75

Simple answer: No If you can see it, you can photograph it. There have been countless attempts over the years to solve this part of DRM and all have failed. Instead of focusing on the barcode, have you considered making it difficult to copy the id card itself? So that security for each area can quickly check it isn't an overlay? For example a hologram ...


71

Your question is missing a lot of context, but what you do say sounds like you’re looking to settle an argument. So my answer will start with “It depends...” One reason to have unique usernames that aren’t email addresses is to protect privacy when other users can see the username. For example, GitHub profiles indicate the username in the profile URL, and ...


58

The UUID specification details several "versions" which are methods for generating the UUID. Most are aimed at ensuring uniqueness (that's the main point of UUID) by using, e.g., the current date. This is efficient but means that while the generated UUID are unique, they are also predictable, which makes them inadequate for some security usages. The "...


57

It seems like the spammer got your personal information including your password through a security breach somewhere. Why did they use your password instead of your name? I would say it was an honest mistake on their side. They just mixed up the fields when designing the spam mail. When you are still using the password somewhere, you should change it ASAP. ...


53

Simple answer is yes. Unfortunately I think you might be struggling to do so on a tight budget, barcodes can be printed using inks that are only visible under UV/IR light, so they aren't visible to the naked eye and can't be replicated without specialist equipment and inks. Unfortunately the scanners that can read these codes aren't cheap and neither is the ...


31

I know of at least one government that has a root CA: The state of the Netherlands. As far as I know they don't use it to identify people when they come pick up their driver license. I think Estonia has a system in which all residents have a card containing a certificate.


29

While a simple red cellophane does little to hide the barcode, you could apply multiple colors to hide the barcode from human eye. If the barcode scanner only uses a single wavelength (such as red), it will see the colors differently than a human or a color camera. This would be more difficult to photograph and print successfully, because cameras and ...


27

Claims are a method of providing information about a user, and roles are a description of a user by way of which roles they belong. Claims are generally more useful because they can contain arbitrary data -- including role membership information. E.g. whatever is useful for the given application. Claim Based identities are more useful, but tend to be ...


25

It depends on how smart the thief is. We work with police to catch criminals based on their IP address on a regular basis. We've got a high success rate, but we can't catch them all. Usually, the IP address is enough to trace the connection back to the ISP (Internet Service Provider). Generally, ISPs will work with law enforcement in cased of known fraud ...


25

As the answer by phillipp stated, there is a good chance they got your password from some form of security breach. I doubt that they would have obtained that through Paypal's system. It could have happened in one of the following ways, to name a few (with tips on how to protect yourself from each one). At some point you could have accessed a fake PayPal ...


24

Mapping the public key to an IP address is easy (just hash it and keep the first 80 bits) and you have listed the ways to make this somehow robust (i.e. make the transform slow). It has the drawback that it does not solve the problem at all: it just moves it around. The problem is about binding the cryptographically protected access (namely, the server ...


23

The cheapest solution for your situation in this case is utilising the human security guard to do photo check. Use the barcode tag to quickly lookup the user's record from the participant database, the database should store participant's photo and the guard should check that the participant that presented themselves match the photo on the database. The ...


22

If your adversary is a nation state actor, and you need to ask this question on StackExchange, then you're doing it wrong. You cannot be "100% safe" from a determined, powerful adversary. While it's fallacious to say "if they want you, they'll get you", it is true that you cannot be 100% safe from any powerful adversary. They will always have 0days that you ...


21

Identity is a malleable concept with an irksome tendency to morph whenever you look at it too closely. What I understand from your description is that you want to be able to track back some actions (i.e. "applying for a job") from a random network user back to the actual individual, in such a way that, should the job application be fake in some way, you have ...


21

As @Lighty said, the IMEI is a unique identifier for your phone (not the SIM card though, that would be the IMSI). You can think of it as an equivalent to a MAC address in Ethernet. The IMEI could be spoofed to impersonate you / your phone. Your phone could get traced in a network using the IMEI (It actually is to maintain your connection). The IMEI is also ...


20

This is a nobrainer. Don't let the domain lapse. Domains are cheap, security incidents are expensive.


20

To complement Sjoerd's answer: some countries even give every single citizen and resident their own certificates, stored inside an ICC that is also the primary identity document. For illustration, here are mine (and the two CAs from the trust store of my macOS computer). They're used in government agencies, post offices, pharmacies, and even companies. Many ...


19

IMEI is like a GUID (Global Unique Identifier), that identifies your unique handset. Your carrier can blacklist your IMEI by instructing the GSM Alliance to do so, so that the mobile can't connect to any networks, usually in the case the handset is lost or stolen. Your handset's IMEI is sent in the handshake process when connecting to a network, and can be ...


19

E-Mails are in fact used for user identity on many websites. There are advantages and disadvantages to this. An incomplete list: Advantages the problem of uniqueness is solved already no need to come up with or invent a username you don't need to ask the e-mail address additionally Disadvantages people do sometimes change their e-mail address it often ...


18

In case of web browsing your software configuration usually provides a pretty unique fingerprint that can be tracked as you browse. Check out the Panoptclick project. Also every piece of information you post to different sites will contain information about you. For example the time of your postings will give a clue about which time zone you are in even if ...


18

Displaying a hash of nick and password to identify users is known as Tripcode. There are different variants of this, sometimes the website operator adds a secret key, sometimes an expensive hash like PBKDF2 or bcrypt is used, sometimes the password is replaced by public key.


18

As @SteveS said, RBAC is an authorization model whereas claims are a way of providing information about a user. It generalizes the notion of a role. In the past identity servers would simply provide applications the username and the list of roles/groups. Claims generalize this such that any user attribute can be passed on to the consuming application. The ...


17

You can’t, because as long as both a human and a barcode scanner needs to be able to see the whole thing, so can a camera and copier. A barcode is no different than printing a string of text, except a machine can read it faster. Security-wise it adds no protection. This issue might not be part of the threat model — have you checked that?


15

I recommend you adopt the "one ssh key per user" model. It is easy to use for end users, simple to explain to users, and is likely to meet the security requirements. Ease of use is very important. If a security mechanism is too hard to use, people will find a way to bypass your security mechanism. An easy-to-use, pretty good security mechanism is far ...


15

Is NFC really too expensive? I found a 50-pack of MiFARE NFC stickers for $13.20, making them < $0.27 per attendee; if you plan on 500 attendees, that's $132 which really isn't that much in the scheme of a catered event of that scale. If you can manage to swing $0.89 per attendee, you can actually get inkjet-printable MiFARE cards, saving the step of ...


13

•Is there any reason (from a security standpoiny) that a government, bank, or credit card company should not be part of PKI? Mixing business and worldwide government interests isn't something most security professionals are keen on and the damage that can be caused by a rogue CA (whoever the owner was/is) is very real, so that is the main security risk. ...


12

The first big flaw of your idea is that it doesn't really solve much. Once you want meaningful names like they're currently in use, you need DNS or a similar system. So your point of failure is back, except that it's now DNS and not CAs. Putting the fingerprint into the IP offers little advantage over putting it into DNS alongside the IP, but has the ...


12

I have noticed SPAM which meets this description, and which I infer is the result of address book compromises of people who have me in their contacts. For half a dozen of my acquaintances, I began receiving SPAM with the following characteristics: My friend's name ("JOHN WAYNE") in the From: field, but with a different actual email address, often at yahoo....


11

Not sure how you are planning to carry the id cards, whether hung directly from the lanyard with a simple hole punched through the card or if in a carrier or plastic wallet hung from the lanyard. If you use the clear wallet style of carrier you could have something printed, or a sticker applied, on the outside that covers the area of the barcode but leaving ...


10

This is not very uncommon. Unfortunately you have no single solution, unless the individual is in the same locale as you (in which case you may be able to take legal action if he is causing you to incur costs) Generally, there is no technical solution, as this is a human problem. They could be doing it deliberately, as Pacerier suggests, or they may just ...


Only top voted, non community-wiki answers of a minimum length are eligible