Tom: /* Context */

2025-04-08T18:07:26Z

‎Context

Tom: /* Context */

2019-04-06T23:56:41Z

‎Context

Tom: /* References */

2018-09-05T04:01:56Z

‎References

Tom: Created page with "==Full Title or Meme== A list of various ways in which identity information can be misused or misappropriated on the internet. ==Context== User private data is required for..."

2018-06-21T15:58:59Z

Created page with "==Full Title or Meme== A list of various ways in which identity information can be misused or misappropriated on the internet. ==Context== User private data is required for..."

New page

==Full Title or Meme==

A list of various ways in which identity information can be misused or misappropriated on the internet.

==Context==

User private data is required for release of web resources. Minimizing the amount of data released or its misuse after release is the object of this effort to collect a list of the various attacks and their mitigations.

There are four entities that are in play here.
#The user on a user device (aka a user agent).
#The resource provider (aka a relying party.)
#Identifier and Attribute Providers.
#Data Harvester or Broker

==Problems==

Threats against authentication, federation or user private data, as that can be used in spoofing.

* Attacks at the user device or user agent.
**User private data, including credentials used in authentication or secret seed value.
**Theft of user device or second factor token
**Data of the user's contacts' email address for spamming.
**Insertion of malware on the user's device.
**Interception of legitimate user connections to valuable resources, including elevation of priviledge.
* Attacks on the transmission of user private data.
**Interception of legitimate user connections to steal authentication data.
**Misdirection or misleading connection to attacker sites.
**Hijacking a legitimate user connection (Man in the middle attacks).
* Spoofing attacks at the resource site.
**Online guessing, when user lock-out or time-out is not applied.
**Binding of attacker's token to the user's profile at the resource
**Reuse or Replay of user credentials
***User reliance on passwords alone is known to result in password reuse, so if an attack succeeds on one site, it may work on others.
**Using data acquired by social engineering, such as using a pretext for the user to enable the authentication.
***Complex passwords that are unique to one site or service will force users to write down passwords which can be found.
**Initiating connections through other compromised sites, including compromised Identifier or Attribute Providers.
* Misuse of user private data.
**Releasing data to others.
**Data breaches.
**Social engineering at provider based on partial knowledge of user private data

==Solutions==
These are the mitigations that should be considered based on the risk profile for the resource being protected.

==References==

[[Category:Glossary]]

@@ Line 8: / Line 8: @@
 There are four entities that are in play here.
-#The user on a user device (running a user agent).
+#The user on a user device (running a [[User Agent]]).
-#The resource provider (aka a relying party.)
+#The resource provider (aka a [[Relying Party]].)
-#Identifier and Attribute Providers.
+#[[Identifier or Attribute Provider]]s.
-#Data Harvester or Broker
+#Data Harvester or [[Data Broker]]
 ==Problems==

← Older revision		Revision as of 04:01, 5 September 2018
Line 49:		Line 49:

	[[Category:Glossary]]		[[Category:Glossary]]
		+	[[Category:Identifier]]

Personal Identifier - Revision history

Tom: /* Context */

Tom: /* Context */

Tom: /* References */

Tom: Created page with "==Full Title or Meme== A list of various ways in which identity information can be misused or misappropriated on the internet. ==Context== User private data is required for..."