15: Web Components in Software

Encode QR Code JIS X 0510 in Software 15: Web Components

FTP operates in a plaintext mode, so an eavesdropper can observe the data being passed If confidential transfer is required, Secure FTP (SFTP) utilizes both the Secure Shell (SSH) protocol and FTP to accomplish this task SFTP is an application program that encodes both the commands and the data being passed and requires SFTP to be on both the client and the server SFTP is not interoperable with standard FTP the encrypted commands cannot be read by the standard FTP server program To establish SFTP data transfers, the server must be enabled with the SFTP program, and then clients can access the server provided they have the correct credentials One of the first SFTP operations is the same as that of FTP: an identification function that uses a username and an authorization function that uses a password There is no anonymous SFTP account by definition, so access is established and controlled from the server using standard access control lists (ACLs), IDs, and passwords

Modern encryption technology can provide significant levels of privacy, up to militarygrade secrecy The use of protocols such as SSL/TLS provide a convenient method for end users to use cryptography without having to understand how it works This can result in complacency the impression that once SSL/TLS is enabled, the user is safe, but this is not necessarily the case If a Trojan program is recording keystrokes and sending the information to another unauthorized user, for example, SSL/TLS cannot prevent the security breach If the user is connecting to an untrustworthy site, the mere fact that the connection is secure does not prevent the other site from running a scam Using SSL/TLS and other encryption methods will not guard against your credit card information being lost by a company with which you do business, as in the eggheadcom credit card hack of 2000 In December 2000, eggheadcom s credit card database was hacked, and as many as 37 million credit card numbers were exposed Other similar stories include 55,000 credit card records being compromised by creditcardscom in 2000 and more than 300,000 records being compromised by the CD Universe hack in 1999 The key to understanding what is protected and where it is protected requires an understanding of what these protocols can and cannot do The SSL/TLS suite can protect data in transit, but not on either end in storage It can authenticate users and servers, provided that the certificate mechanisms are established and used by both parties Properly set up and used, SSL/TLS can provide a very secure method of authentication, followed by confidentiality in data transfers and data integrity checking But again, all of this occurs during transit, and the protection ends once the data is stored

The ability to connect many machines together to transfer data is what makes the Internet so functional for so many users Browsers enable much of this functionality, and as the types of data have grown on the Internet, browser functionality has grown as well

But not all functions can be anticipated or included in each browser release, so the idea of extending browser functions through plug-ins became a standard Browsers can perform many types of data transfer, and in some cases, additional helper programs, or plug-ins, can increase functionality for specific types of data transfers In other cases, separate application programs may be called by a browser to handle the data being transferred Common examples of these plug-ins and programs include Shockwave plug-ins, RealOne player (both plug-in and standalone application), Windows Media Player, and Adobe Acrobat (both plug-in and standalone) The richness that enables the desired functionality of the Internet has also spawned some additional types of interfaces in the form of ActiveX components and Java applets In essence, all of these are pieces of code that can be written by third parties, distributed via the Internet, and run on your PC If the code does what the user wants, the user is happy But the opportunity exists for these applications or plug-ins to include malicious code that performs actions not desired by the end user Malicious code designed to operate within a web browser environment is a major tool for computer crackers to use to obtain unauthorized access to computer systems Whether delivered by HTMLbased e-mail, by getting a user to visit a web site, or even delivery via an ad server, the result is the same: malware performs malicious tasks in the browser environment