Questions tagged [privacy]

The attribute of a system that prevents the release of data to unauthorized individuals. The ability or expectation of an individual or group to reveal information about themselves selectively or not at all.

132 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
16 votes
2 answers
2k views

What unique fingerprinting information can an iOS 10 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
user avatar
  • 1,420
6 votes
1 answer
413 views

Is there any privacy- or security-relevant difference between FIDO2 and SQRL

I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme. Both seem to use the same key elements: a private, user-resident "master key" ...
user avatar
  • 3,496
6 votes
0 answers
628 views

How does Facebook Pixel's new first-party cookie work?

Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation: You can now use ...
user avatar
  • 1,230
5 votes
0 answers
2k views

Is Cross Site History Manipulation (XSHM) still relevant?

XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
user avatar
  • 7,285
5 votes
1 answer
581 views

Should I trash my router if it still runs OpenSSL 0.9.8p and OpenVPN 2.2.2 in 2017?

I have the Easybox 904 xDSL router from Vodafone (Germany) running the latest firmware 03.17.01.17. I wanted to upgrade the firmware but found out that the latest version is from 2015 - no updates ...
user avatar
  • 151
4 votes
0 answers
143 views

How to calculate the posterior belief in bayes-optimal-privacy?

The paper "L-diversity: privacy beyond k-anonymity" (DOI: 10.1109/ICDE.2006.1) introduces the concept of bayes-optimal privacy and the idea of prior and posterior belief. A formula for ...
user avatar
  • 141
4 votes
0 answers
84 views

Did Freedom System 2.0 used to provide privacy and pseudonymity via onion routing?

I have been reading a paper known as "Freedom System 2.0 Architecture" where a user's IP traffic is being transferred between a path of Freedom Server Nodes before reaching to its end destination. It ...
user avatar
4 votes
0 answers
2k views

What unique device fingerprinting information can an iOS 11 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
user avatar
  • 1,420
3 votes
0 answers
106 views

Can Apple and Google bypass the decentralised COVID-19 tracing approach (DP-3T)?

Many thoughts have been spent on creating the decentralised, minimum-knowledge contact tracing approach DP-3T. This has been implemented in contact tracing apps of several countries, e. g. the German ...
user avatar
  • 31
3 votes
0 answers
389 views

Privacy implications of GCM on MicroG

GCM (now FCM after a change of ownership to a Google subsidiary) is a push notification framework which is commonly used on Android phones. MicroG is an open source reimplementation of Google ...
user avatar
3 votes
0 answers
123 views

How does "Fides" from the German Bundesdruckerei work?

I'm no security or cryptographic expert, just an interested computer scientist - so this question may be at the wrong place, or contain wrong assumptions. Nevertheless: The German Bundesdruckerei ...
user avatar
3 votes
0 answers
151 views

PS4 gift card online purchase asked for photo ID

I purchased ps4 gift card online and they asked for ID verification. Which I have to take a photo of my ID front and back and a selfie. Is that safe and can they do anything with this information? I ...
user avatar
3 votes
0 answers
96 views

Research on pedestrian trajectories' interaction with camera placement

I'm looking for empirical research on whether pedestrian walking trajectories are affected by areas under video surveillance. Maybe this would depend on the interval after a camera is prominently ...
user avatar
3 votes
0 answers
72 views

Attaching new device in linux only after password

Is there way to restrict attaching new devices in linux, so when attaching new device via usb, PCI, firewire and any other way, new device will be enabled only after entering password?
user avatar
  • 131
3 votes
1 answer
405 views

Offline mobile app data storage Guidelines, Standards

We are currently working on a project to develop an "offline" mobile application that synchronises data with our current cloud software solution that would allow field workers in potential mobile ...
user avatar
  • 503
3 votes
0 answers
135 views

What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?

I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7. When this happens a problem signature is presented, like this example from SuperUser: Problem Event ...
user avatar
  • 131
3 votes
0 answers
5k views

Does this list every Chrome extension/addin that may leak privacy?

I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party. To that end, I discovered: chrome://net-...
user avatar
3 votes
1 answer
1k views

Can my G Suite admin see my browsing history if: I am in incognito mode on iPad Chrome?

Can my G suite admin see by browsing history if: I am in incognito mode on iPad Chrome? iPadOS beta 3. I'm signed in with a G Suite account. If they are monitoring me, is it visible? Is there any way ...
user avatar
2 votes
0 answers
44 views

What are the main PII data brokers? (How do certain online companies get accurate age verification?)

A long time ago, I signed up for Apple Pay Cash. After a bit of using the service, I was asked to input my name and birthdate to continue using the service. At the time, I was underage. I input ...
user avatar
  • 21
2 votes
1 answer
164 views

AirTag may be trackable over Bluetooth when battery is low

My Apple AirTags are low on battery. At the bottom of the warning it tells me "When AirTag battery is low, privacy protections are temporarily adjusted and AirTag may be trackable over Bluetooth&...
user avatar
  • 1,104
2 votes
0 answers
83 views

All private subdomains found and listed, including those from my home IP

It's been my understanding in the past years that it's not easily possible to find out all the subdomains of a domain (unless these are used publicly, like in hyperlinks, etc), and likewise not easily ...
user avatar
  • 215
2 votes
0 answers
176 views

Send a Picture of my ID and a selfie of me holding it to a Questionable Website

Some website asked for the verification of my identity to make a purchase of online goods. I didn't think twice and send them a picture of both sides of my country's ID (not USA) and a selfie holding ...
user avatar
  • 21
2 votes
0 answers
96 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
user avatar
  • 941
2 votes
0 answers
261 views

Is it a privacy issue that iOS persists private keys between app installs of the same bundle ID?

In iOS apps, Apple goes to a lot of trouble to keep applications from creating a stable identifier for a specific device. For example, in iOS >= 5 they no longer allow apps to get the hardware-tied ...
user avatar
  • 361
2 votes
0 answers
131 views

Loosing internet connection while connected to specific VPN server?

I have noticed a strange behaviour earlier today on my VPN on a specific server. When I run a trace route command while connected to VPN (on a specific countries server) my internet will not work for ...
user avatar
  • 21
2 votes
0 answers
539 views

How does the "Control Frame Attack" bypass the MAC-Randomization on Smartphones?

In this Study regarding MAC-Randomization of different Smartphone Manufactures on page 15 the so called Control Frame Attack is described. I'm not sure whether I understand this correctly. Are they ...
user avatar
  • 21
2 votes
0 answers
511 views

How to protect data at rest in a small web application where it’s hard to protect keys

A small web application typically consists of a web server (e.g. Apache or nginx) and a database server (e.g. MySQL or PostgreSQL). Often, the two are hosted on a single physical server or on a ...
user avatar
  • 199
2 votes
0 answers
123 views

Can (the carrier of) a caller/callee see the position of the other ones mobile phone?

Someone came to me with the following request: He/She wants to drive somewhere without the employer knowing in his/her free time. If the employer will know about the drive, it will be bad for his/her ...
user avatar
  • 2,988
2 votes
0 answers
163 views

How to make sure your API key cannot just be copied and used

One thing I often struggle with when developing my API's is authentication. I didn't have much trouble with this when I was making them for just a single website and was able to implement the ...
user avatar
2 votes
0 answers
117 views

How can I identify invisible online tracking images?

This question refers to invisible 1 pixel images that are placed on web pages to track you via how your browser renders the image. Is there any potential way to discover these images despite them ...
user avatar
1 vote
0 answers
18 views

Is iCloud Private Relay leaking my DNS queries to my ISP?

So I noticed recently that despite iOS settings saying all DNS queries go through iCloud Private Relay's DNS servers, despite Private Relay using Oblivious DNS over HTTPS, and even despite dnsleaktest....
user avatar
1 vote
1 answer
87 views

Possible rogue admin monitoring my online activities

I teleworked for a medium-sized software company. We had a network architect who offered me a firewall to install so I could securely access on-premises resources and play around with some ...
user avatar
1 vote
0 answers
34 views

How to prevent XS-Leaks while maintaining usability?

The methods presented in https://xsleaks.dev/ are based on the fact that malicious Javascript can use Cross-origin requests to infer data by means of faulty status codes, time required, mime type etc. ...
user avatar
1 vote
0 answers
94 views

Does Windows 10 log network activity?

I've been thinking a lot about private browsing recently. Here's a scenario I've been thinking about: Let's say I have a browser installed on my Windows 10 PC called "ChromeFox" (made up, it'...
user avatar
1 vote
1 answer
187 views

What's arstechnica.com messing with my Firefox cookies?

I decided to post on Security as it's more a privacy-oriented question. I could post it on Superuser as a browser question. These days I am experiencing a strange behaviour with Firefox 92.0.1 ...
user avatar
1 vote
0 answers
268 views

Does Safari's "Prevent cross-site tracking" option ACTUALLY prevent determined efforts at cross-site tracking? (By, e.g. Facebook)

In other words: Does Safari's "Prevent cross-site tracking" option effectively prevent cross-site tracking? (Is it for purpose?) I though it would work; are my expectations off? Or, more ...
user avatar
1 vote
0 answers
119 views

iOS: What are potential privacy issues with Intune device enrollment?

I work at a large corporation and don't know how the mobile device management (MDM) is configured (and also the settings can be changed dynamically). I have a personal iPhone and the employer wants me ...
user avatar
  • 1,419
1 vote
0 answers
99 views

Nym Perfect Forward Secrecy

I recently heard about the Nym mixnet and am researching it and the Sphinx packet format. So far it looks promising, but there is one thing I'm unsure of. Networks like Tor use ephemeral keys to limit ...
user avatar
1 vote
0 answers
92 views

How can I authorize access to a resource without knowing who I've authorized?

I have a database-backed web application, with authentication via organizational single sign-on, modeling a library lending system for digital books. I'd like to allow users to check out books and see ...
user avatar
1 vote
0 answers
131 views

Can my school website see my other tabs and/or applications on my desktop?

When I am at home taking an online exam through my school website (they use Blackbaud which allows teachers to set up assessments through a website), on my personal laptop, can that school website see ...
user avatar
  • 11
1 vote
0 answers
84 views

On python installation, does the setup write any private information on any of the files from the installation folder?

I'm trying to develop some tools to share with people made with a custom python installation. I've copied the python installation folder into a .zip with the purpose to share with friends and others ...
user avatar
  • 11
1 vote
2 answers
473 views

Is there any reason to not use my real name in my email address?

Somewhat of a privacy/security question here. I'm looking to get away from Google services, especially email, and I'm wondering if there's a reason not to use my real name in the email address. The ...
user avatar
  • 141
1 vote
0 answers
136 views

Can I determine whether my phone probes base transmission station (BTS) without a SIM card?

This question is related to another inquiry on this site: Can Android phone running without SIM card be tracked (localized) by police? Accepted answer claims that: Without a SIM, your cell phone ...
user avatar
  • 162
1 vote
0 answers
118 views

Does it make sense to create a Facebook account so I can tell them not to track me?

Not sure this is the right site to ask this, but here it goes. I've never created a Facebook account, because I don't want people to know about me more than I know about them. But I do have an ...
user avatar
1 vote
0 answers
96 views

Any NFC readers (Android or iOS) able to access the ePassport raw (still encrypted) data e.g. without the Basic Access Control (BAC)?

Firstly, I assume it's possible to passively read the encrypted data from a ePassport NFC chip? All of the NFC scanning apps fail to load anything without the BAC. We are not interested in the ...
user avatar
  • 11
1 vote
0 answers
70 views

Is mutually private protocol negotiation possible?

Say I have two peers that wish to engage in a protocol with multiple sub-protocols. Naturally, it is necessary for them to negotiate which sub-protocol they should use. But what if the peers wish to ...
user avatar
1 vote
0 answers
410 views

My college manages my Google account, can they view my browsing history if I use a personal device on a home network while logged in?

I have found multiple sources telling me otherwise, but most are outdated by a year or two. If I am logged into my G-suite managed account on google, and search something up on a home network and ...
user avatar
  • 11
1 vote
0 answers
995 views

Can someone impersonate you on WhatsApp?

Well I'm not a developer so I'm here to resolve a specific question. I have been investigating this subject for a while now and I need and opinion from experts or developers which really understand ...
user avatar
1 vote
0 answers
53 views

Abstract data access to user data in large-scale webservices

I am doing research on large-scale webservices and I am trying to understand what common techniques are to prevent user data being accidentally leaked to other logged in users. Especially where end-to-...
user avatar
1 vote
0 answers
91 views

Are tracking cookies from facebook, google, etc sneaked into open source projects?

In my node.js project, I'm using a several open source libraries and frameworks like - express, express-session, bootstrap 4.x etc. I also have NGINX setup as reverse proxy. For this app's website, I ...
user avatar