Questions tagged [privacy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
2 answers

How can I enable user data sovereignty in a B2B SaaS application?

We develop a SaaS solution that processes customer ERP data and provides analyses from it in a front-end. The software is a standard solution and should require as little customization as possible for ...
Dennis's user avatar
  • 13
1 vote
1 answer

How to test functionality that requires a certain internal state?

I'm struggling to test functionality in a class where the class has to be in a certain state for the functionality to work, but the class cannot be put directly into a given state by design, to ...
gotube's user avatar
  • 127
0 votes
2 answers

Do I have too much access to my users' personal media?

This would be a broad question - but I'm asking specific to the situation around an app that I've developed. In short, I've written an app that allows users to persist their photos and videos to the '...
DanDev's user avatar
  • 23
0 votes
3 answers

How to create a code that will be send by SMS to verify that it's a valid phone number? [closed]

I'm creating a mobile app that will have a verification process of the phone number like most of apps do when they use your phone. I'm also developing the back-end but I don't know exactly what is the ...
Vencovsky's user avatar
  • 351
1 vote
3 answers

Should I keep in the database a record of the user accepting the terms and coditions?

Most of applications, when you sign up, you must agree with some terms and conditions. Should the information that the user agreed to those terms be saved in the database? I asking this because I'm ...
Vencovsky's user avatar
  • 351
2 votes
1 answer

Cookie consent and facebook cookies?

As a bit of a background, we create a website where a "third party" can organize a sport event, letting us handle enrollment and other checks. Well on our website ever since we implemented a cookie "...
paul23's user avatar
  • 1,071
0 votes
0 answers

Generating fake number for a 25 digit PII number in a file containing millions of rows

I have to expose some sensitive data containing a PII column that has a 25 digit number. Rest of the columns aren't PII data. This is done such that the data can be safely shared to the larger ...
stormfield's user avatar
1 vote
0 answers

Prevent token sharing: chained single-use tokens VS a designated invalidation feature

Situation: A Client is requesting a resource from a Host multiple times, usually with minutes or hours between requests. The Client has a signed, verifiable token, which we'll call a Receipt, that ...
ShapeOfMatter's user avatar
-2 votes
1 answer

Do I need any sort of gdpr/cookie/localstorage notification if I only save data when the user creates an account?

I've made a website which is going into production soon. The website doesn't store any information about the user unless they create an account, in which case I save username, email and a password to ...
Jonas Mohammed's user avatar
8 votes
2 answers

Is XACML actually used and implemented?

I have been working for quite a lot of time on a research project at University focused on Access Control. More specifically, I am studying how to protect unauthorized access to personal data in a ...
giada's user avatar
  • 141
0 votes
2 answers

How generate an anonymous (even for system administrator) identification number from a non anonymous identification number

Premise: I'm asked to develop a system that will trace sensitive data. The data are gathered by an intermediate operator (let's call him IO) on an office terminal. The final user (EU) will show up to ...
Fabio Persi's user avatar
3 votes
1 answer

How to ensure privacy on a remotely hosted server?

If I have written a privacy tool as a .NET web application which is to be hosted on a commercial hosting site, other than hosting it in a privacy friendly country, how can I assure users that the ...
CompanyDroneFromSector7G's user avatar
1 vote
1 answer

Controlling permissions for content on web server (pattern/architecture)

I’m working on a proof of concept for a personal project and am unsure how to go about handling ‘permissions’ on content that is uploaded into the application. Problem: In this application users ...
zaza's user avatar
  • 119
7 votes
3 answers

Git philosophy: public vs. personal files: is there hybrid versioning?

I often find myself puzzled with such a questioning. I need to version my projects for two reasons: publish source code with its whole history so that people will be able to get into it, explore it ...
iago-lito's user avatar
  • 183
-1 votes
1 answer

Are there any JSON based notations for Access Control Lists? (Alternative to S-Expression)

I'm looking for a notation that is familiar to modern developers and can supersede s-Notation. (additional insight into Rivest's proposal of s-Expression is here) Is there any Swagger, JSON or other ...
makerofthings7's user avatar
5 votes
3 answers

Hide, obfuscate or otherwise prevent the harvesting of email addresses [closed]

I am developing a public repository webapp for my organization. It will be public webapp, exposed to the internet. All people and organisational units can be queried and its contact data will be ...
Pierre Henry's user avatar
5 votes
1 answer

Hide authentication information on Github

When your creating a project that has some sort of information that needs to be private (authentication details, etc), but you want to use some public repo like Github, are there anything that can be ...
TMH's user avatar
  • 248
2 votes
1 answer

How can I run a script/subroutine on a Web Server and have that subroutine remain private (eg. Key Generator)?

My Problem: I have been tasked with re-implementing a software key generator routine on an external web server running cPanel v. Currently, the key generator is implemented using a ...
Aubrey Robertson's user avatar
11 votes
1 answer

Is there something like Creative Commons licenses for privacy policies?

I've recently read Reading the Privacy Policies You Encounter in a Year Would Take 76 Work Days and was pretty shocked that it was that bad. So I thought how this could be improved. Creative Commons ...
Martin Thoma's user avatar
2 votes
1 answer

Object pointer with privileged access?

Let's say you have class Car with Car->tune() and Car->drive() class CarDriver class CarMechanic Each CarDriver and CarMechanic object has a reference/pointer to a Car object. The CarDriver object ...
donquixote's user avatar
29 votes
4 answers

Zero-knowledge code hosting? [closed]

In light of recent revelations about widespread government monitoring of data stored by online service providers, zero-knowledge services are all the rage now. A zero-knowledge service is one where ...
HighCommander4's user avatar
1 vote
2 answers

Collecting user information for debugging and support

I have a Java application that I need to support. I'd like it to collect user information, such as system information: OS and hardware for easier diagnostics and support. Are there any security &...
alexb's user avatar
  • 153
1 vote
1 answer

Information protection when registering on web sites

Up until now it seems that when you register on a random web site you do so with blind trust. You assume that the site isn't harvesting information and passwords. You assume the site is reasonably ...
James P.'s user avatar
  • 1,223
7 votes
2 answers

Is tracking Android OS.Buid/Manufacturer info a privacy issue?

On the Android operating system details about the phone are available via the Android.OS.Build class. These details include things such as the phone manufacturer, model, version, etc. The customer may ...
Alex Wiese's user avatar
1 vote
1 answer

How do PGP and PEM differ?

Email messages are sent in plain text which means that the messages I send to Derpina are visible to anyone who somehow gets access to them while they are in transit. To overcome this, various ...
Dummy Derp's user avatar
3 votes
2 answers

Do privacy concerns prevent us from accessing location-based user data?

Every time my team begins to explore the scenarios that are possible with mobile device location data, location data that is part of user data, or even location data that may be retrieved or inferred ...
Sean Mickey's user avatar
4 votes
1 answer

How easy is it to alter a browser fingerprint?

I am researching this question for a possible paper. Given the exploitation of user identities for risk management and market tracking, how easy is it to alter a browser enough to throw off ...
JFig's user avatar
  • 41
2 votes
2 answers

How long can I store the subscribe personal information? [closed]

In my subscription form I want to use a double opt-in method: First, the visitor subscribes Then a confirmation email is dispatched. If he replies... Then I add him to the system. In the case where ...
Leo Chan's user avatar
  • 211
3 votes
2 answers

Google Analytics and customers privacy

I work in a company that sells SaaS web applications for HR and financial issues. Our customers are key accounts to which we guarantee the privacy of their data, for obvious reasons. We need to make ...
GG.'s user avatar
  • 131
16 votes
4 answers

Why do certain sites prevent spaces in passwords?

It seems less common with newer websites, but many websites I need an account on (like for paying bills, etc.) prevent me from creating a password with spaces in it. This only makes things more ...
Ian Hunter's user avatar
37 votes
4 answers

Should MVC/REST return a 403 or 404 for resources belonging to other users?

When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to GET a resource that they don't have access to: 403, which says ...
Aaronaught's user avatar
  • 44.2k
4 votes
3 answers

Crash and error report to developer [from user perspective]

I have some questions regarding whether to crash or report errors to the user. We are developing a web site and mobile clients in which we allow our users to report any bugs and crashes through e-mail....
Prasham's user avatar
  • 1,059
17 votes
3 answers

How do I comply with the EU Cookie Directive?

On 26 May 2011, a new EU directive comes into force that users accessing websites should now be asked for permission to allow the website to store cookies containing information about them and their ...
Rory McCrossan's user avatar
5 votes
2 answers

Is there any risk of web browsers spying away localhost applications on an Internet-connected PC?

Despite what it might look like this is a serious question. After that story with Android OS and Chrome browser submitting to Google the details of the WiFi access points they see in the neighborhood ...
user avatar
6 votes
3 answers

Is there any legislation requiring how we store passwords? [closed]

Given the Sony data breach and other events recently, is there any actual laws or regulation regarding how to store passwords? I think there are with credit cards, you're not allowed to store the 3 ...
RoboShop's user avatar
  • 2,770
12 votes
2 answers

Saving critical data in (third party) databases

How do you save important(privacy-wise) user data like SSN, Credit Card Numbers and Addresses in databases? Scenario: Only data which needs to be available is saved. For eg, SSN is saved because the ...
abel's user avatar
  • 697
1 vote
2 answers

Conditions for a traditional friends system vs. open following system

I'm just curious for everyone who is developing social sites out there. When you build a method for connecting users, do you prefer to use a following-style system (follow me, you can see all of my ...
Dandy's user avatar
  • 111