Skip to main content
268 votes
Accepted

Why not use a national ID as username for every website?

Privacy. Being able to link every user account to a natural person would be the end of anonymity on the Internet. Maybe you have nothing to hide, so that's of no concern for you. But as Edward Snowden ...
Philipp's user avatar
  • 49.4k
88 votes
Accepted

Is there a way to make sure my government does not swap out SSL certificates?

If your adversary is a powerful nation-state threat actor, web PKI will not protect you. Nothing is preventing them from issuing their own certificate. In fact, many governments run their own ...
forest's user avatar
  • 66.9k
57 votes
Accepted

A government agency sent our website admin an email that our website had been defaced

It's extremely easy to fake email. If someone did fake this, I don't see how the agency would know about it. The concern is that the link they sent you was the attack itself. For example, this ...
JimmyJames's user avatar
  • 3,069
56 votes

Why not use a national ID as username for every website?

In some countries, it is simply forbidden to use the most important unique IDs in other databases than those for which it was originally meant for. For example, you would get an ID for the state-run ...
Relaxed's user avatar
  • 1,738
47 votes
Accepted

What is the best way to respond to phishing emails sent from a government domain?

It is likely that the from header has been forged. I get emails from fake .govs quite often, mostly they end up in my spam filter. The hyperlink within is either unique, allowing tracking, or just ...
AstroDan's user avatar
  • 2,248
47 votes

How do US government agencies open their email attachments?

While I cannot speak for every government agency everywhere, in highly secure environments, what I have seen [unable to disclose] is: sandbox email attachments no attachments but authorised, ...
schroeder's user avatar
  • 131k
31 votes

A government agency sent our website admin an email that our website had been defaced

A CERT (Computer Emergency Response Team) task is precisely to watch over the security problems on the actives under their constituency. In the case of national CERTs like CERT-AU, they often care ...
Ángel's user avatar
  • 18.9k
27 votes

How do US government agencies open their email attachments?

Segmentation is the key technique here. You never work with sensitive data and external data at the same time. Depending on the sensitivity, you may use a different device that may be air gapped from ...
Lie Ryan's user avatar
  • 31.4k
27 votes

Is strategic cyber-warfare feasible today?

The problem with such attacks is that neither the attacker nor the defender have any incentives to claim responsibility of the attack. As such attacks can be done with small number of people and the ...
Lie Ryan's user avatar
  • 31.4k
24 votes

What is the best way to respond to phishing emails sent from a government domain?

You should respond to phishing from .gov addresses the same way you respond to any other sort of phishing - you don't. Don't reply to the e-mail, don't click links, don't open attachments, don't do ...
Iszi's user avatar
  • 27.1k
23 votes
Accepted

What countries are at highest risk of espionage on personal devices?

Assuming you have a basic level of Cyber Security measures e.g. ecrypted hard drives, decent user name and password rules, encrypted VPN tunnels etc. I would say there are a number of issues to ...
SCH's user avatar
  • 246
21 votes

Why not use a national ID as username for every website?

As well as security, there are also colossal privacy concerns. You probably don’t want Facebook and Pornhub to be able to compare notes and link your Pornhub account to your Facebook account. And of ...
Mike Scott's user avatar
  • 10.3k
18 votes

Why not use a national ID as username for every website?

Actually we have a very pertinent case in point as to why this is not a good idea. In the US, we have long had a system of credit reporting that is based on national Id. The (absurd) presumption was ...
JimmyJames's user avatar
  • 3,069
12 votes

What is the best way to respond to phishing emails sent from a government domain?

I'd like to let the agencies involved know that they have compromised accounts This is not likely to be true. Unencrypted, unsigned email is not a secure system; it's based on data that the mail ...
ArtOfCode's user avatar
  • 572
12 votes

What does Obama's phone say about Android and phone hardware?

The phone you are talking about is not the stock Samsung S4. As you can read in the article the cameras are removed, there is a special app store only and there are special apps on it. It also states ...
Steffen Ullrich's user avatar
12 votes
Accepted

Let's Encrypt is based in the US and subject to US laws

Good questions all. I can't speak too much to other things they could do, but here's some comment on the ones your brought up: Yes, they could revoke a certificate. But while this could cause some ...
nbering's user avatar
  • 4,028
11 votes

A government agency sent our website admin an email that our website had been defaced

Unless they told you in the letter, there is no way of knowing how they were informed of the hack. The chances are that someone reported a problem, attack, or probe of some kind to CERT, and they ...
John Deters's user avatar
  • 34.3k
11 votes

Is there a way to make sure my government does not swap out SSL certificates?

Even if you have the original CA certificates the browser/OS might be modified to not properly check certificates. Or the browser/OS might be backdoored so that the plain data can be extracted ...
Steffen Ullrich's user avatar
8 votes
Accepted

Why aren't there FIPS level 4 devices on the market?

When based on a standard, especially those as stringent as FIPS 140-2, you have to go through the following processes (which are time consuming and expensive): Design Testing Certification If you ...
signus's user avatar
  • 386
8 votes

What countries are at highest risk of espionage on personal devices?

Does this make any real difference? I mean, is the goal of this question to build a list of countries where you need to be secure, and other where it is not necessary because people out there are all ...
WhiteWinterWolf's user avatar
8 votes

How do people in China get past the Great Firewall in practice?

Domain fronting using the Tor Browser is the easiest and hardest for them to block. It's quite popular because of it's effectiveness and ease of setup. Basically, it uses a legit domain like Amazon's ...
Daniel Grover's user avatar
7 votes

Why is HTTPS security allowed in most countries

In addition to @Petris's answer. In addition, here are a few reasons why government security services don't object too loudly to HTTPS: They need to use it themselves The cost to the country of not ...
Julian Knight's user avatar
7 votes

Why not use a national ID as username for every website?

Their are numerous reasons this is a bad idea. Here are a few off the top of my head. If we all had the same username for every service, there now exists a DB of all usernames (which will be leaked, ...
TrickyDupes's user avatar
  • 2,849
7 votes

Why not use a national ID as username for every website?

Other answers cover the concerns over privacy, authentication, and availability very well, but there's another, more pragmatic problem with this approach: It's simply too hard to implement from a ...
barbecue's user avatar
  • 629
6 votes
Accepted

Why would an organization like the DoD prefer to use its own Root Certificate(s)?

They do rely on generally available CA root certs for sites that are expected to be generally avaiable to the public over HTTPS. See https://www.army.mil for one prominent example. However, the DoD ...
Xander's user avatar
  • 35.8k
6 votes

Is the story about getting a visit by police for googling pressure cookers true?

The article itself clarifies that the source of the tip was an employer: Update: Police in Suffolk County, NY, released the following statement on Thursday evening: "Suffolk County Criminal ...
gowenfawr's user avatar
  • 72.9k
6 votes

Is there a way to make sure my government does not swap out SSL certificates?

Yes. Check the certificate's issuing CA and its fingerprint and/or entire public key, which you can find by viewing the certificate details in your browser. Compare these against the values seen by ...
R.. GitHub STOP HELPING ICE's user avatar
6 votes

Let's Encrypt is based in the US and subject to US laws

And They could refuse to issue new certificates. They could be forced to give your personal data (registration email, list of linked domains to your ACME account, IPs of your server, ...) to US ...
Tom's user avatar
  • 2,105

Only top scored, non community-wiki answers of a minimum length are eligible