For the last five or so years, SSL has been paraded as the
technology that secures the Internet. All you have to do is look
and see the padlock on the bottom of the screen and you can be
sure it’s safe.
Is it true?
SSL is a technology for providing a secure connection between
two places. It provides secure links, or pipes between wherever
it starts and wherever it stops.
What it does not do is actually secure any of the data that
passes through the pipe, or really know where either end of the
pipe actually is. What you can be sure of is that anything put
into one end of the pipe is going to come out wherever the other
end is.
But surely the data is fully protected? Yes, whilst the data is
in the pipe it is protected. Now, assuming – and unfortunately
that’s what we have to do – that you know for sure where each
end of the pipe is, and you are sure that each end is very
secure, and you know for certain who is at each end, then you’re
OK. If any of those is not true then you do have a problem.
My data is SSL protected between the server, and me so why
should I worry? Well no one at the server end really knows whom
the data is from because they don’t know what your identity is.
They assume that data arriving through the pipe is right, and
that your identity can be presumed from the data, not the other
way around. Unfortunately there are hacker attacks that divert
your link through their own site, where they can pretend to each
end that they are the other entity without either end being the
wiser. (This is called a man-in-the-middle attack using web site
spoofing.)
Once your information gets to the server it stops being
protected and anyone can get to it, at least judging from the
fact that hackers target web sites first because that’s where
they can guarantee to find large quantities of names, addresses,
credit card numbers and so on. (Actually, SSL places such a
heavy load on computers that they now have other machines doing
just the SSL encryption so your data is potentially exposed even
before it has a chance to get to the web server, but that’s not
the point.)
So there’s the problem. SSL provides strong protection, but not
actually to the data, just the link. You might say it was a
condom that protects the pipe.
About the author:
ArticSoft (www.articsoft.com) have over 30 years experience in
the field of computer security, and 15 years experience of
securing information on personal computers and messaging
systems. Our CEO Steve Mathews, is one of the authors of BS7799
(now ISO/IEC 17799) and is well recognized in the security
industry.
|
