By
Konrad Roeder
c.Konrad Roeder 1998
Some
people say never send anything confidential or private over
the Internet. This may have been good advice five years
ago, but things are changing quickly on the Internet. Privacy
has been added to many programs and features so that only
the recipient of the communication can read it. Thus there
are times when it's perfectly safe to send credit-card numbers
and other sensitive information over the net. It's
not all that difficult to assess the risks and make a judgment
whether or not to send the information encrypted or not.
Let's
first talk about where the risks of compromising your information
really are. First and most important, there is your own
machine. If people have access to your machine, there are
trails of your activity in different files in your machine.
Your machine may contain documents, spreadsheets and other
kinds of sensitive data you would not want prowling eyes
on. Your e-mail program may keep a record of mail that was
received and sent. Your Web browser keeps a cache of recently
accessed Web pages. IRC chat has logging functions that
could be left on. The point is that your machine contains
a lot of sensitive data that may need to be physically or
software password secured.
While
it is possible for people to illegally tap your phone lines,
it usually requires equipment and to be in an open place.
Although many people have heard clicks and pops when talking
about sensitive information over the phone, the actual likelihood
of it being an illegal wiretap is actually quite negligible.
In the
telephone company switching office, it is possible to tap
communications, and read the character based communications
using a modem and a communications protocol analyzer. However
this can only be done under court order. Telephone switching
equipment is required by law to provide lawful intercept
capabilities in the United States. I would expect the same
in foreign countries.
From
there to the Internet Service Provider is a trip over local
or long-distance trunk lines to another telephone switching
office or directly to their office. To tap these trunks,
although possible, is difficult. Once at the Internet Service
Provider, the incoming lines go to a collection of modems.
From the modem, the signal is routed in the ISP's internal
network to one of maybe several connections to the Internet.
Your ISP can easily attach a protocol sniffer and read any
of the traffic going through. With a little more sophisticated
equipment, the ISP can read most anything you do on the
Internet. However,
they have little time to spy on their customers.
From
there, the information goes out over the Internet. Again,
these are big trunk lines owned by the backbone Internet
Provider. It is difficult and complicated to tap these lines.
So in short, what I am telling you is that the biggest risk
in your privacy is probably your computer, garbage can or
someone looking directly over your shoulder.
If you
are concerned with transmitting confidential information
over the Internet, make sure that you secure your office
or home and use only secure forms of transmission. Keep
your sensitive data on removable media which you can lock
up. You may also want a polarized glare screen to keep prying
eyes from seeing passwords and sensitive information.
For
Web browsing and purchases online, I would suggest using
sites that use a secure server. With Netscape, you will
notice the golden key on the lower left is no longer broken
on a secure site. With Internet Explorer, there is an annoying
pop-up warning you that security mode has changed, but there
is no indication.
For
e-mail I would suggest PGP 5.0 which uses public key encryption.
It is available at http://Web.mit.edu/network/pgp.html
for US residents and http://mail.telstar.net/mirror/pgp/download.shtml
for international users.
|
