Ch. 5: Online Privacy Flashcards
Internet/WWW Background
- the Internet today has the same basic architecture as when it was first designed. Data on the vast network is transferred by shuttling small pieces of information known as data “packets” from one computer to the next. Data is disassembled into packets on transmission, scattered through the network while in transit and then dynamically reassembled upon arrival at the destination computer.
- WWW is an information sharing model built on top of the physical Internet.
WWW Tech Development
- Historically functioned on 2 technologies: Hypertext Transfer Protocol (HTTP) and Hypertext Markup Language (HTML).
HTTP - manages data communications over Internet, defines how messages formatted and transmitted, defines actions web servers and web browsers take in response to various commands.
HTTPS = protocol that allows encryption of data.
HTML - content authoring language used to create web pages. Document “tags” can be used to format and lay out a web page’s content and to “hyperlink”—connect dynamically—to other web content. Today is HTML5 version (no plug ins necessary - those are software pieces that run in browsers and allow for video or audio.
Extensible markup language (XML) - While HTML uses tags to describe the contents of a web page or file in terms of how it should be displayed, XML describes content of a webpage in terms of the data that is being produced.
This enables automatic processing of data in large volumes, necessitating attention to privacy issues.
Web server
computer that is connected to the Internet, hosts web content and is configured to share that content.
Proxy server
an intermediary server that provides a gateway to the web.
A proxy server typically masks what is happening behind the organization’s firewall, so that an outside website sees only the IP address and other characteristics of the proxy server, and not detailed information about which part of an organization is communicating with the outside website.
Virtual Private Network
important category of proxy server, widely used in the United States for employee web access, but not nearly as widely used by consumers.
VPNs encrypt the information from the user to the organization’s proxy server, thus masking from the ISP both the content and web destinations of that user
Caching
web browsers and proxy servers save a local copy of the downloaded content, reducing the need to download the same content again from the web server.
To protect privacy, pages that display personal information should be set to prohibit caching.
Web server log
A web server log is sometimes automatically created when a visitor requests a web page.
Examples of the information automatically logged include the IP address of the visitor, the date and time of the web page request, the URL of the requested file, the URL visited immediately prior to the web page request, and the visitor’s web browser type and computer operating system.
Depending on how the web server is configured, it is possible for personal information such as a user name to appear in web server logs.
IP addresses themselves, and thus web server logs containing them, are considered personal information by some regulators but not by others
Internet Protocol (IP)
specifies the format of data packet that travels over the Internet and also provides the appropriate addressing protocol.
An IP address is a unique number assigned to each connected device—it is similar to a phone number because the IP address shows where data should be sent from the website.
IP addresses used to be more dynamic (changing from session to session) but today are generally static, so your device always has the same one.
Internet Service Provider (ISP)
is an organization that provides services for accessing, using, or participating in the Internet. I
Transmission Control Protocol
- enables two devices to establish a stream-oriented reliable data connection.
- A combination of TCP and IP is used to send data over the Internet.
- Data is sent in the form of packets, which contain message content and a header that specifies the destination of the packet
Transport layer security (TLS)
Ensures privacy between a user and a web server.
When a server and client communicate, TLS secures the connection to ensure that no third party can eavesdrop on or corrupt the message.
TLS is a successor to secure sockets layer (SSL).
Javascript
cripting language used to produce a more interactive and dynamic website.
But has vulnerabilities and problems interacting with some programs and systems - privacy issues.
Cascading Style Sheets (CSS)
= language used to describe the presentation of web pages. This includes colors, layout and font.
This language allows for adaptation of the web page to different types of devices.
CSS and HTML are independent of each other.
Flash
• Flash is a bandwidth-friendly interactive animation and video technology plug-in that has been widely used to enliven web pages and advertisements. Compatibility and security problems, however, have led to a decrease in use
Social engineering
= a general term for how attackers can try to persuade a user to provide information or create some other sort of security vulnerability.
The social engineer is intent on gaining access to private information and targets an individual or group within an organization that may have such access.
Techniques include using an assumed identity in communications, eavesdropping on private conversations or calls, or impersonating an employee or hired worker.
Contrasts with technically based attacks.
Technically based attacks
Examples = structured query language (SQL) injection, cookie poisoning or use of malware.
In these attacks, the attacker exploits a technical vulnerability or inserts malicious code.
One technical but common threat to online privacy is XSS. XSS is code injected by malicious web users into web pages viewed by other users. Often, the unauthorized content resulting from XSS appears on a web page and looks official, so the users are tricked into thinking the site is legitimate and uncorrupted.
XSS is the basis for many convincing phishing attacks and browser exploits.
Web Access Best Practices
- Infosec training
- Security plan - combat variety of attacks.\
- More sensitive the website, the stronger the authentication should be (2 factor, eg), and mask passwords.
- Dont’ use cookies for authenticating and authorizing end-user access.
Protecting Online Identity - Best Practices
Login/password/PINs - unique passwords, change regularly, decline “remember my password” and memorize or keep in secure storage (password manager app, eg).
Software - Use antivirus and firewall software. install patches.
Wireless networks and Bluetooth. Keep current on known vulnerabilities.
File sharing - use options available to restrict what files and directories can be accessed by the website and services.
Public computers - be cautious.
Public charging stations - be cautious
Ditto for PI on websites.
Commercial email codes of conduct (in addition to CAN-SPAM requirement of opt-out)
Many business groups have codes of conduct and self-regulatory frameworks in place for commercial email. Common commercial email principles include:
• No false or misleading header information
• No deceptive subject lines
• Opt-out mechanism in each message
• Notification that the message contains an advertisement or promotional information
• Information about the sending organization39
