59 votes
Accepted

How could a security control introduce a privacy issue?

Many security controls around authentication require you to collect additional data from the users, which has privacy implications. For instance: If you require an email address to sign up, you need ...
Gh0stFish's user avatar
  • 10.9k
52 votes
Accepted

Domain about to expire. Afraid that new owners will spread malware

Unless your freeware is somewhat popular or used by high-value targets, its usefulness for conducting supply chain attacks is probably limited. If the domain name enjoys good SEO, I would rather ...
Kate's user avatar
  • 7,917
39 votes

How could a security control introduce a privacy issue?

A good example of a security control that opened the door for a privacy issue is HSTS. HSTS allows a domain to include a header in a HTTP response to instruct a browser to always make subsequent ...
mti2935's user avatar
  • 23.4k
34 votes
Accepted

Pros & cons of including requesting IP address in password reset emails?

if you're putting someone else's email into a reset process, do you have any real expectation of privacy? This statement is based on the idea that putting someone else's email into a reset process is ...
schroeder's user avatar
  • 129k
24 votes

Are banking and finance apps safe on an Android phone with cracked apps?

The security on the system depends on the security of the hardware, the OS and the applications. While there is a strict separation between apps by design in modern smartphone OS, there are regularly ...
Steffen Ullrich's user avatar
21 votes

Domain about to expire. Afraid that new owners will spread malware

Cost makes a big difference. Some people think keeping a domain means spending hundreds of dollars a year because "that's what we've always paid", but that really is not the case. If the ...
manassehkatz-Moving 2 Codidact's user avatar
13 votes

How could a security control introduce a privacy issue?

One example is a 2FA system that reveals part of the user's phone number, even when the password is wrong. Yes, I actually have used a system like that.
Solomon Ucko's user avatar
13 votes

Pros & cons of including requesting IP address in password reset emails?

The intention being that if someone is receiving unexpected reset emails, this allows them to do a basic level of investigation I would question whether a full IP address is the best solution to this ...
Gh0stFish's user avatar
  • 10.9k
5 votes
Accepted

Should the use of the HTTP 'ETag' header be avoided for security and privacy concerns?

Are inodes the only type of known information disclosure through ETags or are there other examples of information disclosure through ETags? The purpose of Etag is to detect if a file has changed and ...
Steffen Ullrich's user avatar
4 votes
Accepted

Why reveal or hide folders' absolute paths in link sharing?

Actually, the first link is to Sharepoint. Sharepoint is a file system service that has a very different original purpose and design from personal drives. File structures in Sharepoint are exposed. ...
schroeder's user avatar
  • 129k
3 votes

Pros & cons of including requesting IP address in password reset emails?

I believe this is against privacy laws in addition to the other answers. California’s privacy law considers IP addresses as Personally Identifiable Information (PII) if used as an attempt to identify ...
Jarrod Christman's user avatar
3 votes

GPS metadata in uploaded pictures: vulnerability or not?

I think the concept you are looking for is "Hazard" not "Vulnerability". Vulnerabilities are Hazards, but Hazards encompass far more than Vulnerabilities. Let's take a look at this ...
schroeder's user avatar
  • 129k
3 votes

GPS metadata in uploaded pictures: vulnerability or not?

If a web application (like an internet forum, social media, etc.) does not remove GPS metadata (EXIF) from uploaded pictures, is it considered a security vulnerability or not? It's not a ...
ThoriumBR's user avatar
  • 54k
3 votes

Domain about to expire. Afraid that new owners will spread malware

I wouldn't worry too much about them spreading malware on your domain unless it was fairly prominent, it just wouldn't be worth the effort. What you do need to make sure of though is that any accounts ...
ScottishTapWater's user avatar
3 votes

Are Bluetooth and/or NFC anonymous?

Not anonymous. Yes, connected devices could compare hardware. Using the Bluetooth Address: https://learn.sparkfun.com/tutorials/bluetooth-basics/how-bluetooth-works https://macaddresschanger.com/what-...
schroeder's user avatar
  • 129k
3 votes

Any tool that can prevent ISP from knowing which websites we visit? beside tor?

Two methods that are commonly used to prevent ISP's from monitoring the sites that users connect to are VPN's and TOR. With a VPN, the ISP can see that the user is using a VPN. Also, the VPN provider ...
mti2935's user avatar
  • 23.4k
3 votes
Accepted

Backup GPG private key in KeePassXC

The entire database is encrypted including the notes. The security of both the program and the file format is analysed indepth in KeePassXC Application Security Review by Zaur Molotnikov. From the ...
Esa Jokinen's user avatar
2 votes

How could a security control introduce a privacy issue?

This is widespread in countries with strict privacy laws and when these are applied in a company context. A typical example of such a country is Germany. Any system (including security ones) you ...
WoJ's user avatar
  • 9,038
2 votes

Domain about to expire. Afraid that new owners will spread malware

Is the domain popular? If it gets reasonable amount of tracking you can look for a cheap registrar and put information that software is no longer supported and place Google ADs on it. It might be ...
Marcin Raczkowski's user avatar
2 votes

GPS metadata in uploaded pictures: vulnerability or not?

No, it is not a vulnerability. Definitions of vulnerability may change, but in general it is something like: Vulnerabilities are flaws in a computer system that weaken the overall security of the ...
Ljm Dullaart's user avatar
  • 2,125
2 votes
Accepted

Does Signal store mobile phone numbers server-side in plain text?

They send you an SMS to verify the phone number. Not just the Signal Foundation, but also some third party (Twilio?) that sends the SMSes gets your number. Signal may or may not store it thereafter, ...
Luc's user avatar
  • 32.9k
2 votes

Are banking and finance apps safe on an Android phone with cracked apps?

In addition to the issue of the OS having vulnerabilities that can be exploited by an app (to then target other apps), the banking app can also have vulnerabilities that can be exploited from another ...
tim's user avatar
  • 29.6k
2 votes

Are Thunderbird email accounts kept private between them?

The accounts are all accessed and managed through the same Thunderbird process, so in that sense some sharing is unavoidable; if there's a bug or a security exploit[1] via your personal account, this ...
CBHacking's user avatar
  • 48.4k
2 votes

Is having my college's VPN client on my personal laptop safe in terms of privacy?

The college has access to the plaintext data you send over the VPN. This could include, for example, website data (if the site uses plaintext HTTP) or the domains you're accessing (if the VPN assigns ...
Ja1024's user avatar
  • 5,907
2 votes

Is having my college's VPN client on my personal laptop safe in terms of privacy?

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/VPN/RemoteAccessVPN/VPNSophosConnectClient/index.html makes it sound like the Sophos SSL VPN is just ...
Joseph Sible-Reinstate Monica's user avatar
1 vote

How much info can employers find out about an employee publicly?

The process you are trying to describe is called OSINT (Open Source intelligence). It's the process of gathering information from public sources. Google is the biggest tool for OSINT, but there are ...
schroeder's user avatar
  • 129k
1 vote

Does Signal store mobile phone numbers server-side in plain text?

Yes. No matter if it's plaintext, hash or encrypted information, or if it's data, credentials and/or payload(s), companies must comply with the law "Required disclosure of customer communications ...
0100101000110011's user avatar
1 vote

How could a security control introduce a privacy issue?

While you already accepted a very good and quite detailled answer, let me try to add another one, commensurate to the level of the question: What kind of security control would cause a breach of ...
AnoE's user avatar
  • 2,389
1 vote
Accepted

Does it make any difference for what an ISP might see if we use a non-standard port for HTTP and HTTPS?

The domain can be hidden in TLS 1.3, even if this isn't currently supported in all browsers. TLS uses the Server Name Indication (SNI) extension to specify the hostname it wants to connect to. In TLS ...
Ja1024's user avatar
  • 5,907
1 vote

dmarc privacy concern with microsoft reports

The envelope_to field is optional for the sending service to include in the aggregate reports (in XML format) as detailed by de minOccurs="0" part of the element explains in appendix C: ...
Reinto's user avatar
  • 267

Only top scored, non community-wiki answers of a minimum length are eligible