Questions tagged [legal]

Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investigation and trial. Note that if your question matches this description chances are high that it is off-topic at this site and you'll better try law.stackexchange.com.

Filter by
Sorted by
Tagged with
0
votes
0answers
71 views

Would it be illegal to brute force to gather the information that is available publicly on a govt. website? [closed]

Yesterday the results for my class were announced and released on a website. To check my result I have to enter two things My Roll Number My Application Number I want to see one of my friends' ...
1
vote
2answers
285 views

What encryption did Encrochat use, and how was it broken? [closed]

On 2nd July, the UK's national news outlets broke the story of an "unprecedented" 4-year-long, Europe-wide investigation that, in the UK, resulted in the arrest of 746 criminals, including ...
1
vote
2answers
122 views

What are the potential security risks of using a commercial VPN service?

Commercial VPN services are gaining a lot of popularity and some of them are heavily advertising their products on social media networks and technology magazines today. The advantages of using such ...
0
votes
0answers
83 views

How do LEA and others track no log VPN users?

Other questions have been asked but not with the specific details that I have shown (no log VPN, no leaks, dynamic user agent and JavaScript disabled). Hypothetical situation Someone sends a ...
0
votes
1answer
242 views

TLD Re-direct precedence in law

I hope to soon resurrect an old web-site of many years standing: it has the URL xxxx-xxxx.com, and I still rent the domain name. Now I am not anxious to continue hosting it in the USA --- though ...
1
vote
1answer
89 views

Reason for lack of asymmetric cryptography in AWS KMS for regions in China

In the documentation of the AWS Key Management Service (KMS) I found this interesting sentence: Asymmetric CMKs and asymmetric data key pairs are supported in all AWS Regions that AWS KMS supports ...
0
votes
2answers
129 views

Would a difficult to access “Key” be an option to securely solve the Apple vs. FBI problem?

In recent times, there has been an escalating demand by legislators in the US and the world around to be able to decrypt phones that come pre-configured with strong encryption. Key escrow is commonly ...
1
vote
0answers
47 views

How to get on a list of sites that handle financial information? [closed]

Until about a year ago, I was working for one of the big tech giants. During my time there, I noticed that the IT department would do a MITM attack on any website that employees access. i.e. if you ...
1
vote
0answers
41 views

saving entire Windows event log for auditing & preserve digital evidence

As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down. ...
-2
votes
1answer
72 views

Can employees' personal properties be part of the scope? [closed]

Let's assume the customer (target) wants to have a full physical pentest done. (I'm a student and have 0 exp in actual Pentesting and Red Teaming Properties of topic: Cars (in the car park) ...
37
votes
2answers
12k views

Should I present forged documents in a Penetration Test/Red team engagement?

A previous question of mine lead to this discussion which mentioned the subject of Document forgery. I've seen many people (in videos) forge IDs and employee badges for such engagements so that seems ...
1
vote
0answers
119 views

Why does Samsung access my contacts and storage if I use their store? [closed]

If I want to access the Galaxy Store on a Samsung Galaxy phone I have to agree to a set of terms (Legal information). These terms are excerpted below: All content made available to you by the ...
1
vote
1answer
79 views

Does data inside a VPC needs to be encrypted in trasit too? [closed]

I know there are laws which require all data to be encrypted in transit and at rest. It makes sense for browser to server connections but, Does data flow within a VPC, lets say a kubernetes cluster ...
1
vote
4answers
171 views

How can Facial Recognition surveilance be misused by police? [closed]

There has been a lot of news lately about facial recognition use by police forces being banned or that it should be banned. The obvious example is that a police officer who is motivated by personal ...
0
votes
1answer
100 views

Is there a danger to client port scanning?

Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports? ...
1
vote
2answers
157 views

Protecting against planted evidence

This question was motivated by this 2018 article by the Electronic Frontier Foundation that discusses the findings from the Mark Rettenmaier case. For a bit of background on that case, this article ...
105
votes
8answers
11k views

Ex-contractor published company source code and secrets online

Just found my current company code on the plain internet. We are talking hundreds of thousands of lines of scripts and configurations, including database schemas and a fair amount of internal ...
1
vote
0answers
179 views

For pen testing why would the client need to sign a NDA?

I'm starting the process of doing some pen testing and other security related things as a contractor. Specifically regarding pen testing. I have been Googling around to put together some docs for the ...
0
votes
3answers
561 views

Will pentesting my own LAN violate ISP rules? [closed]

I want to learn and practice penetration testing on my own network, and I want to be sure I'm making it legal. Is there a system that reports to my ISP that I'm making suspicious activities, even if ...
1
vote
2answers
102 views

Is it legal to store users searches [closed]

Im developing a webshop and i got a task asking for storing users searches. Is it legal? It will be stored in a db with the fields Date, Search text, userId
0
votes
2answers
240 views

Australia's Legal Do's and Don'ts of Hacking [closed]

Just wondering what methods used in Pen-testing (Denial of service, dropping a shell, phishing, etc.) would land you in legal trouble in Australia?
1
vote
1answer
78 views

Could a cloud provider access your data?

Would it be possible that an Amazon (for example) sysadmin get into your VM (physically by going in the rack where the server hosts your VM, and virtually) and get your precious source code? and more. ...
-2
votes
1answer
141 views

Paid Android apps for free? [closed]

One of my friends recently made a website where one could download paid apps on the Play store for free. I also saw many other websites that do the same. How did he do it? Is it legal? If yes, then ...
-2
votes
2answers
641 views

Is PCI compliance required by law?

Is PCI compliance required by law? We are creating a website where we will accept customer card data and pass it to merchant API. Everywhere on the internet you will find PCI is required. But what ...
1
vote
2answers
158 views

Can employers log internet traffic of employees personal computers? [closed]

I have a suspicion that my employer is misusing their work monitoring and remote access software to check my online activity outside of work. I have the software installed on my personal machine as I ...
0
votes
1answer
63 views

HIPAA non-business associate for contract work

I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
6
votes
1answer
165 views

How can companies verify that a national security letter is real? [closed]

It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it. There ...
2
votes
1answer
142 views

Can I get in trouble for legitimate mistakes in bug bounty testing? [closed]

During some recent bug bounty testing, I needed to record a pcap using Wireshark, then replay it repeatedly in order to stress test a locally hosted server (which is in-scope of the bounty program). ...
-3
votes
1answer
129 views

Legal advise concerning copyright infringement (BitTorrent) and Wi-Fi hacking [closed]

Someone has hacked into my Wi-Fi and downloaded a film, TV shows and other content over a 2 year period using BitTorrent, I am now being sued by a copyright infringement company. The TV programs as ...
-5
votes
1answer
613 views

IP Logs at LinkedIn [closed]

To make a long story short, the CEO in my firm was fired but she did not change her status at LinkedIn about being employed at my firm. I sent her several mail that remained unanswered. So after 9 ...
2
votes
2answers
101 views

Is there an easy way to detect clients that ignore certificate validation errors (in production)?

I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets ...
1
vote
2answers
198 views

Has anyone used a file hash to prove authenticity of a file during legal proceedings?

I've had a client come to me with a request for a feature to prove that a file uploaded to a cloud service we run is the same as the one that they subsequently stored in their document management ...
-1
votes
1answer
172 views

Audio steganography and DRM

I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
0
votes
1answer
497 views

Is PGP illegal? [closed]

Forword. The following question I have asked at first at Law Stackexchange, because it has to do mainly with legal aspects of encryption and my assumption was, that there is the right place, https://...
3
votes
1answer
7k views

How can police get someone's search history?

Sometimes I see news articles saying that someone was suspected of a crime so the police got their search history and found various google search terms etc. What are the possible ways they can do ...
0
votes
2answers
170 views

Auditing user emails (illegal?) [closed]

I'm the systems administrator for a company that does a lot of outbound emails and a lot of inbound emailing to potential clients. We've had a email auditing tool running for a couple weeks that ...
1
vote
0answers
33 views

How can I establish origin/ authenticity of a electronic document

Scenario: PartyA had put up an online offer on PartyB's certain product, if I bought the product through PartyA's channel then I shall be entitled to an specific gift/reward if PartyB approves my ...
19
votes
4answers
6k views

The non-compliance of the EU cookie law as a finding in a penetration test report?

I recently noticed a penetration test report wherein the non-compliance of the European Union (EU) cookie law was stated as a finding under an "other" category. I consider this more of a legal, ...
-1
votes
1answer
965 views

Is obtaining Mac Address illegal? [closed]

Just wondering, in the US, if a retailer or restaurant wants to collect user's data through obtaining mac address, is it illegal?
2
votes
0answers
257 views

Why aren't foreign VPN companies forced to keep logs? [closed]

This link explains the inconsistency with what VPN services consider 'logging'. Certainly, there is no way for us to verify their claims without an extremely rigorous independent audit. But even that ...
1
vote
0answers
67 views

Where can I find legal acts (USA) for storing or processing social security number, tax id, driver license?

There is a PCI DSS for credit card processing. Does somewhere exist similar requirements for personal data processing, especially in US?
2
votes
0answers
55 views

Are there laws to fine certificate authorities who issue false certificates deliberately? [closed]

As we all know, server-side digital certificates are key to server authentication. Now consider the following situation (I know it may be an absurd situation, but let's imagine it's true): A hacker ...
1
vote
1answer
349 views

Required security for storing bank transactions, but not credentials

If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
-1
votes
2answers
958 views

Legal Issues around simulated phishing attacks [closed]

We are putting together a service for use both internally and for our clients using GoPhish to test users' awareness of phishing. Basically, the users will receive a phishing email and we will measure ...
0
votes
1answer
74 views

Unencrypted login page for EU (utility) company handling PII [closed]

Suppose a EU company provides me access to my personal information over HTTP, without even an option for HTTPS. Does that violate EU privacy laws? Can the company be compelled to fix its website, and ...
3
votes
3answers
252 views

How do VPNs protect identity without assuming legal blame?

I understand that a VPN is basically a computer (or a collection of computers) that encrypts and proxies your internet traffic. One popular use of a VPN is to pirate software or movies. The VPN keeps ...
0
votes
2answers
1k views

Multiple instances with the same SSL certificate legalities? [closed]

In here it said some CA's wouldn't permit using the same SSL certificate on multiple servers: Can I use a single SSL cert on two different servers?. But what about two instances from the same server. ...
1
vote
2answers
60 views

Can a website's privacy policy be made more effective by incorporating it into company bylaws?

I'm concerned primarily about the US, but also UK and Germany. Is there any way to give a privacy policy greater trust, and more effectiveness, by somehow binding it to a company's bylaws with the ...
0
votes
2answers
210 views

Legality of sniffing own traffic between mobile app and server

Recently I found a bug on a mobile app which claims to protect their users' privacy, however after connecting my phone with burp and installing a certificate I noticed that this app was sending a ...
0
votes
1answer
63 views

Two-Factor Authentication on downloadable client but not website

A friend of mine plays RuneScape, and mentioned to me that her account was recently compromised. She told me she has two step authentication on her RuneScape account, and on the email address ...

1
2 3 4 5
7