73
This seems like a very wrong medium to send such information via.
Email is used for the same reasons Social Security Numbers get re-used as account identifiers in the US: Ubiquity.
Not everyone has a Facebook account. Not everyone has a Twitter account. But almost certainly, anyone with Internet access has an email account. It is a reasonable expectation ...
25
While you correctly identified problems with e-mail, a mail based verification is still considered sufficiently secure for many cases. While there are alternatives like SMS based verification, automated phone call or even snail mail, these are not as easy and cheap to use as e-mail.
The optimal security measures are usually a balance between usability (i.e. ...
13
Email is the least worst option.
It's not just the ubiquity of email. Email is federated, standard protocol. No one entity controls email. Email is a marketplace. You choose your email provider. Don't trust them? Take your business elsewhere. There's thousands and, from an authentication perspective, they are all equivalent. You can even run your own service,...
5
It is a simple method for low(/medium) security services with no obvious better alternative. IMHO it may be in many cases a reasonable compromise between usability and security without advertising identity of your "tracking device" (cellular phone number).
5
Face detection software is ubiquitous. There's no way to put up an image of your face and allow humans to recognize it but not computers. If you're putting your image online, expect it to be mined.
You can make it a little more difficult for facial recognition software to know that it's looking at a face (which is sufficient to prevent it from knowing who it ...
5
Was typing in my password into an HTTPS website
...
When I type in
Username123
Password123
Can the internet provider see it just like that?
Typically, no. The application-layer data you mentioned (username/password) is encrypted via Transport Layer Security (TLS) as it is passed from the application-layer to the transport layer.
In principle, only the web ...
3
It depends on your goal, so your question might be too broad.
If you want to show your real face, but at the same time don't want your face to be analyzed by any AIs, then it's impossible, because your face will be processed by some AI sooner or later. Even if a particular social media site didn't use AI at the moment, it might start doing so in the future.
...
2
The notion is that you have an alternate channel. Most of the time a web account was created then verified by email.
You registered originally giving your email address. Now what does it take for a Black Hat to steal your account:
He has to know your login and your email address. (Often the same.) With these he can send a request to change your password.
...
2
Everyone has an E-mail address and is willing to use it to register on some website. And you can easily create disposable addresses. So it is convenient for users - and cheap.
On the other hand not everyone is willing to share a phone number and even SMS is not considered secure these days.
Not long ago, I had to register for an auction and the credentials ...
2
The dummy, i.e. unconnected, microphone plug was a commonly recommended security method many years ago. It worked by mechanically breaking the circuit to the internal microphone in order to connect to the non-existent external microphone.
Those days are long past, despite this now misguided security recommendation.
Nearly all modern devices use software ...
2
Key splitting (best case scenario)
The ideal cryptographic algorithm for this purpose is Shamir's Secret Sharing, as it provides Information theoretical security, meaning it's mathematically impossible to recover the actual key without having the k number of shares specified by the person splitting the key.
We don't know how many shares are needed, and/or if ...
1
Media attachments are shared and forwarded more frequently to multiple recepients than messages. If retention period is small, the attachment has to be reuploaded by the sender.
Sender encrypts media elements with AES-CBC-256 key and uploads it to the server. The sender encrypts the key and the URL and sends it to the recepient. If the sender and recepients ...
1
It explains what it means. It's not storing messages it is storing media.
Since transmitting media can take a lot of bandwidth, it is better and easier for everyone if there can be a copy that is cached somewhere for lowered traffic needs and faster access. If a lot of people in the group and accessing, downloading, and playing that media over a long period ...
1
My question is, is it possible to get your other operating system hacked even while Kali Linux is plugged in and the primary OS is "Sleeping"?
If you don't have full-disk encryption enabled on your computer, and you get hacked while running another OS from an external drive, then the attacker can mount the main computer's drive and compromise your ...
1
As @hft's answer points out, no, your ISP typically cannot read HTTPS traffic. However, they can tell the length of traffic sent each way (possibly not precisely if a block cipher is used), which is sometimes enough to determine some things about the encrypted traffic. They can also see when data is sent each way - how many requests (and responses) are made (...
1
You can easily build yourself a "mic lock" by getting the cheapest wired microphone solution that will work for your hardware (for example a Bluetooth dongle with a microphone that goes in. The cheaper the better, since cheaper means it won't have things like multiple microphones or Noise Cancellation microphones or things like that.
Also, cheapo ...
1
An activation code does only that: it activates the Windows license. It doesn't add the installation under the control of your school, like logging in to the computer with an organizational account would do (Intune, Autopilot etc.).
However, using such licenses on personal devices might be a violation of the license terms. But that's a bit out of scope for ...
1
This answer assumes the earphones are a slave device and the phones are master devices. Each Bluetooth pairing is distinct using a different Longterm Key negotiated at the point of 1st pairing and then re-used as part of session authentication. There is no reason why a Bluetooth device should 'leak' information to another paired device.
Regards the 2nd part ...
Only top voted, non community-wiki answers of a minimum length are eligible
