To: Lizzie Tudor who wrote (10851 ) 3/17/2002 2:22:34 PM From: stockman_scott Read Replies (1) | Respond to of 57684 Musings on 'The Security Presumption.' -From The Harrow Technology Report / March 18, 2002 We "know" that the information we transmit via Email is not secure. Unless you use special software such as PGP to encrypt a message's contents, it's possible (if not straightforward) for anyone on your LAN, or at your ISP, or at any of the servers that your message's packets traverse on the way to their destination, or at the destination ISP, or on your recipient's LAN, to read some if not all of your message. We all "know" this. And it probably doesn't matter much if you're sending a note to Aunt Millie. In fact, most of us never give this a second thought. Yet as Email becomes evermore a part of how we conduct our personal and business affairs, this presumption of security in a known insecure environment can lead to problems. And not just the obvious ones regarding things financial. For one example, as an increasing number of physicians have begun using Email to answer patient questions, and perhaps to prescribe medication, an intercepted Email message could illuminate things you probably didn't want to be public knowledge. And a modified Email message could be downright dangerous. Most of us have grown up in a written communications environment, the "mail" or "post," were the presumption of security carried the force of law. In the U.S. and in many other countries, the sanctity of first class mail is protected by laws that carry stringent penalties for anyone tampering with a letter; which in a manner of speaking "encrypts" the contents of the envelop, even though it isn't normally practical to actually encrypt the words. But with Email, Instant Messaging, and other forms of electronic messages, their contents don't (currently) enjoy similar legal protection. This becomes even more of a potential problem when any aspect of an Internet connection "goes wireless," because at that point an interloper no longer needs physical access to your or your ISP's physical wires -- they can just pluck your messages out of thin air. For example, the March 11 eWeek (http://www.eweek.com/article/0,3658,s=712&a=23806,00.asp) describes how someone can pick up a few parts at Radio Shack, and some free software from the Internet, and capture messages thumbed into many cellular phones or into the increasingly popular "BlackBerry Internet Edition," a wireless Email device from Research In Motion (RIM) that uses the wireless Mobitex network.) We might expect that once such an "opening" was discovered, the vendor would rush to close the gap. Yet the security researcher who demonstrated this security hole, Joe Grand, explains why that isn't going to happen: "The problem is, this isn't a bug. Its part of the spec that data is transmitted in the clear... The risk depends on who is using the network and when and what data they're sending." "Executives at RIM said they don't see the attack as a problem because they have never touted the Internet Edition devices as being secure." Indeed, Research In Motion CEO Jim Balsillie points out that, "Internet traffic isn't supposed to be secure." The problem, in my opinion, is that it should be. When the Internet was born, non-trivial encryption was beyond the ability of typical hardware. But thanks to enhanced end-to-end encryption and authentication schemes, and the results of Moore's Law on processing power, we can now easily encrypt our messages with the computational horsepower available to any of us; our PCs can encrypt and decrypt without missing a beat. I'm not a security expert, and so I wouldn't presume to suggest the best ways for protecting our Internet-borne missives. But I do strongly believe that the time, and the technology, and our society's growing use of electronic messaging, have all have reached a point where we can and should "change the rules" to make our casual although incorrect presumption of security, real. It could only make the Internet a better, and safer, and more empowering place for individuals and businesses and commerce.