Safety and Security on the Internet - 0 views
-
Why Should I Worry About Security? The Internet is a global collection of Interconnected Networks that facilitate information exchange and computer connectivity. The Internet is comprised of many different computers, all of which fall into two categories: servers (also known as "hosts") and clients (also known as "guests") -- technically, everything on the Internet can be considered a "host," but for this discussion, we'll use "hosts" and "guests." Guest machines send bursts of computer data called "packets" which are analyzed by the server belonging to the guest's Internet service provider. If the data is located locally (on the ISP's machine), the ISP's server will return the packets. If the information sought is not local (on another machine), the ISP's server hands off the packets to a router, which then sends the packets to the server containing the information. Once the information is located, it is sent back to the guest machine. There are many different types of computers that fill these two categories: mainframes, minicomputers, PCs, Macintosh, Unix and others. Despite the many varieties of computers that combine to form the Internet, every computer connected to the Internet needs to be able to communicate with every other computer -- without this ability, there is no Internet. All of these computers are able to communicate because in a sense they can all speak the same language -- TCP/IP. TCP/IP actually isn't a language; it is in computer terms what is known as a "protocol." A protocol is simply a standard for transmitting and receiving bits of information. As long as all of the interconnected computers follow the same protocol, they can exchange information. Unfortunately, when data is sent from one computer to another on the Internet, every other computer in between has an opportunity to see what's being sent. This poses an obvious security problem.
-
Say you decide to purchase concert tickets on the Web. To do so, you need to fill out an electronic form with your name, address and credit card number. When you submit the form, your information passes from computer to computer on its way to the concert ticket web server. It is possible that someone could be watching the data passing through one of the computers that is in between your computer and the concert ticket server. No one knows how often this happens, but everyone concedes it is technically possible. And its also possible off the web, too -- E-mail can be captured (and read, if not encrypted), as can file transfers via unsecure FTP. If someone wanted to, it wouldn't be too difficult to connect a capture device to someone's phone line (assuming they use a modem to connect to the Internet) and steal an electronic copy of the data exchanged on the Internet. Even if you make your purchase on a secure web site supporting the latest security features, it has been recently shown that secure sites can cause Internet Explorer (and other browsers) to send sensitive information to a non-secure server in plain text format.
-
The point is, there are a lot of security issues related to a network such as the Internet. No FAQ could possibly cover them all. That is why this FAQ concentrates on Internet Explorer. Because there are millions of people who use Microsoft Windows family products, and because those millions have the ability to blend Internet Explorer with these products, the seriousness about security should be of paramount importance to everyone. Remember, software products are only as secure as the environment in which they operate.
- ...2 more annotations...
-
What Security Features does Internet Explorer Have? Internet Explorer is a safe browser in many ways. The latest version of IE supports Secure Socket Layer (SSL) 2.0/3.0, Private Communication Technology (PCT) 1.0, CryptoAPI, and VeriSign certificates, and one version employs 128-bit encryption, one of the strongest forms of encryption that's commercially available for use over the Internet. To see if you have the 128-bit version of Internet Explorer, go to the Wells Fargo Bank site and take their browser test. "Secure Socket Layer (SSL) is a Netscape-developed protocol submitted to the W3C working group on security for consideration as a standard security approach for World Wide Web browsers and servers on the Internet. SSL provides a security "handshake" that is used to initiate the TCP/IP connection. This handshake results in the client and server agreeing on the level of security they will use and fulfills any authentication requirements for the connection. Thereafter, SSL's only role is to encrypt and decrypt the byte stream of the application protocol being used (for example, HTTP). This means that all the information in both the HTTP request and the HTTP response are fully encrypted, including the URL the client is requesting, any submitted form contents (such as credit card numbers), any HTTP access authorization information (usernames and passwords), and all the data returned from the server to the client." -- Microsoft's IIS 1.0 Features Tour. It has been reported, however, that SSL has been cracked. Private Communication Technology (PCT) is a Microsoft-developed security protocol available in IE only. According to their Internet draft, "The Private Communication Technology (PCT) protocol is designed to provide privacy between two communicating applications (a client and a server), and to authenticate the server and (optionally) the client. PCT assumes a reliable transport protocol (e.g., TCP) for data transmission and reception. The PCT protocol is application protocol-independent. A "higher level" application protocol (e.g., HTTP, FTP, TELNET, etc.) can layer on top of the PCT protocol transparently. The PCT protocol begins with a handshake phase that negotiates an encryption algorithm and (symmetric) session key as well as authenticating a server to the client (and, optionally, vice versa), based on certified asymmetric public keys. Once transmission of application protocol data begins, all data is encrypted using the session key negotiated during the handshake." IE also supports server and client authentication by using digital certificates to identify users to web servers. In addition, IE supports code signing with Authenticode, which verifies that downloaded code has not been modified. For more information on Authenticode, visit Microsoft's Authenticode page or the excellent Authenticode FAQ page. CryptoAPI 1.0 provides the underlying security services for the Microsoft Internet Security Framework. CryptoAPI allows developers to integrate cryptography into their applications. Microsoft has given a great deal of thought to the issue of security and it products, and Internet Explorer 4.0 is no exception. From "Security Zones" to continued support and refinement of Authenticode, IE4 promises to be one of the safest browsers of all time. You can read all about the security available in IE 4 at http://www.microsoft.com/ie/ie40/?/ie/ie40/features/ie-security.htm. Also, check out what Microsoft is doing to keep transactions private with IE 4.
-
What are "Cookies?" Cookies are small text files that are sent to web browsers by web servers. The main purpose of cookie files are to identify users and to present customized information based on personal preferences. Cookie files typically contain information such as your name (or username), password information, or ad-tracking information. There is a good body of literature on the Internet about Cookies. Despite what you may have read or heard, most people, including myself, do not view Cookies as any kind of a security threat. However, because of the way Cookies work (e.g., a web server storing a text file on someone's hard drive), Microsoft (and other browser manufacturers) have built options into their browsers that notify users when Cookies are being passed to them, and give the user an option to prevent the cookie from being accepted. I don't think this is a good idea. By rejecting Cookies, your browser may not display the entire page or the site may not function as intended. The reality is that Cookies are text files -- they cannot contain viruses or execute applications, they cannot search your hard drive for information or send it to web servers, and most of the information they contain is simple tracking information designed to effect better customer service.