• PC World
• » Consumer Advice

Letter of the Month: No Security in the Padlock Icon

In November's Bugs and Fixes, Stuart J. Johnston states, "We have grown to believe that if we see the little padlock icon at the bottom of Internet Explorer screens, our transactions are safe." He then talks about a vulnerability that might let bad guys pose as a real site and get your credit card information.

The problem is actually worse than that. I wrote a paper in 1999 entitled "Are Secure Internet Transactions Really Secure?"

This paper discusses how many businesses--particularly small businesses--use third-party hosting. The little padlock indicates only that the connection from your browser to the site server is secure. It does not tell you how the company transfers your data from the server back to where the company can process it. In many cases sites use formmail.cgi or cgiemail.cgi to package the form data and e-mail it back to the business in plain text. If you were willing to send your data to the business in plain text, why wouldn't you just do that instead of using a secure form? In cases like this, the business is simply providing a false sense of security.

Unfortunately, consumers have no easy way--if any way at all--to determine whether the business is using a third-party server and an insecure back-end processing system.

Stephen Mencik, CISSPACS Defense, Gambrills, Maryland

• See more like this:
• letters,
• letter,
• letters to pc world