New answers tagged

1

Yes - Right of access is a requirement under GDPR for EU residents, although it is not always implemented in the same way. I would start with Mozilla's Privacy Policy which has a link to a form for Data Subject Access Requests at the end - that in turn has an option for Information Requests. It also has a link to Information for EU, EEA, and Swiss users ...


1

In August 2019 information about a Key Negotiation of Bluetooth (KNOB) Attack was published. At this point it's best to assume that all of your Bluetooth devices are unsafe, unless you upgraded firmware in 2019: After we disclosed our attack to industry in late 2018, some vendors might have implemented workarounds for the vulnerability on their devices. ...


3

For Wi-Fi using the standard WPA2 Personal encryption, any device which knows the PSK (password) will be able to both sniff and inject data for any other device connected to that network. This means that a mobile phone, if connected to the same AP, will be able to tamper with connections from your laptop. However, if you are connecting to a banking website ...


0

The answer to your question is "Super cookies" The trick is about HTTP Strict Transport Security (HSTS) for something it wasn't intended for. HSTS is a modern web feature that allows a website to tell a browser it should only connect to the site over an encrypted connection. Which makes the cookies for that website work even when you're in icognito mode. ...


0

You asked many questions: Is there a way to collect the desired information without risking the person's personal information? Yes, but it's a different technical model than you're describing. Many card issuers participate in programs with 3rd party vendors designed to facilitate those third parties storing transactional data in order to help their ...


0

Does my service have to be pci-compliant? I'm only qualified to answer this one part of your question. As you correctly identify, compliance with PCI DSS is enforced through a contract, typically between a merchant and a bank, or a service provider and the entity they provide services to. If no one has required you to comply with PCI DSS in a contract, you ...


0

Is there a way to collect the desired information without risking the person's personal information? This varies entirely on how you plan on pulling the data, and even down to the users specific bank Can someone spend the user's money with this information? (If so, how?) Some places, a card number and name may be all they need to initiate a charge. Most ...


0

Credit Card Numbers are property of the VISA, Master Card, American Express and other issuers so you cannot store them without abiding their rules even if you are not a merchant. If the card passes in clear text in your system you will have to comply with their requirements. You are not forced but if you have a breach you will not be able to prove that you ...


0

Since the question was asked, the landscape has changed considerably. Today, there are two points that favor a single SSH key for all hosts. Hardware keys are getting more popular. At least the arguably most popular brand, Yubikey, only supports a single SSH key. If you are using an LDAP server for authentication, you can add an LDAP schama to store an SSH ...


0

I'm unsurprised in the very lest that the phone carrier would charge the end user for the trace and capitalize upon the situation rather than resolve it since the carrier is the medium through which the spoof calls are being made. A subrogation claim against the carrier named in the original plaintiff's petition as well would likely relieve the end user and ...


1

The best answer can only give a lawyer. To my knowledge, it mainly depends, if there is a legal base for providing Email address of one user to another user. See the Article 6 "Lawfulness of processing" in DSGVO. A few examples. (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; One ...


2

I suspect this list could be made much longer, but just from the top of my head: E-tags and other cache mechanisms HSTS (and perhaps HPKP?) Local storage Flash, may it rest in peace (perhaps included in "super cookies") Basically, you can use anything that creates some sort of state in your browser, that affects the browsers behaviour towards servers. That ...


-2

Not more than other cloud processing I would say. Apple revolutionized software distribution by allowing licenced developers from abroad to upload apps to their App Store for global distribution with payment processing by Apple, after initial success with USA based developers (iOS 2 july). TechCrunch has a reply by the appdevelopment company. Founder ...


7

As far as I know there is no actual proof that FaceApp is used for malicious purposes, the same that there is no public available proof that companies like Huawei (China) or Kaspersky (Russia) will knowingly harm the (American, European, ...) security. The main argument here is that there might be increased risk since the government in these countries might ...


9

When your organization is subject to the GDPR, then it should have a designated Data Protection Officer. This person is responsible for ensuring that data protection laws are applied within the organization. This should be the first place to report to.


Top 50 recent answers are included