Secure Websites Are All a Lie
ConsumerWatch / Technology Aug 22, 2010 - 08:26 AM GMTThere is no such thing as a secure website, and everything you've been led to believe about web security is a lie. And your free speech is threatened, amongst other serious ramifications.
Do NOT trust any website to guard your private data, not even banking websites are secure. I will explain why and how you can help to make sure it gets fixed immediately! I mean that every website where you enter a password to get access, is not secure, no matter what that website says to the contrary.
You may read all the technical details at the following bug report I filed for the Firefox browser:
https://bugzilla.mozilla.org/show_bug.cgi?id=588704#c36
Note as far as I know, this web security problem applies to all browser software, including Internet Explorer, Google Chrome, Safari, Opera, etc..
Two critical vulnerabilities exist on every browser software that you use to surf the web, and even if your browser says the website is secure (small lock icon at bottom), it is a lie and here is why:
1) Hacker in the network can intercept and proxy the secure connection between your browser and the server of the secure website, and thus steal (and even alter) the data that is transferred back and forth. It is impossible for your browser and the website server to know the hacker is in the middle. This hacker could even be the government, because nearly all traffic on the internet passes through government routers (this was verified anonymously by someone who works as a programmer inside Homeland security), and if government can end your security, they can also end your ability to have free speech:
http://en.wikipedia.org/w/index.php?title=Carnivore_%28software%29&oldid=376444660
http://news.cnet.com/8301-13578_3-10463665-38.html
http://www.prisonplanet.com/obamas-war-on-the-internet.html
http://www.prisonplanet.com/google-plans-to-kill-web-in-internet-takeover-agenda.html
2) Hacker can get a virus into your computer (even if for just a few minutes), and that virus can access your secure connection (even if you have your own SSL certificate and/or hardware password generator device and/or biometric device), because the connection encryption password (and/or the site session authentication keys) are not encrypted properly by the browser.
I am not joking nor exaggerating, and I am sufficiently expert on this. Read the Firefox bug report to check my expertise. If you ask another security expert for an opinion, make sure they read the technical details first, because most so called "experts" are not fully aware of the logic that applies.
Neither of these threats have anything to do with hacking the server of the website. The first threat is called a "man-in-the-middle attack" and it has nothing to do with a virus in your computer, and it applies to everyone who is using the internet, except for those very few of you who have installed your own personal SSL certificate on your browser software. However, even if you did install your own personal SSL certificate, the second threat applies to everyone. The second threat occurs when a virus can sneak past your firewall and anti-virus software, and then it can steal the data that keeps your connection secure, because that data is not encrypted properly as it should be. And note that the type of encryption that must be used to fix this problem, is very specific and requires the use of one-way hashes.
There is an easy way we can fix the second threat. Browsers must properly encrypt the data they store that controls the security of the (connection and login session authentication) for the website (see my Firefox bug report for the details), so that the virus can not use that data even if it accesses it. In the Firefox bug report, I explained how this encryption can be done in such a way that it is secure. In that same bug report, I also suggested a way that the browser software could automate the issuance of personal SSL certificates in order to fix the first threat.
If you care about this current (and looming to be critical) security and free speech threat, you need to click to that bug report I filed for the Firefox browser, and then click the "Vote" link near the top of that bug report page and to the right of the "Importance" choice. You must first sign up for free to the bugzilla.mozilla.com site, before you click the "Vote" link. You don't need to be a technical expert to sign up and vote. Any one is allowed to sign up and vote. It is your right as member of the internet community which uses Firefox. If we can get Firefox to fix the problem, then the other internet browsers will also, because they don't want Firefox to have an advantage. Website programmers want to make their sites secure, but we need the browsers to fix their side of the problem first.
Do not expect this problem to get fixed if you all do not hammer Firefox with sufficient (as in hundreds of) votes. Firefox has had a similar bug report on this problem since 1999, which they have not fixed after 11 years:
https://bugzilla.mozilla.org/show_bug.cgi?id=588704#c27
Here is your chance to fight for our free speech rights. All you have to do is click and vote. By protecting our ability to communicate securely on the internet, you will have insured that we can always talk freely to each other without government tracking. And you will have thwarted hackers current ability to steal your bank account and other important sites where you normally login (sign on) with your password.
I urge you not to dismiss this matter, and if you agree about the importance, please act immediately as I have suggested.
By Shelby Henry Moore III
short bio, I have published articles on FinancialSense.com, Gold-Eagle.com, SilverStockReport.com, LewRockwell.com. I am the sole or contributing programmer of numerous (some million+ user) commercial software applications, such as Corel Painter, Cool Page, WordUp, Art-O-Matic, etc.. I have an education in engineering and math.
Disclaimer: My writings are my personal opinions, not to be construed as statements-of-fact. Do you own research. Licenses to think and communicate have never interested me too much, so I am not a licensed research, journalism, investment, legal, nor health professional. Please consult the proper authorities for all matters covered in my writings. I disclaim all liability for what you do after reading my writings. No one can predict the future, and if there is a physical world investment that never loses value, I haven't found it yet in my 44.1 years here on Niribu.
© 2010 Copyright Shelby Henry Moore III - All Rights Reserved
© 2005-2022 http://www.MarketOracle.co.uk - The Market Oracle is a FREE Daily Financial Markets Analysis & Forecasting online publication.