Questions tagged [legal]
Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investigation and trial. Note that if your question matches this description chances are high that it is off-topic at this site and you'll better try law.stackexchange.com.
314
questions
1
vote
0
answers
36
views
My friends phone that was sent to police forensics has been broken into. Can you help me with some of these questions?
I was very disappointed to hear that my friend, who had his android phone seized not too long ago, has had his phone broken by police forensics.
As far as I know, it was a few years old, Samsung, and ...
1
vote
1
answer
72
views
qualified e-signature long-term security
I'm considering to obtain a QES (Qualified electronic signature). But I'm concerned about long term security.
The hypothetical scenario is lets say after 10-15 years the algorithms are cracked or ...
- 624
0
votes
0
answers
37
views
What strategies can I use to negotiate security terms in vendor contracts for vendors in high geopolitical risk countries?
Please assume the following in responding:
Data being passed to vendor is subject to data protection laws in the USA such as GLBA
Data itself resides within the United States
Switching vendors will ...
- 1,766
3
votes
2
answers
333
views
What is the worst thing that can happen to me if I use a laptop that I had lent to a person who might have been involved in shady activities?
I lent my old laptop to a person who was in need of it in order to work abroad during autumn. Recently though, I learnt from a trusted source that his father had faced trouble with the police in the ...
- 33
1
vote
0
answers
109
views
How do we reconcile a requirement to keep backups, with a requirement that we be able to purge data on request? [closed]
As part of SOC 2 preparation (and just general operational best-practice) we take regular PostgreSQL backups and keep them for up to a year. One of our partners has a requirement that we be able to ...
- 11
6
votes
1
answer
810
views
PCI Compliance Password time to die change requirement
In the PCI DSS3 requirements it states that the user must change their password every 90 days, how are banks in the UK getting around this requirement? Is it because of 2FA?
As a new business we are ...
- 163
2
votes
0
answers
213
views
CISO goes to jail if something goes wrong? [closed]
I'm building up most functions out of opensource projects; honeypots, firewall, ERP, CRM, PBX, physical security, software security, network security, security government, asset policy management, etc....
- 155
2
votes
2
answers
2k
views
What encryption did Encrochat use, and how was it broken? [closed]
On 2nd July, the UK's national news outlets broke the story of an "unprecedented" 4-year-long, Europe-wide investigation that, in the UK, resulted in the arrest of 746 criminals, including ...
- 989
1
vote
2
answers
390
views
What are the potential security risks of using a commercial VPN service?
Commercial VPN services are gaining a lot of popularity and some of them are heavily advertising their products on social media networks and technology magazines today.
The advantages of using such ...
- 263
0
votes
0
answers
212
views
How do LEA and others track no log VPN users?
Other questions have been asked but not with the specific details that I have shown (no log VPN, no leaks, dynamic user agent and JavaScript disabled).
Hypothetical situation
Someone sends a ...
- 117
0
votes
1
answer
294
views
TLD Re-direct precedence in law
I hope to soon resurrect an old web-site of many years standing: it has the URL xxxx-xxxx.com, and I still rent the domain name.
Now I am not anxious to continue hosting it in the USA --- though ...
2
votes
1
answer
317
views
Reason for lack of asymmetric cryptography in AWS KMS for regions in China
In the documentation of the AWS Key Management Service (KMS) I found this interesting sentence:
Asymmetric CMKs and asymmetric data key pairs are supported in all AWS Regions that AWS KMS supports ...
- 1,272
0
votes
2
answers
174
views
Would a difficult to access "Key" be an option to securely solve the Apple vs. FBI problem?
In recent times, there has been an escalating demand by legislators in the US and the world around to be able to decrypt phones that come pre-configured with strong encryption. Key escrow is commonly ...
- 101
1
vote
0
answers
92
views
How to get on a list of sites that handle financial information? [closed]
Until about a year ago, I was working for one of the big tech giants. During my time there, I noticed that the IT department would do a MITM attack on any website that employees access. i.e. if you ...
- 2,028
1
vote
0
answers
110
views
saving entire Windows event log for auditing & preserve digital evidence
As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down.
...
- 177
-2
votes
1
answer
121
views
Can employees' personal properties be part of the scope? [closed]
Let's assume the customer (target) wants to have a full physical pentest done.
(I'm a student and have 0 exp in actual Pentesting and Red Teaming
Properties of topic:
Cars (in the car park)
...
- 3,482
36
votes
2
answers
12k
views
Should I present forged documents in a Penetration Test/Red team engagement?
A previous question of mine lead to this discussion which mentioned the subject of Document forgery.
I've seen many people (in videos) forge IDs and employee badges for such engagements so that seems ...
- 3,482
1
vote
0
answers
307
views
Why does Samsung access my contacts and storage if I use their store? [closed]
If I want to access the Galaxy Store on a Samsung Galaxy phone I have to agree to a set of terms (Legal information). These terms are excerpted below:
All content made available to you by the ...
- 111
1
vote
1
answer
195
views
Does data inside a VPC needs to be encrypted in trasit too? [closed]
I know there are laws which require all data to be encrypted in transit and at rest. It makes sense for browser to server connections but,
Does data flow within a VPC, lets say a kubernetes cluster ...
- 227
1
vote
4
answers
226
views
How can Facial Recognition surveilance be misused by police? [closed]
There has been a lot of news lately about facial recognition use by police forces being banned or that it should be banned.
The obvious example is that a police officer who is motivated by personal ...
- 403
0
votes
1
answer
236
views
Is there a danger to client port scanning?
Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports? ...
- 425
1
vote
2
answers
270
views
Protecting against planted evidence
This question was motivated by this 2018 article by the Electronic Frontier Foundation that discusses the findings from the Mark Rettenmaier case.
For a bit of background on that case, this article ...
- 474
107
votes
8
answers
11k
views
Ex-contractor published company source code and secrets online
Just found my current company code on the plain internet.
We are talking hundreds of thousands of lines of scripts and configurations, including database schemas and a fair amount of internal ...
- 1,266
1
vote
0
answers
428
views
For pen testing why would the client need to sign a NDA?
I'm starting the process of doing some pen testing and other security related things as a contractor. Specifically regarding pen testing. I have been Googling around to put together some docs for the ...
- 111
0
votes
3
answers
2k
views
Will pentesting my own LAN violate ISP rules? [closed]
I want to learn and practice penetration testing on my own network, and I want to be sure I'm making it legal.
Is there a system that reports to my ISP that I'm making suspicious activities, even if ...
user193070
1
vote
2
answers
231
views
Is it legal to store users searches [closed]
Im developing a webshop and i got a task asking for storing users searches. Is it legal?
It will be stored in a db with the fields Date, Search text, userId
- 11
0
votes
2
answers
681
views
Australia's Legal Do's and Don'ts of Hacking [closed]
Just wondering what methods used in Pen-testing (Denial of service, dropping a shell, phishing, etc.) would land you in legal trouble in Australia?
1
vote
1
answer
185
views
Could a cloud provider access your data?
Would it be possible that an Amazon (for example) sysadmin get into your VM (physically by going in the rack where the server hosts your VM, and virtually) and get your precious source code? and more.
...
- 21
-2
votes
1
answer
189
views
Paid Android apps for free? [closed]
One of my friends recently made a website where one could download paid apps on the Play store for free. I also saw many other websites that do the same.
How did he do it?
Is it legal? If yes, then ...
- 101
-2
votes
2
answers
980
views
Is PCI compliance required by law?
Is PCI compliance required by law?
We are creating a website where we will accept customer card data and pass it to merchant API.
Everywhere on the internet you will find PCI is required. But what ...
- 27
1
vote
2
answers
263
views
Can employers log internet traffic of employees personal computers? [closed]
I have a suspicion that my employer is misusing their work monitoring and remote access software to check my online activity outside of work.
I have the software installed on my personal machine as I ...
- 11
0
votes
1
answer
123
views
HIPAA non-business associate for contract work
I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
- 115
6
votes
1
answer
219
views
How can companies verify that a national security letter is real? [closed]
It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it.
There ...
- 1,935
2
votes
1
answer
213
views
Can I get in trouble for legitimate mistakes in bug bounty testing? [closed]
During some recent bug bounty testing, I needed to record a pcap using Wireshark, then replay it repeatedly in order to stress test a locally hosted server (which is in-scope of the bounty program).
...
- 193
-3
votes
1
answer
236
views
Legal advise concerning copyright infringement (BitTorrent) and Wi-Fi hacking [closed]
Someone has hacked into my Wi-Fi and downloaded a film, TV shows and other content over a 2 year period using BitTorrent, I am now being sued by a copyright infringement company.
The TV programs as ...
- 21
-5
votes
1
answer
923
views
IP Logs at LinkedIn [closed]
To make a long story short, the CEO in my firm was fired but she did not change her status at LinkedIn about being employed at my firm. I sent her several mail that remained unanswered. So after 9 ...
- 1
2
votes
2
answers
203
views
Is there an easy way to detect clients that ignore certificate validation errors (in production)?
I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets ...
- 457
2
votes
2
answers
616
views
Has anyone used a file hash to prove authenticity of a file during legal proceedings?
I've had a client come to me with a request for a feature to prove that a file uploaded to a cloud service we run is the same as the one that they subsequently stored in their document management ...
- 153
-1
votes
1
answer
464
views
Audio steganography and DRM
I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
user178802
0
votes
1
answer
848
views
Is PGP illegal? [closed]
Forword. The following question I have asked at first at Law Stackexchange, because it has to do mainly with legal aspects of encryption and my assumption was, that there is the right place, https://...
- 211
4
votes
1
answer
16k
views
How can police get someone's search history?
Sometimes I see news articles saying that someone was suspected of a crime so the police got their search history and found various google search terms etc.
What are the possible ways they can do ...
user176396
0
votes
2
answers
339
views
Auditing user emails (illegal?) [closed]
I'm the systems administrator for a company that does a lot of outbound emails and a lot of inbound emailing to potential clients.
We've had a email auditing tool running for a couple weeks that ...
- 481
1
vote
0
answers
68
views
How can I establish origin/ authenticity of a electronic document
Scenario: PartyA had put up an online offer on PartyB's certain product, if I bought the product through PartyA's channel then I shall be entitled to an specific gift/reward if PartyB approves my ...
- 195
19
votes
4
answers
6k
views
The non-compliance of the EU cookie law as a finding in a penetration test report?
I recently noticed a penetration test report wherein the non-compliance of the European Union (EU) cookie law was stated as a finding under an "other" category. I consider this more of a legal, ...
- 6,661
-1
votes
1
answer
2k
views
Is obtaining Mac Address illegal? [closed]
Just wondering, in the US, if a retailer or restaurant wants to collect user's data through obtaining mac address, is it illegal?
2
votes
0
answers
373
views
Why aren't foreign VPN companies forced to keep logs? [closed]
This link explains the inconsistency with what VPN services consider 'logging'. Certainly, there is no way for us to verify their claims without an extremely rigorous independent audit. But even that ...
- 21
1
vote
0
answers
119
views
Where can I find legal acts (USA) for storing or processing social security number, tax id, driver license?
There is a PCI DSS for credit card processing. Does somewhere exist similar requirements for personal data processing, especially in US?
- 127
2
votes
0
answers
112
views
Are there laws to fine certificate authorities who issue false certificates deliberately? [closed]
As we all know, server-side digital certificates are key to server authentication. Now consider the following situation (I know it may be an absurd situation, but let's imagine it's true): A hacker ...
- 21
1
vote
1
answer
496
views
Required security for storing bank transactions, but not credentials
If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
-1
votes
2
answers
2k
views
Legal Issues around simulated phishing attacks [closed]
We are putting together a service for use both internally and for our clients using GoPhish to test users' awareness of phishing. Basically, the users will receive a phishing email and we will measure ...
- 99