The Stack Overflow podcast is back! Listen to an interview with our new CEO.

New answers tagged

3

... how do we know any device is doing what it is supposed to do We don't. But this lack of absolute certainty is not specific to IT security. If you talk to your friends you don't know for sure if the they are telling the (full) truth. If you buy something you don't know for sure if it actually has all the qualities the vendor claims. But it is not that ...


3

There is a saying at my company: Quality Assurance is making sure that something does what it's supposed to. Security Assurance is making sure that it does only what it's supposed to. So unfortunately, I think your questions will lead you to a full security audit or penetration test, which, as you point out, requires great knowledge and skills which ...


2

Normally DNS traffic is in clear and can easily be sniffed by the ISP (just sniff port 53), making it possible to create user profiles. And not only could the traffic be sniffed but it could also be redirect to the ISP's DNS server in order to give a different answer. This is a typical way to block domains at the ISP level. DoH uses HTTPS for transport and ...


1

What uses exist of persistent data stores by apps, or by apps across an app group, that survive app (or app group) deletion If I understood the question correctly, looks like all app-specific keychain items still survive app uninstall (as confirmed by Apple Staff back in Dec 2017). It changed for a while in iOS 10.3 beta, but reverted back by GM and never ...


1

There are two underlying different questions here. What is technically possible from the work laptop. The laptop could host some attack kits that scan the other hosts on the network for possible vulnerabilities, or scan the network activity. The former attack could have almost unlimited possibilities - in fact the limitation is just how secure is you home ...


0

The following will emit the "username < email >" field from the UID packet, without requiring regexes: $ gpg --with-colons --list-keys 0xDED9B508F4E10DB2 | awk -F: '$1=="uid" { print $10 }' blah <a@b>


1

If your employer installed some sniffer software on your work laptop, which intercepts all possible packets, then it can monitor what is happening in your home network. The results can be sent from your work laptop to employer directly via network or later on, when you are in your employers network. If you don't trust your employer and want to be sure that ...


3

They would have very limited visibility even if they went out of their way to configure it; on top of that, I would not expect them to do so. They could scan your network and identify devices by IP and host name; a good scanner will often identify OS as well. Active measures of this sort are (a) detectable and (b) highly uncommon on user workstations. ...


3

Privacy is far more nuanced than that and the systems involved are extremely complex and layered and constantly changing. A single rating will not work to encapsulate all that. A movie is a closed piece of content that doesn't change. Privacy regulations include the requirement for systems to describe what information is collected and what is done with it. ...


0

Long story short, you can't unfortunately. You could ask a user to provide an encryption key the first time they login, then store that encrypted with the token, but of course the token will change if they reauthenticate (as you identified), so they would have to provide their key again at that point. For you to be able to decrypt the user data you'd have ...


Top 50 recent answers are included