Questions tagged [legal]

Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investigation and trial. Note that if your question matches this description chances are high that it is off-topic at this site and you'll better try law.stackexchange.com.

Filter by
Sorted by
Tagged with
-2
votes
1answer
133 views

Paid Android apps for free? [closed]

One of my friends recently made a website where one could download paid apps on the Play store for free. I also saw many other websites that do the same. How did he do it? Is it legal? If yes, then ...
1
vote
0answers
72 views

For pen testing why would the client need to sign a NDA?

I'm starting the process of doing some pen testing and other security related things as a contractor. Specifically regarding pen testing. I have been Googling around to put together some docs for the ...
0
votes
3answers
234 views

Will pentesting my own LAN violate ISP rules? [closed]

I want to learn and practice penetration testing on my own network, and I want to be sure I'm making it legal. Is there a system that reports to my ISP that I'm making suspicious activities, even if ...
8
votes
4answers
8k views

How effectively can ISPs detect illegal file sharing?

Recently the USA passed a law requiring ISPs to spy on their customers' internet connections to check for illegal file sharing. I assume that they would do this by sniffing packets, but doesn't this ...
17
votes
4answers
11k views

Best way to report a foreigner attacker's ip to authorities?

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe? From your experience what is the ...
1
vote
2answers
85 views

Is it legal to store users searches [closed]

Im developing a webshop and i got a task asking for storing users searches. Is it legal? It will be stored in a db with the fields Date, Search text, userId
0
votes
2answers
92 views

Australia's Legal Do's and Don'ts of Hacking [closed]

Just wondering what methods used in Pen-testing (Denial of service, dropping a shell, phishing, etc.) would land you in legal trouble in Australia?
5
votes
1answer
7k views

Is there a maximum allowed key size in the USA?

I've heard that using encryption outside military use has been illegal for a long time in the USA. However, I've also heard that when the regulation was updated, limits were put on encryption strength ...
5
votes
2answers
1k views

Google Account Compromised - Possible Investigation?

This morning, I've not been able to login to my Google Account. Google says, my account has been compromised and I had to walk through account credentials recovery and verify (SMS to verify phone ...
1
vote
0answers
55 views

Where can I find legal acts (USA) for storing or processing social security number, tax id, driver license?

There is a PCI DSS for credit card processing. Does somewhere exist similar requirements for personal data processing, especially in US?
1
vote
1answer
67 views

Could a cloud provider access your data?

Would it be possible that an Amazon (for example) sysadmin get into your VM (physically by going in the rack where the server hosts your VM, and virtually) and get your precious source code? and more. ...
-3
votes
2answers
301 views

Is PCI compliance required by law?

Is PCI compliance required by law? We are creating a website where we will accept customer card data and pass it to merchant API. Everywhere on the internet you will find PCI is required. But what ...
0
votes
2answers
948 views

Why SPAM mails have UK Contact Addresses and Emails?

I've seen a similarity in most of the SPAM mails I receive, that majority of them are sent from Hotmail accounts and specifically from hotmail.co.uk domain. Another thing that I noticed is, the ...
0
votes
2answers
123 views

Can employers log internet traffic of employees personal computers? [closed]

I have a suspicion that my employer is misusing their work monitoring and remote access software to check my online activity outside of work. I have the software installed on my personal machine as I ...
4
votes
0answers
585 views

How do I avoid drawing the ire of the Department of Homeland Security when prepping to run my RPG? [closed]

So I'm running a long-standing role-playing game wherein the players' characters in the game are unknowingly working for another character who wants access to the data of the United States ...
20
votes
6answers
1k views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
13
votes
7answers
10k views

Storing credit cards for automatic payments?

I have no experience with storing credit cards and I do not know anything about the legal end of this. The company I work for / develop for wants to store credit cards to process auto payments for ...
0
votes
1answer
54 views

HIPAA non-business associate for contract work

I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
6
votes
1answer
155 views

How can companies verify that a national security letter is real? [closed]

It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it. There ...
2
votes
1answer
127 views

Can I get in trouble for legitimate mistakes in bug bounty testing? [closed]

During some recent bug bounty testing, I needed to record a pcap using Wireshark, then replay it repeatedly in order to stress test a locally hosted server (which is in-scope of the bounty program). ...
-3
votes
1answer
107 views

Legal advise concerning copyright infringement (BitTorrent) and Wi-Fi hacking [closed]

Someone has hacked into my Wi-Fi and downloaded a film, TV shows and other content over a 2 year period using BitTorrent, I am now being sued by a copyright infringement company. The TV programs as ...
5
votes
2answers
435 views

“fake” phishing mails from CST

I work in the computer security team of my company and my team leader ask me to send "fake" phishing mails to my colleagues. The mails intended to lure them into clicking on the embedded links (the ...
-5
votes
1answer
205 views

IP Logs at LinkedIn [closed]

To make a long story short, the CEO in my firm was fired but she did not change her status at LinkedIn about being employed at my firm. I sent her several mail that remained unanswered. So after 9 ...
10
votes
1answer
7k views

What are the implications of running a Tor non-exit relay node?

Intuitively, running a non-exit Tor node should bring the benefit of plausible deniability that a packet originated from your device. Unlike exit nodes however, you would not have to worry about ...
-1
votes
1answer
117 views

Audio steganography and DRM

I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
2
votes
2answers
94 views

Is there an easy way to detect clients that ignore certificate validation errors (in production)?

I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets ...
4
votes
1answer
1k views

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually). I'm trying to navigate the labyrinth of US export regualtions - something I ...
2
votes
1answer
2k views

How can police get someone's search history?

Sometimes I see news articles saying that someone was suspected of a crime so the police got their search history and found various google search terms etc. What are the possible ways they can do ...
1
vote
2answers
162 views

Has anyone used a file hash to prove authenticity of a file during legal proceedings?

I've had a client come to me with a request for a feature to prove that a file uploaded to a cloud service we run is the same as the one that they subsequently stored in their document management ...
1
vote
1answer
559 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser (...
0
votes
1answer
346 views

Is PGP illegal? [closed]

Forword. The following question I have asked at first at Law Stackexchange, because it has to do mainly with legal aspects of encryption and my assumption was, that there is the right place, https://...
0
votes
2answers
132 views

Auditing user emails (illegal?) [closed]

I'm the systems administrator for a company that does a lot of outbound emails and a lot of inbound emailing to potential clients. We've had a email auditing tool running for a couple weeks that ...
8
votes
2answers
300 views

How can one easily determine which IT Security related regulations apply?

Joe Tech gets a job managing Acme Startup's IT services. Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C. Joe Tech is aware that some of these data types ...
1
vote
0answers
31 views

How can I establish origin/ authenticity of a electronic document

Scenario: PartyA had put up an online offer on PartyB's certain product, if I bought the product through PartyA's channel then I shall be entitled to an specific gift/reward if PartyB approves my ...
0
votes
1answer
250 views

Under GDPR, is one user borrowing another's logged-in session for financial transactions illegal?

Our organization has historically been very lax with Data Protection and compliance, and we have a number of POS sales positions serving the public and taking payments; both Cash, Chip and Pin and ...
19
votes
4answers
6k views

The non-compliance of the EU cookie law as a finding in a penetration test report?

I recently noticed a penetration test report wherein the non-compliance of the European Union (EU) cookie law was stated as a finding under an "other" category. I consider this more of a legal, ...
7
votes
1answer
553 views

What countries have laws in place that respect Do Not Track HTTP headers or cookies?

Google offers a Chrome plugin that uses cookies to control privacy, while Firefox offers a HTTP Header to tell websites to not track the users and log the data anonymously. This obviously extends a ...
-1
votes
1answer
632 views

Is obtaining Mac Address illegal? [closed]

Just wondering, in the US, if a retailer or restaurant wants to collect user's data through obtaining mac address, is it illegal?
1
vote
0answers
201 views

Why aren't foreign VPN companies forced to keep logs? [closed]

This link explains the inconsistency with what VPN services consider 'logging'. Certainly, there is no way for us to verify their claims without an extremely rigorous independent audit. But even that ...
0
votes
2answers
103 views

Testing network ACLs from blocked CIDR ranges

I have a requirement to drop network traffic from countries which the United States is under an embargo with. Dropping traffic from certain CIDR blocks is trivial to do with AWS VPC, but I am curious ...
4
votes
1answer
88 views

How can I prove that I adhere to stated privacy policy? What audits are effective for voluntary compliance?

I have a website and mobile app that doesn't store data or PII. Suppose I'm not subject to any special privacy laws. How can I voluntarily submit myself to an audit to ensure that I'm acting true to ...
12
votes
5answers
852 views

How should I tell an organisation that they are vulnerable when I wasn't given permission to check?

I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
5
votes
1answer
6k views

Is it possible to un-spoof a spoofed caller ID?

I know that Trapcall allows mobile telephone users to forward their calls to a toll free number, which then forwards them back to the user's telephone, allowing them to see the caller ID. However, ...
30
votes
4answers
6k views

Consequences of grey hat hacking

While I was working on a anomaly detection system (finding cheaters in a quite popular online game service) I accidentally found a way to get a password of a user in a reasonable amount of time. ...
4
votes
1answer
13k views

To get security clearance, do I need to be national of the country?

For example, if I want to apply to a job based in UK which requires security clearance, can I only do so if I'm a British national? What if I'm from another country belonging to the EU?
2
votes
0answers
49 views

Are there laws to fine certificate authorities who issue false certificates deliberately? [closed]

As we all know, server-side digital certificates are key to server authentication. Now consider the following situation (I know it may be an absurd situation, but let's imagine it's true): A hacker ...
5
votes
5answers
899 views

Am I required to hash passwords

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen? If not required in the US, but required in the ...
-4
votes
1answer
140 views

Why is data security genuine technically not perfectly possible? [closed]

Why is data security genuine technically not perfectly possible? In my country (Austria) I was a member of the team that made first laws for protecting "person-related data" for every person. Have ...
21
votes
6answers
12k views

Are documents truly “signed” by DocuSign?

I've never been happy with the explanation DocuSign gives for themselves in their own marketing material (e.g. https://www.docusign.com/how-it-works/electronic-signature/digital-signature/digital-...
8
votes
3answers
2k views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible [closed]

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...