Hot answers tagged

140

You can't vet individual lines of code. You'll just die trying to do that. At some point, you have to trust someone else. In 1984, Ken Thompson, one of the co-inventors of much of Unix, wrote a short article on the limitations of trusts. At some point, you do have to trust other people, you have to trust that whoever wrote your text editor isn't ...


114

Facebook does not need to use third-party cookies to track you as you move from site to site, if the sites contain Facebook's javascript code (e.g. for the Facebook 'like' button). In this case, Facebook's javascript code can place first-party cookies on your system, and communicate back to Facebook's servers to show you ads based on sites that you've ...


98

It's a matter of privacy. The thing you definitely determine from the license plate in some countries is the county of the registered car. In small countries some counties have a small number of registered vehicles and that eases tracking one. Other things you may be able to determine in quite a lot of EU countries: year of birth of the owner (since some ...


60

To protect your privacy and avoid tracking, nothing beats cash. There are various services that let you purchase credits in cash at a brick and mortar store, which you can then later use to purchase goods and services online. One example is paysafecard (I haven't tried it, but you should also be able to buy bitcoin with cash). There are a number of VPN ...


47

My "Composer" directory tree currently is at over 120,000 lines of code. And that's for the minimal number of crucial PHP libraries that I need. Your mistake is in trying to vet third-party code as if it were your own. You cannot and should not try to do that. You haven't mentioned any of the libraries by name, but I'm going to assume that a fair chunk of ...


42

It is to protect the privacy of the individuals. Imagine that you can link the license plate of a car to the owner. You take a picture of a car in Berlin and share it in the internet, you will be giving this information to all persons on the internet that the car was sighted in Berlin and thus violating the privacy of the owner that might not wish no one ...


41

In the UK people often obscure licence plates in photographs they post online to protect themselves or the vehicle's registered keeper (often the owner) from "number plate cloning". Number plate cloning is where someone acquires licence plates by having them produced without providing proper documentation (1). This is usually done in order to steal the ...


27

Using a VPN won't make you anonymous. The owner of the VPN service will still knows who you are from the origin IP address. In the past several VPN providers that stated that everything was anonymous in fact released all the information they had to the FBI and US Department of Justice. It makes sense that they are not private; if you commit a crime using ...


27

Welcome to the new paradigm of coding: you're using libraries on top of libraries. You're hardly alone, but you also need to understand that anytime you bring in code you didn't write, you bring in some risk. Your actual question is how can I manage that risk? Understand what your software is supposed to be doing Too often, library managers become a ...


25

Since the license plate is (indirectly) linked to a person, it can be used to identify a person. As such, it is "personal data" as defined by the GDPR. It is now illegal to share such data without prior authorization from the car owner. Because its location at a specific time can be deduced (near the car, at the time of the picture), it is an even more ...


23

In addition to the other answers: The website you visited could have sent information about your visit directly to Facebook using their "Server-side API". This doesn't need any client-side scripting technology to be enabled, because all communication happens between the 3rd party website and Facebook. The more information you give the 3rd-party site, ...


21

If the wireshark trace was made from the perspective of a passive eavesdropper, then there is nothing in the trace that could be used to tamper with future SSL/TLS connections. Keep in mind that there are many entities that are in a position to make the same trace that you made, including wireless hotspot operators, ISPs, backbone carriers, data centers, ...


17

You could use xmr.to for that. According to them: XMR.TO allows you to make a Bitcoin payment with the strong privacy provided by Monero. This means that using Monero together with XMR.TO, you can pay any Bitcoin address in the world while protecting your privacy. You buy Monero, a privacy-centric coin, send to xmr.to with the destination Bitcoin address,...


13

You cannot hide how much data you are sending and when you are online. But, Tor encrypts data and sends it through proxies before it reaches the target server, so that hides the contents of the communication and to which website or server you are talking. You can also try to hide that you are using Tor, but this is difficult and a determined ISP will be able ...


11

You could buy gift cards with cash then sell them for bitcoin on r/GiftCardExchange


11

I'm figuring that the foundational knowledge about this topic is slowly being lost to time, and there are new course modules in schools around the world to cover this type of thing, so I think it's appropriate to cover it here. There is a separation between the content of a site and the advertisements shown on the site. Sites like Instagram (or newspapers, ...


11

Reading Cross-Origin Resource Sharing CORS and the Same Origin Policy SOP are your friends here. Since the javascript in question is not hosted by http://127.0.0.1, it will run afoul of the SOP and default rules for CORS in browsers will prevent the javascript from reading the response. That covers your immediate question - you are protected by default. ...


10

HTML 5 local storage check allows you to reliably detect private browsing mode now (2019). It works by attempting to write then read "Local Storage". see: https://gist.github.com/jherax/a81c8c132d09cc354a0e2cb911841ff1 or https://github.com/jLynx/PrivateWindowCheck with PoC ------ edit to add functional description ---- From the jherax link ...


10

It records where someone was, and you don't know what that reveals about someone. Ethically This part is discussed in a lot of comments and answers. An overview: You drive around with it all day, so it gets lots of exposure already. However, that doesn't mean that even more exposure is desirable. Aganju's answer explains: posting on the internet opens ...


9

When your organization is subject to the GDPR, then it should have a designated Data Protection Officer. This person is responsible for ensuring that data protection laws are applied within the organization. This should be the first place to report to.


8

Canvas Fingerprinting The technique you are referring to is Canvas Fingerprinting. It is one of many possible methods available for website operators to try to identify and track users without cookies. The reason for this, of course, is because cookies can be cleared, or even "tricked" by things as simple as switching to a private (aka incognito) window. ...


8

Ultimately, it is the responsibility of the merchant to do whatever they can to verify that the card is not being used fraudulently - because if the transaction is later found to have been made fraudulently, the transaction is reversed by the processor. There are many things the merchant can do to attempt verify that the card being used is not stolen, such ...


8

"Monitor" can mean many things. Monitor Your Traffic If the client is not controlled by the employer, they can only monitor your traffic across the VPN on their side and not your file system/desktop. 2-way communication does not mean that they suddenly can log into your machine. It means that the traffic from the employer network might also reach your ...


7

As far as I know there is no actual proof that FaceApp is used for malicious purposes, the same that there is no public available proof that companies like Huawei (China) or Kaspersky (Russia) will knowingly harm the (American, European, ...) security. The main argument here is that there might be increased risk since the government in these countries might ...


6

Only half an answer: People are not always logical about their choices of personal information sharing. They like to have their initials and their birth year on the license plate, and show off those vanity plates, but at the same time they don't want their initials or their birth year known in the internet, and give fake birth years or initials when ...


6

I see there's a bounty because you want a more precise and up-to-date answer, but the truth is that the right answer was already given by others. I can just give you a few more details, even though I'm not a JS developer and I've never known how this stuff works either. The short answer is: they use JavaScript to implement some kind of heuristics that ...


6

Tricky question! It will be hard for us to give certain answers, we may only guess that they might employ fingerprinting techniques that match in both VMs. For example, the VMs might both have have the same operating system, user agent string, set of fonts, give the same canvas fingerprint, have similar CPU performance, etc. It might also be that they found ...


6

TLDR: Europeans are privacy aware and don't share what they don't have to share; there is a practical difference between something being public locally and globally To approach this a bit more broadly and from a cultural perspective: Europeans are often more aware of privacy issues than say Americans: They often follow the rule to not give away more ...


6

There is a saying at my company: Quality Assurance is making sure that something does what it's supposed to. Security Assurance is making sure that it does only what it's supposed to. So unfortunately, I think your questions will lead you to a full security audit or penetration test, which, as you point out, requires great knowledge and skills which ...


6

... how do we know any device is doing what it is supposed to do We don't. But this lack of absolute certainty is not specific to IT security. If you talk to your friends you don't know for sure if the they are telling the (full) truth. If you buy something you don't know for sure if it actually has all the qualities the vendor claims. But it is not that ...


Only top voted, non community-wiki answers of a minimum length are eligible