Hot answers tagged

102

Listening using the microphone is unlikely Listening secretly without consent While listening using the microphone for collecting data would be technically possible, there's a few things against the theory. The unifying factor is that secretly monitoring conversations is considered unethical and would probably even be illegal. Getting caught of such actions ...


30

I have experimented some time ago on this topic, by choosing a small pool of plausible products, verifying they were not appearing in my ads, and then discussing aloud (orally, not electronically) far and wide a randomly-chosen half of them with trusted friends involved in the same experiment, and carefully not discussing the others. After some time we also ...


21

If it is not secure, are there any better alternatives? It's secure for certain threat models, and the best tradeoff for accessibility vs attack surface. To intercept an SMS, you have to have some control over the routing of the messages or the device receiving it. Without privileged information / insight provided at the carrier level, SMS is the best ...


18

Originally this question wasn't about SMS verification (e.g. for password recovery or MFA), but validation of the phone number. This answers to that question. The purpose of the verification is not to validate ownership of the number, but only access to it. Verifying the ownership of a subscription would be a legal thing and require legal documents. Parents ...


11

Someone else around you could have "given the information away". Example... You talked about a holiday with your spouse. Your spouse did not mention it, but did some research, using a shared computer for instance, maybe even using your mobile, using their own device with your account somehow logged in, or from the same IP address. Advertisers now ...


6

Yes they are listening. I've been testing it by specifically talking with some people about set subjects that you are not likely to need in a daily life. For example, we had a talk about army clothes, discussing how different armies dress. It was situational and this is not a topic any of us was ever interested in, like, at all. We also never searched ...


5

As the press reported it, Facebook does record mic of messenger : https://newatlas.com/computers/facebook-not-secretly-listening-conversations/ In this article, they speak about messenger app conversation eavesdropped and transmitted to humans in order to check if the AI correctly transcribed it. The invoked reason is that the AI listen when the user uses ...


4

I doubt it. If that was the case, tech researchers would have already detected issues and reported them to the press. Thus all of these “smart” devices that can listen are very carefully managed to ensure that when you shout “Alexa…” or “Hey Siri…” then — and only then — do they act on the sounds around you. Can you imagine if it could be proven that Google, ...


3

It seems probable. "Reputable" companies already don't mind overreaching with this for their voice recognition, often sending off recordings of you even when they weren't actually locally recognized as a command so they can analyze it for their own gain like improving speech recognition: David Goldman (CNN): Your Samsung TV is eavesdropping on ...


3

In my understanding this means, that the security relevant implementations should be centralized or included as isolated plugins/libraries. This ensures, that security relevant functionalities can be easily maintained and updated. E.g. when you have your crypto methods distributed all over the app, it is much harder to keep an overview and update them ...


3

Scenarios like that are possible, but not without consequences. Your list continues like this: A victim reports this to the police. The perpetrator loses license to operate as a franchise due to this abuse. T-Mobile hands over the identity to the police. Criminal charges are easy to bring as the evidence is overwhelming. A more typical SIM swap scam is to ...


3

Is this a secure or even common practice, and does it put me at risk of having my credit card details stolen? This is common practice, and if done properly, is secure. This is what's referred to as a CNP (Card Not Present) transaction. Securing card transactions over telephony is challenging and there is a PCI Security Standards document dedicated to this ...


3

I think there's a lot of speculation here, and while I haven't done extensive research myself, this article I found last year seems to be well researched, and has a very plausible explanation. If I can find other's similar that I've read in the past, will add them shortly. I think what this mostly adds to the current top answer is pointing out the massive ...


2

CORS doesn't prevent anything, and it doesn't protect the server. It simply tells a conforming client (a browser) what is permitted for the protection of the browser's user; CORS is a way to carefully make holes in the browser's Same-Origin Policy. Additionally, CORS headers are advisory, in that they don't actually prevent anything from happening. They make ...


1

This is not possible using http headers alone. CORS only applies to browsers, not to any other clients. If you want to restrict api calls to your app, you need to implement some form of authentication. However, if your app is publicly available you have no way of keeping an api-key or something similar a secret if it is not unique per app installation.


1

Installing malware through websites is not as common as you seem to think. The malicious website needs to exploit a vulnerability in your browser which permits to get root access (quite uncommon). So, as far as your browser is up to date, only the 0days (rare) could affect you. But, even with less privilege, the malicious website could still tamper the ...


1

As all software based techniques have a potential to be flawed or hacked (and, as @Jason commented: an app that is seemingly not running might still run), there may be a 'hardware' based solution: A good old sticker that covers the camera (only really practical for the front facing camera) is a solution that's not hackable. 'Camera cover slides', available ...


1

There is a type of attack on these verification systems that has existed in the wild for a couple of years (at least). Here is how it works: An attacker calls the target institution posing as an account holder and requests services. Another attacker working in tandem calls the victim posing as a representative of the same institution investigating possible ...


Only top voted, non community-wiki answers of a minimum length are eligible