What are websites methods of collecting audio fingerprint? Is it by JavaScript or Java applets or flash plugin?
How to counter it?
Does it work on Android?
You can block them with permission settings
For websites there might be a security risk when using lesser known or less secure browsers. But Chrome for example allows you to manage permissions per domain or stop it all together:
https://support.google.com/chrome/answer/2693767?co=GENIE.Platform%3DAndroid&hl=en
https://ccm.net/faq/30701-prevent-websites-from-accessing-your-camera-and-microphone-on-google-chrome
On Android apps, apps need to explicitly ask for microphone access before recording anything:
https://www.avg.com/en/signal/guide-to-android-app-permissions-how-to-use-them-smartly
https://www.psafe.com/en/blog/prevent-apps-using-microphone/
If your concern is purely about your own security, the links I shared have steps for managing your privacy.
Related
I am working on a major update to my app and I wanted to take advantage of Firestore's offline persistence (web) as a caching layer (as described in this recent Firebase video: https://youtu.be/iQOTjUko9WM ).
I have a tester who swears she has no security-related extensions installed. Or even any sort of third-party app meant to 'harden' a device.
But my app's offline persistence does not work for her... and only her, out of about 20 testers.
In Chrome she sees a message "Audit usage of navigator.useragent navigator.appversion and navigator.platform" in her console (but hasn't toggled the triangle to see if there is more info).
In Edge she sees "tracking prevention blocked access to storage for..." and that is followed by "FirebaseError: Failed to get document from cache..."
Is there some sort of permission request needed in some cases? Or some sort of 'defensive' check I need to add before using getDocFromCache()?
I really want to use offline persistence as a cache to prevent unnecessary reads as the user moves around in my app. Thanks in advance!
Sounds like they've got strict tracking prevention mode enabled in Edge (and the equivalent in Chrome).
Have them check (for Edge) Privacy, search, and services -> Tracking Prevention. If it is set to Strict move back to Balanced, also check for Blocked trackers and/or allow an Exception.
I'm currently working on a project using visual studio 2010. I will like to know how to use a thumb drive to authenticate security in asp.net.
For example, when you insert a thumb drive from the user computer(example D: drive). The system is able to track that this is the correct drive plus the thumb drive and then the user will be able to view the page. If the thumb drive is removed or not insert, it will redirect you to a lock.aspx screen till the thumb drive is inserted back again to the correct drive.
I am thinking using the serial number as the key to know which is the thumb drive.
It is something like the (USB predator) but I am trying to do it on a web application instead on Windows.
Anyone can give me a guide on how to start or tools that I can use for this?
The problem consists of two parts.
First, you need to have something on the client which will check the USB device. Browsers themselves won't do this for you unless you have a power to build some custom version of the browser (Chromium- or Mozilla-based, for example) and have your users install and use this browser. Alternatively you can create a plugin for the browser, which will do the job. One more option is to have some applet on each page of your service. In case of plugin you need to have the client install it and the plugin host itself (browser) should let the applet connect to USB device in some way. In case of applet see below.
Second aspect is the use of the USB drive. Such drives can be easily copied or stolen, so their security is low. There exist USB cryptotokens, designed as part of their functionality for client-side authentication, the task similar to yours. USB cryptotokens contain certificates with private keys and/or they can contain symmetric keys or other information which (A) requires the user to enter PIN to access this information and (B) is not extractable from the device (keys can be used but not copied). Both A and B significantly increase security.
USB cryptotokens require that the user installs the driver for such token, also the tokens are more expensive than regular flash memory. On the other hand, they can be accessed from Java applets relatively easily (and maybe from browser plugins too - this depends on the browser) AND they can be used for authentication in a safe way by performing cryptographic operations instead of pure transfer of the serial number or alike.
To sum up, you can build a login scheme but you will need to make the user install something (plugin and/or USB token driver or custom browser).
I have a bit of a difficult situation in that I need a way for a client connected to an ASP.NET MVC site to sign and decrypt blobs with their private key, such that the server never sees the private key material. In the decryption case, these are encrypted session keys. It is acceptable that the server see the session key, just not the users private key.
That is, I need to present the user some content in a browser, have some javascript (or java applets, or silverlight, etc.) execute client side that communicates with a hardware token on the client, and returns the result to the server.
This is NOT client side authentication. I don't need to simply authenticate via IIS with a certificate. The hardware tokens are HID OmniKey USB readers.
My understanding of the options available are:
1. Mozilla Javascript Crypto - This seems to be the optimal route. It appears that Firefox exposes various smart card events and functionality to remote sites. I see how to sign text, but nothing about decrypting blobs (the largest goal). There seems to be methods for loading a PKCS#11 module, but the documentation seems to stop after that.
2. Silverlight with Elevated Trust - This is my second preferable route, because of familiarity with Silverlight and .NET. Silverlight 5 has the ability to P/Invoke, so I could always call the PC/SC modules, but this requires running Out of Browser, which I can't do. There seems to be some posts about running a Silverlight app In Browser with elevated trust, but this is a global setting, and so I don't want to diminish security for other applications.
3. ActiveX - An ActiveX component can interact with the PC/SC module, but this would be an Internet Explorer only solution. If forced to pick a required browser, I'd prefer Firefox or Chrome.
3. Firefox/Chrome Extension - My understanding is Firefox XPCOM is C++, and I can just directly call the PC/SC libraries, and the extension can interact with scripts/DOM on the remote site. I'm not sure how the remote site though can trigger a Firefox extension. In other words, how does the remote site tell the extension "ok, it's time to sign"? One such example of this route is XSign (though it doesn't use hardware tokens).
4. Java Applet - This might ultimately be the only way to do it. I've found a couple examples/guides, but I'm not familiar with Java. Java Applet for Signing with a Smart Card. In this case, it's just a simple applet that can communicate with the token, and post the results to the site.
Are there other options available? I believe option (1), Mozilla Javascript Crypto is the best approach, but the documentation is beyond sparse. Thanks for any guidance.
I have virtually examined all options. The last option (Java Applet) is the most appropriate for your case and easiest to implement. The downside is that JRE (Java Runtime Environment) should already be installed at client side and plays nice with the browser. User also has to grant permission to the applet to connect to his smart card at first run.
BTW if you want to use PKCS#7, you can use Bouncy Castle. It has no standard API in JDK.
PS: Don't use JavaScript for cryptography. Javascript Cryptography Considered Harmful.
Maybe you could consider just having the clients download a native application and install it (once). You can have them use that app to do the authentication and negotiate a session key with your server - the app could then launch a browser with the session key in the launch url. "Native" apps could probably be not that native - use java or .net (if you're windows only) or python etc.
I am developing a flex 4.5 web based application and I need to make sure if the client chooses a certain level of security, each user can log only from an authorized computer.
So the question is how can I get some unique computer information? Anything like HDD serial number, CPU specifications, motherboard information, even the user that is logged into the Operating System can do.
So far the information on the web isn't giving me much hope that this can be achieved, but I had to ask.
Thanks in advance.
I suppose the only option available for web application is to create unique id from fields of flash.system.Capabilities class.
Other strategy which can be used is to generate unique UID in process of computer's authorization and then store it in local storage using SharedObject. Then web app tries to read authorization data from SharedObject on web app start. If there is no such data computer isn't authorized.
Richard is right. For security, unique identifying information is not available for applications running through Flash Player. You could write an Active X control (for IE) or a plugin (for Mozilla based browsers) to obtain additional information for your app if users (and their IT administrators) allow it. Information available will vary depending on the browser and operating system the user is running.
Adobe Air, on the other hand, allows access to additional network information including MAC address in the NetworkInfo class. Maybe it's worth considering an installed client app for users who require the additional security. Take a look at: http://www.adobe.com/devnet/air/flex/articles/retrieving_network_interfaces.html
This is not easy using a browser based Flex application, but there are some workarounds.
The browser based Flash Player can communicate with an AIR app on the desktop using localconnection. So, you could create an AIR app that utilizes NativeProcess to retrieve your machine specific information.
You could also use NativeProcess from a AIR app without using the browser at all.
A third option would be to install an application server on the client machine and have the browser based app communicate with the server to retrieve the client information.
I consider most of these options too difficult to be practical, but it depends on how important this feature is to you.
The Flash Player security sandbox will not let you read anything unique about the system on which the SWF is running, so I'm afraid this is not possible. The closest you will get is likely Capabilities.serverString along with maybe IP address, but the serverString property just lists all the capabilities of the client, which is obviously not a unique thing, and also might change from time to time for the same computer.
Warning: my knowledge of server-side scripting is limited to say the least.
This isn't a technical solution, but rather a different approach to your problem.
An alternative solution to would be to inspect the raw packet at the server in order to obtain data such as the IP and MAC address. Based on this the server can then deny or allow the login attempt.
I am used to working on embedded web servers running on micro controllers where C-based black magic is rather common, so I am not sure if this is possible or practical in a more traditional environment.
I have two applications which access camera and mic written in flex.When these two resources had to be used it ask flash player asks for the use of system resource Allow or Deny Is there any way to by pass this.In gmail->settings->chat->view settings it doesnt ask for this confirmation.How to code this
No, it's not possible to bypass this dialog. I couldn't find the gmail feature you were referring to, but I highly doubt that they have some way of working around this security barrier.