Hot answers tagged

351

This is actually an interesting new field in infosec - reputation management. Employers, Law Enforcement and other government agencies, legal professionals, the press, criminals and others with an interest in your reputation will be observing all online activity associated with your real name. These "interested parties" (snoops) are usually terrible at ...


351

It might just be because I am already "that parent", but it would be a strong NO from me - and the school administration would get a strong talking to about this. I would push to have that policy changed (though without much hope), for everyone and not just my own child. There are privacy issues. Security issues. Potentially legal issues - is the software ...


256

If the device left your sight for any amount of time, replace it. It can no longer be trusted. The cost to assure it can still be trusted significantly exceeds the cost of getting a new one There is effectively no way to verify that the hardware has not been tampered with without significant expertise and employing non-trivial resources. The only solution ...


204

According to Google, the difference is with handling referrer information when clicking on an ad. After a note from AviD and with the help of Xander we conducted some tests and here are the results 1. Clicking on an ad: https://google.com : Google will take you to an HTTP redirection page where they'd append your search query to the referrer information. ...


195

NOTE: I work at Google now. I didn't work there when I wrote this. This is my own opinion, not Google's. But it's the only opinion that makes any sense. It's also probably the most important thing I've written on this site; you must understand this to understand what online privacy is. Advertisers use what information they have to try to best guess what ...


192

Loading that page loads https://www.googleadservices.com/pagead/conversion.js https://www.googletagmanager.com/gtm.js?id=GTM-WPPRGM https://stats.g.doubleclick.net/dc.js The reason Google can track you is that the website shares details of your visit with them - in this case via loading Google JavaScript code for their ads service. *To expand on this - ...


191

Be careful about assuming too much. You say that you know "surefire" that your university is spying on you, but your only evidence is that your mom is computer illiterate and you're "sure some of them know more than they should" about you (WARNING - this is a red flag for those of us not in your situation, you do indeed sound extremely paranoid). If you don'...


185

One possible explanation is that DuckDuckGo is using the headers that are sent in your request to determine their display. For example, it is very common to use the Accept-Language header to determine in which language a webpage should be displayed. This header is set by default in all modern browsers based on the language preference settings. My browser, ...


172

Yes. Always assume yes. Even if you are not sure, always assume yes. Even if you are sure, they might have a contract with the ISP, a rogue admin who installed a packetlogger, a video camera that catches your screen... yes. Everything you do at the workplace is visible to everyone. Especially everything you do on digital media. Especially personal things. ...


165

A private key corresponds to a single "identity" for a given user, whatever that means to you. If, to you, an "identity" is a single person, or a single person on a single machine, or perhaps a single instance of an application running on a single machine. The level of granularity is up to you. As far as security is concerned, you don't compromise your key ...


163

I'm the founder of DuckDuckGo. D.W. is right, if we were to violate our privacy policy we could get in a lot of trouble. Additionally, I've tried to be as transparent as possible on how we operate, both in our privacy policy and on my blog. I've thought and explored external verification, from someone like the EFF for instance, but I don't think that really ...


162

I like to store mine on paper. Using a JavaScript (read: offline) QR code generator, I create an image of my private key in ASCII armoured form, then print this off. Note alongside it the key ID and store it in a physically secure location. Here's some that should work for you no matter what operating system you use, as long as you have a browser that ...


162

While there is no doubt that weak passwords are an issue for your company, I would strongly advise against telling your boss about the things that you have done. Your company decided against giving temporary workers access to sites and resources for a reason. Not only did you gain unauthorized access to the wireless LAN by guessing the password to the ...


158

It looks like the main site is embedding script from Adobe Marketing Cloud directly into the page. While these scripts are loaded from the same server as the main site it looks like that these scripts communicate with external servers using XHR and also download new script from demdex.net and 2o7.net according to the logs of uBlock Origin. Especially the ...


155

There is no proof that DuckDuckGo operates as advertised. (There never is, on the web.) However, that is the wrong question. DuckDuckGo is very clear in its privacy policy. DuckDuckGo says it doesn't track you, it doesn't send your searches to other sites, by default it does not use any cookies, it does not collect personal information, it does not log ...


149

Needing to install things is kind of the point of needing the laptop, so it makes perfect sense that they want to install Office, AV, and certificates. There are no surprises there. To do that, they need admin access, but I would want to revoke that access once they were done. I would want to know the list of everything they want to install, and if they ...


140

You can't vet individual lines of code. You'll just die trying to do that. At some point, you have to trust someone else. In 1984, Ken Thompson, one of the co-inventors of much of Unix, wrote a short article on the limitations of trusts. At some point, you do have to trust other people, you have to trust that whoever wrote your text editor isn't ...


138

If I delete my router's history, is it still visible and can my ISP still provide it to my parents? Or is it deleted from existence? Your ISP's record of your network usage isn't in any way affected by you doing anything to your router. You could wipe its memory, subject it to an EMP, and crush its chips to dust, and it wouldn't have any effect on them. :-) ...


137

I wouldn't. You have no real way to tell exactly what they've changed. Some schools are excessively nosy or controlling. And even if the district is being respectful of your privacy, they could have a rogue admin in their ranks. Others have been bitten. There have been lawsuits because of blatant misconduct before. They have alternatives, so ...


136

A good option is to harden your Content Security Policy. It allows you to fine-tune which resources the browser will load/run, and is supported by most browsers. Consider the following header: Content-Security-Policy: default-src 'none'; img-src 'self'; style-src 'self'; This tells the browser to disable scripts, frames, connections and any other objects/...


133

Deep Packet Inspection, also known as complete packet inspection, simply means they are analyzing all of your traffic as opposed to just grabbing connection information such as what IP's you are connecting to, what port number, what protocol and possibly a few other details about the network connection. This is normally discussed in contrast to the ...


121

A more secure alternative is to create a new keypair that you use for this purpose. Create the keypair on your boss' computer. Transfer the public key to your own computer. Connect to the server and add the public key. Now your boss' computer can connect to the server. When this is done, you can remove the key on the server. This way, your own key does ...


119

Yes, you should absolutely reject the CSR. Additionally, you should change your hosting provider as it looks like they don't know what they are doing. It is already bad enough that they sent you the private key via e-mail i.e. via an insecure medium. However, they also Cc'ed it to someone else, which is a complete breach of confidentiality. Furthermore, I ...


113

Facebook does not need to use third-party cookies to track you as you move from site to site, if the sites contain Facebook's javascript code (e.g. for the Facebook 'like' button). In this case, Facebook's javascript code can place first-party cookies on your system, and communicate back to Facebook's servers to show you ads based on sites that you've ...


108

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


106

As a very long time Tor user, the most surprising part of the NSA documents for me was how little progress they have made against Tor. Despite its known weaknesses, it's still the best thing we have, provided it's used properly and you make no mistakes. Since you want security of "the greatest degree technically feasible", I'm going to assume that your ...


105

The file and folder/directory permissions on an operating system are managed and enforced by... you guessed it right, that operating system (OS). When the operating system is taken out of the picture (booting a different operating system), then those permissions become meaningless. One way to think of it: You hire a big bodyguard (OS) to protect your house. ...


104

Disclosing the MAC address in itself shouldn't be a problem. MAC addresses are already quite predictable, easily sniffable, and any form of authentication dependent on them is inherently weak and shouldn't be relied upon. MAC addresses are almost always only used "internally" (between you and your immediate gateway). They really don't make it to the outside ...


99

It's a matter of privacy. The thing you definitely determine from the license plate in some countries is the county of the registered car. In small countries some counties have a small number of registered vehicles and that eases tracking one. Other things you may be able to determine in quite a lot of EU countries: year of birth of the owner (since some ...


98

They are using a system called ISIS which also has some more details available here. It appears to be a form of micro-tagging embedded within the currency itself (based on the comment the same technology has been used in fuels and perfumes). Basically, a specially manufactured particle is constructed and then mixed as an additive with the coin. This ...


Only top voted, non community-wiki answers of a minimum length are eligible