack/crack software. How to protect yourself from the government on the internet? I’m ...
4
votes
1answer
49k views

What can be done with the last 4 digits of one's SSN [closed]

If a hacker were to get the last 4 digits of your SSN (and maybe some other info like name, etc), what could they do? To avoid the possibility that they could guess the other digits from date/...
2
votes
2answers
127 views

Are Amazon AWS instanceIds security sensitive?

For troubleshooting, it's useful to include HTTP response headers that indicate proxy and backend EC2 instance ids, such as: X-Backend: i-8af67c92e0f3d89b6b X-Via: i-5b8146e7102940c75b-us-east-2b Is ...
0
votes
1answer
46 views

How do I get unique users signed up? [Canada or US] [closed]

Clients can win prizes on service and our team has to check their identity before giving prizes to them. Is there any way to collect photo ID while people signing up? Is it legal? Or there is some ...
1
vote
2answers
209 views

What is the safest way to identify a device without human action please?

I want to allow users of our website to restrict access to their account from devices they have explicitly authorized. This will be checked at the connection and each time the IP address changes. To ...
1
vote
2answers
103 views

Job Website Identity Verification

I signed up for work at a Job Website so I can do some freelance web development. They have an option where you can verify you are a US citizen so you can apply for jobs that people asked for US ...
5
votes
1answer
447 views

Can a Bitcoin Seller steal my Identity?

I was trying to buy some bitcoins on https://localbitcoins.com. However, the seller was looking for a copy of my ID and a photo of my debit card (long number covered). I'm curious as to how open ...
4
votes
2answers
1k views

Examples of Federated Identity Management, Third Party Identity Services and Single Sign-On

I am studying the domain of Identity and Access Management in CISSP, and I come across the three terms Federated Identity Management (FIM), Third Party Identity Services (3PIS) and Single Sign-On (SSO)...
1
vote
1answer
12k views

Gave scammers my name, date of birth, … What now? [duplicate]

I was contacted on a world wide exchange and chat site, on which the contactor (disguised as a normal, friendly person) wanted to be friends. They gave me their mail address. In their first e-mail ...
4
votes
1answer
245 views

Gravatar - Is it a security risk for medical forums?

If site forums use Gravatar, and the users are predominantly posting personal information about mental health issues, is this a security risk? Should the site consider turning off, or allowing opt ...
2
votes
0answers
83 views

Security implications of owning a German electronic ID card

I am German and about to renew my ID card. Since around 2010, the new ID cards contain an electronic chip that can be used for e.g. online authentication. If I understood the documentation correctly,...
3
votes
1answer
2k views

Is there a risk with making my Device ID public?

When making a mobile app with ads, I am required to register my test phones as test devices by providing the Device ID. These Device IDs are unique to an individual phone. Is there any risk with ...
3
votes
5answers
22k views

Is it possible for someone to see under the “blacked out” part of this image (see below)?

Ok, so I sent some pictures to a journalist to report something I thought was noteworthy. However, one of the images contained my date of birth and other personal information so I blacked it out ...
2
votes
3answers
210 views

How to prove a user is actually the perpetrator of certain actions?

TL;DR : What is the best and most "by the book" way to accheive non repudiation of origin. I have a system in which users can perform actions (register/unregister/...) Those actions are signed by my ...
3
votes
1answer
761 views

Why is callerID spoofing not possible when using short codes?

The question is already in the headline: Why is callerID spoofing not possible when the destination number is a short code? Here for example the answer to the question if callerID spoofing is still ...
1
vote
3answers
629 views

How can apps deal with phone number recycling/reassignment when sending password resets?

Instagram lets users sign up with their phone number (verified by a pin sent via text), a username and password. Should you forget your password, you can request a link sent via text to your phone, to ...
1
vote
2answers
245 views

How to Verify the identity of another computer

So I'm building an application that is designed for sharing files across a local network, and eventually across the Internet. I want to have a system for verifying the identities of computers, ...
1
vote
0answers
157 views

What is the target hash for a certain security level in TeamSpeak 3? [closed]

In the VoIP software TeamSpeak 3 there are "security levels" to proof someone's identity. According to [this question][1], it is based on the proof-of-work algorithm Hashcash, generating hashes of a ...
2
votes
3answers
513 views

How to prove my identity by GPG signature on a file?

It's a common need to prove that a file is truly created by someone, and I think GnuPG did the job. However, anyone can generate a gpg key with an unverified email. GPG key servers doesn't verify my ...
0
votes
1answer
7k views

Could revealing your full name on the internet be dangerous? [duplicate]

Apparently I can't find an answer to this on the internet, maybe because it's an obvious answer but still. Is there a reason to keep your full name disclosed on the internet?
5
votes
2answers
387 views

Passing user identity to an internal REST service

I have two services - A and B - which both expose a HTTP/REST API. Service A is exposed to the public and authenticates its users. It delegates part of the workload to service B which also has to know ...
2
votes
1answer
48 views

Verification methods of IDP in SAML2 IDP initiated login

What are the methods we can use to verify Identity Provider in Identity Provider initiated login in SAML2 Single sign on (SAML2 SSO)? Can any one who has access to IDP private key are able to create a ...
3
votes
3answers
1k views

Why doesn't a cookie persist across different machines?

I am running Chrome with a specific --user-data-dir on removable storage that allows me to maintain a single browser session on different machines throughout the day (history, bookmarks, extensions, ...
3
votes
1answer
121 views

Computer identity still recognised after reinstall

I bought a second hand laptop from a guy called Marcus. It had Win 10 on it but I immediately installed a new SSD drive and loaded Linux Mint. I was surprised when I visited a cafe to find that it ...
3
votes
2answers
360 views

How to secure a digital ID from being faked?

We're trying to create a digital ID to replace UK Passport/driving licences for entry into licensed premises, but need to ensure it cannot be faked (or failing that, the barrier to faking it needs to ...
0
votes
1answer
20 views

Preventing unauthorized key-listings

I just noticed that anyone who has root access to my computer can list the keys in my keyring. He would not be able to use any of my private keys without knowing the passphrase, but he could examine ...
2
votes
1answer
3k views

Spoofing the identity of another user in Telegram

In telegram you can setup a unique public username which is available to anyone in the search option, but if you choose not to do that, the only way someone can identify you is by the name you set (ex....
34
votes
7answers
7k views

Could governments and banks become CAs?

When you apply for a passport, driver's license, home mortgage, bank account, credit card, etc., the issuing organization must verify your identity. In the course of doing so, would it be feasible for ...
2
votes
3answers
1k views

How to erase/change all unique identifiers of a computer's identity?

Assuming one wants to be able to access a site from one device without the site realizing that the same device has visited multiple times, what are all the identifiers that one would have to consider/...
2
votes
2answers
575 views

Is it vulnerable to let users know their own and other users id from a database?

Say, I have a table Users with the id being an integer. Each user somehow is aware of their id somehow, for example, in an url to their profile the id is included. Or it's exposed to them by some ...
1
vote
2answers
220 views

Identify a user using random characters of the password

Assuming a password is not stored in plain-text, how is it possible that a support guy is able to identify during a phone call a customer by asking him random characters of his password? For example, ...
2
votes
2answers
7k views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
5
votes
0answers
91 views

How do (broadcast-only/passive) RFID licence plates assert their identity?

I would have guessed by some kind of challenge-response, but there seem to be many claims of 'passive' or 'broadcast-only' tags in the plates. For example from http://www.e-plate.com/security.html: ...
5
votes
4answers
3k views

How to verify personal information (identity)?

I've been trying to find this information but all I can find are answers saying to use a credit card for verification, not real answers. I am trying to figure out how/where companies get information ...
2
votes
2answers
117 views

Interaction between cash register and card terminal

A store allows you to join their loyalty club by simply presenting an ID and a credit card. Your identity is somehow linked to your card and automatically registered the next time you pay, no extra ...
3
votes
2answers
124 views

What are the benefits to adding a bitcoin blockhash UID notation to one's OpenPGP key?

Example: Notation data: blockhash@bitcoin.org 000000000000000011d9f6931e65f814c6f3b221736b0c45f25e0365a3d156fa As seen here: https://sks-keyservers.net/pks/lookup?op=vindex&search=...
0
votes
1answer
3k views

Who's been accessing my computer with TeamViewer? Tracking through UUID [duplicate]

So here I am, sitting at my computer screen on the one day of the week I stayed home from work, checking messages on my phone, when out the corner of my eye I see a browser page being opened. It was ...
1
vote
2answers
3k views

Random autofill [closed]

I was trying to pay for something just now, and when I put my name in the chrome autofill came up and I clicked it. The address that showed up was wrong though but corresponded to the postcode of one ...
8
votes
6answers
2k views

Should I use a cryptograpically secure random number generator when I generate IDs?

It is common to generate random identifiers to expose through an API instead of using a simple auto incrementing primary key. The reasons are many: Prevents easy enumeration. Does not give away order ...
3
votes
1answer
168 views

Single randomly generated passphrase for both identity and authentication

There are questions about using a password only to identify and authenticate a user, rather than an email address or username plus password: Why do we authenticate by prompting a user to enter both ...
6
votes
1answer
194 views

Can windows domains be faked?

Without the equipment and software (and knowledge yet) readily available to test myself, I've been wondering about the relationship between computers and domains in a Windows environment. Some ...
0
votes
2answers
89 views

Guarantee one unique identity per node

I'm in the early stages of designing a decentralised systems protocol, based on a blockchain, for a thesis. For the protocol to remain secure, each node in the system must be capable of generating one,...
5
votes
1answer
203 views

Keeping login in sync with third party providers

When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status. If I have my own server, which requires an access token of it's own (...
3
votes
3answers
154 views

Is it possible to modify jQuery client code to call a remote API in an unintended way?

Is it possible for someone to modify the JQuery code of a remote page and make it call the remote APIs in a different way than intended? Suppose the website www.domain.com has a jquery.js script ...
0
votes
2answers
169 views

Disclosing too much info over email just to close account?

I have account with a stock option trading platform. They are well known and reputable. I had a couple thousand in the account, bought and sold for a while, and then cashed out and withdrew. So I'm ...
2
votes
1answer
7k views

How WhatsApp identifies a specific user

How does WhatsApp identify a specific user in order to forward the messages to him? Here is what I did: I backed up my iOS App from my old device Restored the backup to the new device Opened ...
3
votes
1answer
2k views

Prove ownership of a GMail account

Is there a way for a person to remotely and irrefutably demonstrate ownership of a Gmail email address? I've considered using DKIM signatures, but this has problems: PGP Key Signing Robot DKIM ...
-4
votes
1answer
93 views

sourcing harrassing texts [closed]

I live in the US. Someone is texting harrassing messages to me. I have done a reverse lookup which dead-ends in a landline number. The number I have has been confirmed by my wireless Carrier. It ...