How to protect your online privacy

How to protect your online privacy

Summary: If you want to avoid being compromised when using typical Wi-Fi hotspots that have no security, you can use the following table as a reference of protocols you should and shouldn't use.  The insecure protocols should be banned and never used again; the protocols on the right are the secure alternatives.

SHARE:
TOPICS: Google
39

If you want to avoid being compromised when using typical Wi-Fi hotspots that have no security, you can use the following table as a reference of protocols you should and shouldn't use.  The insecure protocols should be banned and never used again; the protocols on the right are the secure alternatives.  Anyone who doubts this is a problem should look at the DEFCON Wall of Sheep.

Note that in order to use these secure protocols properly, only Digital Certificates that are signed by publicly trusted Certificate Authorities like VeriSign, Entrust, GeoTrust, or GoDaddy should be used on the server side.  Here's a tutorial on how to acquire, purchase, and install a Certificate on your Server for less than $20 a year.  The use of expired or self-signed Certificates is forbidden because it forces and conditions the user in to ignoring Certificate warnings which is extremely dangerous.  Clients don't usually require Digital Certificates and they just need to be configured to point to the secure services.

Insecure protocols (BAN usage) Secure protocols
HTTP HTTPS with SSL
POP (TCP: 110) POP with SSL (TCP: 995)
IMAP (TCP: 143) IMAP with SSL (TCP: 993)
SMTP (TCP: 25) SMTP with SSL (TCP: 465)
FTP FTPS or SFTP ****
Telnet SSH ***
PPTP VPN PPTP over SSTP VPN
ICQ IM client configured for SSL
  Skype (Proprietary PKI)
  SSL-VPN, L2TP*, IPSEC**
  SSH VPN tunneling ***
* L2TP requires Server and Client side Digital Certificates. ** IPSEC can use Server and Client side Digital Certificates or pre-shared keys. *** SSH is not SSL based but is very similar to SSL in principle. **** FTPS is an SSL version of FTP, SFTP is SSH based version of FTP.

Unfortunately this is all probably too complex for the vast majority of users and the infrastructure needs to take a lot more responsibility by blocking the usage of insecure protocols.  Services like HTTP can automatically be redirected to HTTPS but very few online services will do this.  Google supports HTTPS mode if the user manually types in https://mail.google.com which almost no one does so that really doesn't help the vast majority of users who don't know any better.

Almost none of the so-called "Web 2.0" providers care about your online privacy.  For example, the following services have zero support for HTTPS and they're all vulnerable to side-jacking.

  • Google's YouTube service
  • Google Video
  • Google Maps (you want people knowing where you live?)
  • Google's Blogspot
  • Microsoft Hotmail
  • Yahoo mail
  • Facebook
  • MySpace

What is going on here?  I challenge these online services to start protecting people's privacy and start using HTTPS for everything!  [Update 8/8/2007 - Robert Graham of ErrataSec noted that SalesForce.com defaults to SSL mode and even lets companies block non-SSL connections to their own data.  I would add that this is to be expected of any corporate Application Service Provider which charges a substantial monthly fee per user.  What I'd like to see is every online service regardless of whether it's a subscription service or Ad driven service should protect people's privacy.]

Note: Anyone who tells you SSL and encryption is too expensive is living in the 1990s.  Moore's law has given us 2.4 GHz Quad Core processors from Intel for $280 and there are thousand-dollar encryption off-loaders that can encrypt multiple gigabytes of data per second!  I don't want to hear Google saying they can't afford a cheap gigabit encryption off-loader for their Gmail service.  I'm tired of hearing all the excuses.

As people's lives become more and more centered around these online services and more and more people start using Wireless networking, this is a disaster waiting to happen.  My voice isn't enough and you the reader need to demand better security from your online service providers.  I challenge the big three (Google, Microsoft, and Yahoo) to see who will be the first to provide secure HTTPS services by default.  If they want to have an insecure version, let them host that under something like insecure.gmail.com and make people go out of their way to be insecure.

The first ISP that becomes secure-by-default will get my praise.  I also want to see which major Hotspot provider or Municipal Wi-Fi service will implement the Secure Wireless LAN hotspot for anonymous users.  Will it be T-Mobile or AT&T?  I hope other bloggers, Journalists, and Editors to all do the same.

Topic: Google

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

39 comments
Log in or register to join the discussion
  • Google maps

    Lucky I've been using the address down the street this whole time. ;-)

    Of course, banning those protocols altogether is overstating things. Most of what I read on the net does not need to be private. I also can understand companies who understand that ease of use is much more important to their success or failure than whether they offer secure protocols. If being secure becomes a competitive advantage, then Google will transition their services in record time.

    Good luck getting Aunt Bessie to understand the issue, 'cause just scaring her isn't going to get her to ask for SSL encryption.
    GW Mahoney
    • Google Maps?

      I live at 3961 East Enon Road, Yellow Springs, Ohio 45387
      Is there a reason I shouldn't want you to know that?


      David Robinow
      Badge3832
  • You get what you pay for

    Since these are free services we don't really have an expectation of security. While I agree that implementing it would be simplistic and putting in a redirect it trivial they have no real motivation to do so in a free ad supported product. I also don't agree that google maps needs to be secured, my address is in the phone book so its not hard to get anyway.
    jfp
    • That's a lame excuse

      A thousand dollar crypto off-loader is enough to cover a million users. Just hosting the free servers is far more expensive. Furthermore, the companies serve you a lot of ads and they want to be able to data mine you. There are no excuses.
      georgeou
      • Yahoo Small Business Email and Website Hosting

        George, I agree with you that simply because a email service is free is not a valid reason to not provide privacy protection for the service's users. Especially, when as you point out, they are using ads to cover their costs.

        Additionally, in response to the original comment, Yahoo Small Business, which provides web site hosting with business email accounts, ALSO FAILS TO PROVIDE HTTPS security EXCEPT for the login exchange (same as the free users). You would think that Yahoo would provide secure HTTPS for at least their paying customers.
        VTSkiBum
        • They won't change until consumers start demanding it

          They won't change until consumers start demanding it. That's really a horrible shame.
          georgeou
  • I was having trouble understanging Gmail

    If I were to simply type 'gmail.com' in the browser, I would end up at the right site, but if went back to my email, the email would be at an un-encrypted address.
    nucrash
    • it redirects to where u started

      google redirects you to a login page(that has SSL) but then refers you to your starting point (with the cookie).
      If you use https://XXXXX.google.com there is where you will be redirected after login in.
      I use a redirect on my domain so it always gets me https for google mail (GAFYD) : http://m.BUGabundo.net --> redirects to https://mail.google.com/a/bugabundo.net/
      I also have a greasemonkey script that forces most site that have SSL to use it.

      When I'm over a open Wi-Fi spot, I tend to use a VPN. I also change my passwords often (although I tend to forget those sites that I rarely use).
      What about the cookies or Session IDs (SID) ? What can WE do about those, when captured, George?
      (``-_-´´)
      • Kindof defeats the purpose of Cookie Dumping

        Although you may think that you are safe by using paranoid mode, you are actually more prone to attack because you will be broadcasting your unsecured cookies more and more. Actually, about the same. But still, your online identity is hosed until those cookies expire and no one uses them.
        nucrash
  • I can find out where you live now

    www.411.com
    frgough
    • And you made this discovery all by yourself?

      What an ub3r l33t3 hacker you are.

      Now can you figure out Michelle Madigan's home addy?
      nucrash
      • Nice jab, but what about his POINT?

        I think his point is that a lot of worrying about 'security' (from windows users no less
        using the most hackable system on earth) is really rather inane. Get a decent OS
        (non-windows). Use common sense, etc... Just because you are paranoid doesn't
        mean anyone cares where you live (and if they did they could find you in many easier
        ways than trying to hack you as you surf a web mapping app.
        comp_indiana
  • Thanks George. Always pertinent. (eom)

    .
    BillyG_n_SC
  • INternet Anonymity / Security

    I use Ultimate Anonymity. http://www.ultimate-anonymity.com as they offer complete anonymity & privacy resources and have been doing it for over 10 years. Very good resource for anyone serious about online anonymity, privacy or security.
    CSmith66
  • Alternative Browser?

    I?ve reading abaout XeroBank Browser. If acttually the sites aren?t offering the needed security, this could be an alternative for privacy.
    Mois�s �greda
    • That has nothing to do with this

      This is a clear-text problem and it won't go away until these services start using SSL.
      georgeou
      • George - Yes it does

        The Zerobank Browser connects to either TOT or their own private servers (paid service) as the DEFAULT and ONLY option for the browser. It used to be called TORPARK before the commercial services became available and it was renamed XeroBank.
        https://xerobank.com/
        xrayman
  • Spams with PDF's.

    I apologize for being off-topic but I couldn't find a way to email George.

    I have noticed a new spam trend in the past few days--spam emails that only contain a PDF. It seems to be getting through some companies' spam filters and obviously could pose a problem since many employees send PDFs to each other with no message.
    Rick_R
    • Some are text searchable

      Setup your spam filter to search the text of the PDF. You may require additional software and more than likely some bigger hardware. For every additional scan you have to do, the longer it takes to get an email.
      nucrash
    • PDF spam is VERY dangerous and may contain malformed exploits

      PDF spam is VERY dangerous and may contain malformed exploits. That goes for any document type including MS Office or image formats. Even ZIP or ARJ files will exploit flaws in your anti-virus defenses. NEVER open up any kind of attachment from anyone (including your friends) unless you know they have a good reason to send you something.
      georgeou