CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.3  The Web            9  2.3.4  Vulnerabilities

2.3.4  Vulnerabilities 1 Dependence on “Security Through Obscurity”

The logging that occurs on a web server can compromise user privacy by providing a history of the user’s visits to a site. In addition to recording which IP addresses (which may uniquely identify a particular user) visited, which web page, and the time and date, some browsers provide more information such as the name and version of the browser program used for the access, the user’s email address, and other details. Perhaps more damaging to individual privacy are browser history, “favorites” or “bookmark” lists, and the cache of visited pages maintained on client machines, detailing the most recent pages accessed by that user, and the ones they’re most interested in (favorites). It is, thus, no surprise that utilities are available to clear these sources of information about a user’s browsing habits.

Assisting with this logging can be “web bugs”, which are small URL’s (often 1-pixel images) designed for automatic retrieval when a user visits a web page or reads an HTML-based email message. When retrieved, they trigger log entries (as would any URL retrieval). Web bugs can legitimately be used for statistical analysis or may be used to track a specific person. You can find out what web sites use web bugs by installing the free Bugnosis software on Internet Explorer²¹¹. More information about web bugs is available in the Bugnosis FAQ.²¹²

Correspondingly, there are also web sites such as http://www.anonymizer.com, http://www.the-cloak.com and http://www.idzap.com, specifically set up to allow users to view the contents of other sites anonymously, without revealing their IP address or other identifying information to the site.

Why worry about anonymity on the web? The issue of Identity theft has become enough of an issue that the US Federal Trade Commission has set up a toll-free hot line @ 877-ID-Theft.

2.3.4  Vulnerabilities 1 Dependence on “Security Through Obscurity”