Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [legal]

Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investigation and trial. Note that if your question matches this description chances are high that it is off-topic at this site and you'll better try law.stackexchange.com.

1
vote
2answers
75 views

Is it legal to store users searches [closed]

Im developing a webshop and i got a task asking for storing users searches. Is it legal? It will be stored in a db with the fields Date, Search text, userId
0
votes
2answers
55 views

Australia's Legal Do's and Don'ts of Hacking [closed]

Just wondering what methods used in Pen-testing (Denial of service, dropping a shell, phishing, etc.) would land you in legal trouble in Australia?
1
vote
1answer
60 views

Could a cloud provider access your data?

Would it be possible that an Amazon (for example) sysadmin get into your VM (physically by going in the rack where the server hosts your VM, and virtually) and get your precious source code? and more. ...
-3
votes
2answers
207 views

Is PCI compliance required by law?

Is PCI compliance required by law? We are creating a website where we will accept customer card data and pass it to merchant API. Everywhere on the internet you will find PCI is required. But what ...
0
votes
2answers
115 views

Can employers log internet traffic of employees personal computers? [closed]

I have a suspicion that my employer is misusing their work monitoring and remote access software to check my online activity outside of work. I have the software installed on my personal machine as I ...
0
votes
1answer
50 views

HIPAA non-business associate for contract work

I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
6
votes
1answer
146 views

How can companies verify that a national security letter is real? [closed]

It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it. There ...
2
votes
1answer
125 views

Can I get in trouble for legitimate mistakes in bug bounty testing? [closed]

During some recent bug bounty testing, I needed to record a pcap using Wireshark, then replay it repeatedly in order to stress test a locally hosted server (which is in-scope of the bounty program). ...
-3
votes
1answer
99 views

Legal advise concerning copyright infringement (BitTorrent) and Wi-Fi hacking [closed]

Someone has hacked into my Wi-Fi and downloaded a film, TV shows and other content over a 2 year period using BitTorrent, I am now being sued by a copyright infringement company. The TV programs as ...
-5
votes
1answer
125 views

IP Logs at LinkedIn [closed]

To make a long story short, the CEO in my firm was fired but she did not change her status at LinkedIn about being employed at my firm. I sent her several mail that remained unanswered. So after 9 ...
2
votes
2answers
94 views

Is there an easy way to detect clients that ignore certificate validation errors (in production)?

I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets ...
1
vote
2answers
157 views

Has anyone used a file hash to prove authenticity of a file during legal proceedings?

I've had a client come to me with a request for a feature to prove that a file uploaded to a cloud service we run is the same as the one that they subsequently stored in their document management ...
-1
votes
1answer
105 views

Audio steganography and DRM

I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
0
votes
1answer
290 views

Is PGP illegal? [closed]

Forword. The following question I have asked at first at Law Stackexchange, because it has to do mainly with legal aspects of encryption and my assumption was, that there is the right place, https://...
2
votes
1answer
1k views

How can police get someone's search history?

Sometimes I see news articles saying that someone was suspected of a crime so the police got their search history and found various google search terms etc. What are the possible ways they can do ...
0
votes
2answers
121 views

Auditing user emails (illegal?) [closed]

I'm the systems administrator for a company that does a lot of outbound emails and a lot of inbound emailing to potential clients. We've had a email auditing tool running for a couple weeks that ...
0
votes
0answers
114 views

Reference PHI data with a none HIPAA compliance storage

We store PHI data in AWS DynamoDB, we store connected non PHI in AWS Neptune. We will reference this through a user id, this will generated at user creation, the id is time based hash. Is this a ...
1
vote
0answers
31 views

How can I establish origin/ authenticity of a electronic document

Scenario: PartyA had put up an online offer on PartyB's certain product, if I bought the product through PartyA's channel then I shall be entitled to an specific gift/reward if PartyB approves my ...
19
votes
4answers
6k views

The non-compliance of the EU cookie law as a finding in a penetration test report?

I recently noticed a penetration test report wherein the non-compliance of the European Union (EU) cookie law was stated as a finding under an "other" category. I consider this more of a legal, ...
-1
votes
1answer
518 views

Is obtaining Mac Address illegal? [closed]

Just wondering, in the US, if a retailer or restaurant wants to collect user's data through obtaining mac address, is it illegal?
1
vote
0answers
179 views

Why aren't foreign VPN companies forced to keep logs? [closed]

This link explains the inconsistency with what VPN services consider 'logging'. Certainly, there is no way for us to verify their claims without an extremely rigorous independent audit. But even that ...
1
vote
0answers
53 views

Where can I find legal acts (USA) for storing or processing social security number, tax id, driver license?

There is a PCI DSS for credit card processing. Does somewhere exist similar requirements for personal data processing, especially in US?
2
votes
0answers
49 views

Are there laws to fine certificate authorities who issue false certificates deliberately? [closed]

As we all know, server-side digital certificates are key to server authentication. Now consider the following situation (I know it may be an absurd situation, but let's imagine it's true): A hacker ...
1
vote
1answer
276 views

Required security for storing bank transactions, but not credentials

If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
-1
votes
2answers
622 views

Legal Issues around simulated phishing attacks [closed]

We are putting together a service for use both internally and for our clients using GoPhish to test users' awareness of phishing. Basically, the users will receive a phishing email and we will measure ...
0
votes
1answer
72 views

Unencrypted login page for EU (utility) company handling PII [closed]

Suppose a EU company provides me access to my personal information over HTTP, without even an option for HTTPS. Does that violate EU privacy laws? Can the company be compelled to fix its website, and ...
2
votes
3answers
234 views

How do VPNs protect identity without assuming legal blame?

I understand that a VPN is basically a computer (or a collection of computers) that encrypts and proxies your internet traffic. One popular use of a VPN is to pirate software or movies. The VPN keeps ...
0
votes
2answers
897 views

Multiple instances with the same SSL certificate legalities? [closed]

In here it said some CA's wouldn't permit using the same SSL certificate on multiple servers: Can I use a single SSL cert on two different servers?. But what about two instances from the same server. ...
1
vote
2answers
57 views

Can a website's privacy policy be made more effective by incorporating it into company bylaws?

I'm concerned primarily about the US, but also UK and Germany. Is there any way to give a privacy policy greater trust, and more effectiveness, by somehow binding it to a company's bylaws with the ...
0
votes
2answers
173 views

Legality of sniffing own traffic between mobile app and server

Recently I found a bug on a mobile app which claims to protect their users' privacy, however after connecting my phone with burp and installing a certificate I noticed that this app was sending a ...
0
votes
1answer
61 views

Two-Factor Authentication on downloadable client but not website

A friend of mine plays RuneScape, and mentioned to me that her account was recently compromised. She told me she has two step authentication on her RuneScape account, and on the email address ...
1
vote
0answers
140 views

Cybercrime jurisdiction in China [closed]

Context I had a call today from a customer, who asked me details about a cyber attack that occurred yesterday on one of his web servers, it was a common OS injection attack encapsulated in a http ...
1
vote
1answer
351 views

Can I access my own account logs at Godaddy without a subpoena? [closed]

I have some evidence that our Godaddy domain account has been tampered with, by a former administrator with access to the account credentials. To prove that the account was accessed, I need, at the ...
4
votes
3answers
643 views

What are the penal consequences for a passive or active scan on a WebApp with no damage? [closed]

Let's say I only trust web applications that I tested myself with some penetration tests. What penal consequences exist for doing a passive scan (eg. building a map of a website site) or an active ...
8
votes
2answers
238 views

Is there a way to perform data acquisition on CPU's registers?

In Digital Forensics, as a best practice, an investigator should collect data from the most volatile source to the least volatile source. Usually, when talking about live/Dynamic Acquisition, most ...
-4
votes
1answer
165 views

Would Attacking An ISIS Website Be Illegal [closed]

I made a DDoS script that floods an ISIS websites with post requests, if enough people use the script, it could take down the website. (Presuming it works) Would that be illegal and would I be ...
1
vote
0answers
121 views

WannaCry ransomware backtrace [closed]

Can law-enforcement agency trace the source of code, emails or bitcoins destination to catch criminals? After all, someone will get these bitcoins and someone will be using a computer to do it?
4
votes
1answer
88 views

How can I prove that I adhere to stated privacy policy? What audits are effective for voluntary compliance?

I have a website and mobile app that doesn't store data or PII. Suppose I'm not subject to any special privacy laws. How can I voluntarily submit myself to an audit to ensure that I'm acting true to ...
6
votes
1answer
1k views

How does “Unlock your Mac with Apple Watch” work? What should I consider in the Enterprise?

MacOS on 2013 and newer Macs have the following setting at the bottom in system preferences: Question How does "Allow your Apple Watch to unlock your Mac work? From what I've seen, it has a ...
1
vote
0answers
75 views

Legality IP collection/storage [closed]

Without giving too much away, I'm contemplating on designing a service/app for a specific business to monitor certain static IPs such as their service providers and other statically connected devices (...
6
votes
3answers
636 views

Where do people who publish “free proxies lists” get their proxies from?

Where do people who publish "free proxies lists" get their lists from? I know those lists are commonly used for example by so called "internet marketers" for scraping websites. Search for "free proxy ...
5
votes
1answer
5k views

Is it possible to un-spoof a spoofed caller ID?

I know that Trapcall allows mobile telephone users to forward their calls to a toll free number, which then forwards them back to the user's telephone, allowing them to see the caller ID. However, ...
3
votes
2answers
520 views

Should I publish IP addresses that try to brute force my private web server?

Ethically and legally, am I allowed to publish IP addresses that tried to brute force my LAMP server? It's a personal website/blog that gets brute forced a lot and I would like to publish them to my ...
1
vote
2answers
58 views

In what cases should applications be prepared for brute force?

Today I had an idea: I've been thinking that one can use brute force to get some data from a university from our country. It turned out my thoughts were true: an attacker can use brute force to ...
1
vote
0answers
92 views

Malicious Actor with Physical Access to Encrypted Machine [duplicate]

Some background: My org is potentially involved in a legal dispute with a securities brokerage in a under-developed country with mediocre rule of law. The broker also is responsible for co-locating a ...
3
votes
2answers
185 views

Contacting customers of vulnerable software, is it wrong?

Say you're a security researcher who finds vulnerabilities and reports them to vendors to try and receive a bug bounty. If the vendor is not willing to pay any bounty for any vulnerability, you simply ...
1
vote
0answers
57 views

Would extracting logs from a European server to a US SIEM system cause privacy legal concerns?

Looking for an answer related to the European "General Data Protection Regulation." laws.
3
votes
1answer
85 views

Canadian encryption key sizes

I am looking after some legacy software that is compiled with VS2005 which uses .Net 2.0 Rijndael, which fails if the system locale is set to French Canadian. The plaintext is straight ASCII. I have ...
0
votes
1answer
94 views

Does the legality of pentesting without permission depend on its success? [closed]

If I open up the index page of some completely random website (which I have no prior contract to test), and I find myself seeing sensitive information caused by some webapp error, SQL errors for ...
0
votes
1answer
246 views

Under GDPR, is one user borrowing another's logged-in session for financial transactions illegal?

Our organization has historically been very lax with Data Protection and compliance, and we have a number of POS sales positions serving the public and taking payments; both Cash, Chip and Pin and ...