Mar 18 2009 |
My Dad spent over forty years in the Royal Canadian Mounted Police. Over the course of his career, he was stationed through F-Division (RCMP-speak for 'Saskatchewan'). Being RCMP brats, my little sister and I were lucky enough to live in some very interesting places.
One of the more interesting places we lived was a vibrant little town called Carlyle. I was seven years old when we moved there and the whole town quickly became my playground. Perhaps the most interesting aspect of Carlyle was its proximity to other little towns, like Arcola, Kisbey and Forget. One of my parents' good friends lived in Forget, so we used to spend quite a bit of time in that beautiful little place with its fascinating history.
In the mid-80s, Forget (population - 50) still had a shared service phone line, or a party line. Our friend's line used to let out three short bursts when it was for him. I remember being incredibly confused - his phone would let out two short bursts, but he would not answer it. My Dad explained that it was a party line and that when the phone let out two short bursts, it was for someone else. Being seven, I was full of questions and asked what would happen if we picked up the phone. My Dad explained that we would be able to listen in on someone else's conversation. When I asked if we could listen to other people talk on the phone, my Mom and Dad explained that privacy is one of the most important rights we have in a democracy and violating someone's privacy is even worse than stealing.
Why do I tell you this? Not only does it explain a lot about why I do what I do, but it is also a great way to introduce the next aspect of internet security.
HTTP stands for 'Hypertext Transfer Protocol'. If you asked really smart people, they would likely define HTTP as, "a protocol that uses TCP to transfer hypertext requests and information between servers and browsers." Essentially, HTTP is how you say, "Hey server, send me that document on the latest soccer scores", then how the server sends that document to you.
HTTP contrasts with HTTPS, which stands for "Hypertext Transfer Protocol over Secure Socket Layer (SSL)". It does the exact same thing as HTTP, only the request for and the transfer of information are secured via encryption. (Don't worry, I'll talk about encryption in a later article)
Once again, highly technical definitions do not always make a lot of sense and this is an important concept so I am going to use one more analogy.
HTTP is just like the party line that I was so fascinated with in my youth. Nothing is secure and anything you type in, or access over an HTTP connection can be accessed by anyone with an internet connection. With some know-how, you can pick up the line, listen in and find out exactly what anyone else is reading, writing or watching. HTTPS is like a private line system - if your phone rings, it is only for you. And, if you dial my phone number, you can be reasonably confident that I am, in fact, the person on the other line and that nobody can listen in on our conversation.
So, why is this important?
First, it is surprising (I think it should be criminal) how many online shopping payment pages do not use HTTPS. Typing your credit card number on an HTTP page is the equivalent of publishing your credit card number in a newspaper. Would you do this?
And what about electronic mail? When you check a web-based email account, do you ever bother to look at the prefix in the address bar? If so, is it http or https? If it is http, anything you send (or receive) can be accessed by anyone else. Does your electronic mail service have the option to use a secure connection? Most do, though you often have to do a bit of digging to find it.
Please realize that I am not writing about this to make you feel paranoid. Rather, I am writing about this so that you can protect yourself. With that in mind, I have an incredibly easy way for you to protect yourself on the internet. Next time you are on a website, watch the address bar and pay attention to the http vs https prefix. If you are asked to enter information on an http page, ask yourself, "would I publish this information in a newspaper, or talk about it over a party line?"

written by shane G, March 19, 2009
written by Greg H., March 19, 2009
First off, thanks for the question - the best part of a blog is its capacity to turn into a conversation. Unfortunately, there isn't a really good answer to your question. By its very nature, HTTP pages cannot be truly secure - if someone wants to see what you are sending, that information is available in plain text. I guess that my first suggestion would be to carefully analyze the data you are sending and how sensitive it is. If it truly cannot fall into the wrong hands, simply do not enter it into an HTTP site.
Many services (Gmail is a great example) have the option to 'always use a secure connection'. If your email provider does not offer this option, I strongly suggest that you find one that does.
And, if you are concerned about session hijacking (we will write more about this next week), you may want to read this article on setting up a virtual private network (VPN).
http://www.theregister.co.uk/2008/09/01/openvpn_primer/
written by Canada Mens Down Vest, November 18, 2011




