Letters to PC World
Missives on security, ink jet prints, e-books, and more.
Letter of the Month: No Security in the Padlock Icon
In November's Bugs and Fixes, Stuart J. Johnston states, "We have grown to believe that if we see the little padlock icon at the bottom of Internet Explorer screens, our transactions are safe." He then talks about a vulnerability that might let bad guys pose as a real site and get your credit card information.
The problem is actually worse than that. I wrote a paper in 1999 entitled "Are Secure Internet Transactions Really Secure?"
This paper discusses how many businesses--particularly small businesses--use third-party hosting. The little padlock indicates only that the connection from your browser to the site server is secure. It does not tell you how the company transfers your data from the server back to where the company can process it. In many cases sites use formmail.cgi or cgiemail.cgi to package the form data and e-mail it back to the business in plain text. If you were willing to send your data to the business in plain text, why wouldn't you just do that instead of using a secure form? In cases like this, the business is simply providing a false sense of security.
Unfortunately, consumers have no easy way--if any way at all--to determine whether the business is using a third-party server and an insecure back-end processing system.
Stephen Mencik, CISSPACS Defense, Gambrills, Maryland
PC World welcomes letters to the editor. We reserve the right to edit for length and clarity. Send e-mail to letters@pcworld.com.
