Subject: Re: FYI 4 update: security considerations

From: John Curran <[email-masked]>
Date: Fri, 01 Jan 1999 12:24:18 -0500

Happy new year (and may the coming year hold both a larger
and more responsible Internet...)

General comment regarding the security considerations section
is that it has to be relatively short and hence can only hit the
absolutely most essential items that we want a new user to walk
away with...

I would expect it to contain two or three unequivicol statements
regarding safe behavior, and a pointer to another IETF document
for more info (which is pretty much what you've got - great job).   

My only request would be to strengthen and clarify the warnings 
as noted below.

At 10:17 AM 12/31/1998 -0800, April Marine wrote:
>FYI 4
>3. Security Considerations
>
>   The question "is the Internet secure?" can be a confusing one for a
>   new user, who will hear many assurances that it is secure and many
>   scary stories saying it is not secure.  There are a few basic rules
>   of thumb to remember that will address most concerns.
>
>   First, users should make it a rule never to share their account
>   passwords with anyone, certainly never with anyone unknown to them.
>   Learning a password is the easiest way for someone to break into a
>   system.  Possibly a user may think that their files are not that
>   interesting to anyone, but someone may be able to get a foothold
>   from one innocuous account to other places in the same computer
>   system.  Many good security practices for users can be found in the
>   Users Security Handbook (FYI?).

Strike the text ", certainly never with anyone unknown to them" in the
above.

>   Second, understand that there are means for people to track the
>   information a user sends via email, the files one downloads, and
>   the sites visited on the web.  People with legitimate system
>   priviledges have access to information that a user may prefer to keep
>   private.  No responsible site administrator or network engineer
>   will violate users' privacy out of personal curiousity; however,
>   people with legitimate system or network priviledges have access to
>   information about users.  If someone less legitimate gains such
>   priviledges, possibly by attaining illegal access to a system, they
>   also will have access to this information.  This situation is not a
>   problem for most people, but it should be understood that email
>   sent a year ago may still exist in some system's backup archive
>   tape and theoretcially could be resurrected and reviewed.

Add (after email sent a year ago) the following "and/or a log of users
web pages browsed"

Replace "theoretically" with "easily" in the last sentence, and change
"reviewed" with "published widely".

>   Third, before giving personal information over the Internet, such
>   as filling in a form on a Web page, a user should review the site's
>   privacy policy to see how they will use and protect this
>   information.  Do they sell their users' names and email addresses?
>   Do they share them with their advertising partners?  Do they couple
>   names with the pages visited and provide that information to their
>   associates?  It is best to understand how far such information will
>   go before providing it, and a responsible site will be happy to
>   explain their policies regarding privacy of information.

Gurgle.   Impossible to determine whether you're dealing with a true
"responsible site" or simply a very convincing imposter.   I'd edit the
to read as follows:

"Third, before giving personal information over the Internet, such
 as filling in a form on a Web page, users should realize that there
 is no assurance of confidentiality or privacy.   It could be compared
 to faxing such information to a party that you've never dealt with 
 before.  While many organizations on the Internet are responsible
 with information received via the web and email, this cannot be 
 determined in advance."

That's it...  feel free to use or discard these comments as desired.
/John

---

From: April Marine <[email-masked]>
Date: Wed, 6 Jan 1999 10:07:35 -0800 (PST)

These all strike me as great suggestions.

Ray, can you take them into consideration as you prepare a new version?

thanks John!
April

On Fri, 1 Jan 1999, John Curran wrote:

> Date: Fri, 01 Jan 1999 12:24:18 -0500
> From: John Curran <[email-masked]>
> To: April Marine <[email-masked]>
> Cc: Ray Plzak <[email-masked]>, [email-masked]
> Subject: Re: FYI 4 update: security considerations
> 

-------------------------------------------------------------------
April Marine			1-650-604-0762  --> me
GLOBE Program			1-800-858-9947  --> GLOBE Help Desk
(Raytheon ITSS)			[email-masked]
NASA Ames Research Center, MS 204/14, Moffett Field, CA 94035-1000
(and IETF User Services Area Director http://archimedes.nasa.gov/usv/)