TCS - From Ira

From Ira

by Ira Wilsker
Golden Triangle PC Club
From the March 2002 issue of the I/O Port Newsletter

An Internet Potpourri:
Safety, Speed, and Privacy

SAFETY:

Frequent readers of this column have heard me state on many occasions that there is an extreme need for security with our personal computers, regardless of platform. The federal Critical Infrastructure Assurance Office (CIAO), http://www.ciao.gov, in partnership with dozens of other federal, state, and private organizations, recently inaugurated their "Stay Safe Online Campaign" and announced a new web site at http://www.staysafeonline.info. The purpose of this new organization is to "…educate Americans on the need for computer security and encourage all computer users to protect their home and small business systems." On the website is a "top ten" list of safety and security tips, computer security checklists, and information and tools to encourage safe and responsible computer use. In a February 7 press release from the CIAO, Dick Clarke, Special Advisor to the President for Cyberspace Security, stated, "A key part of homeland defense is protecting every computer including home users and small business. This campaign will give all Americans the education and tools they need to secure their personal information and systems from attack. Citizens don't realize how much damage can be done by people using your computers remotely without your knowing it. This campaign will enlighten and empower consumers to take action. In this digital age, computer safety checks should be as routine as checking smoke detectors, the locks on your door, or the brakes in your car. Checking computer safety is vital to protecting consumers." adds Clarke.

The "Stay Safe Online Campaign" is calling for a combined government - private industry drive to encourage computer users to perform, at a minimum, a twice-yearly comprehensive computer security check. The dates specified for this year are April 7 and October 27, 2002, which are also the dates that Daylight Savings Time changes, and we all have to reset our clocks. The idea is that when we change our clocks, we are also to check our computer security. This semi-annual check is in addition to the use of properly installed, configured, and frequently updated antivirus software, as well as the use of a firewall, and other appropriate safety measures.

To view the list of recommended safety procedures and tools, visit the new website at http://www.staysafeonline.info. As an aside, notice the new "info" domain on this URL.

SPEED:

Almost all web surfers are probably using one of the "big two" Internet browsers to surf the web. Microsoft's Internet Explorer surpassed AOL's Netscape a few years ago, but these two giants are dominant in the browser field. A few years ago, a group of Swedes decided that there needed to be a better, faster, and leaner browser with enhanced security and privacy features, and complete compatibility with all major published international web standards. They wanted a very user-friendly browser that was available in most major languages, and in versions that could run on almost all major operating systems, so they developed Opera. Opera is only a fraction of the size of its larger competitors, offered faster loading of web pages, and in many ways had more enhanced features then its larger competitors. I recently downloaded the 3.6meg Opera version 6.01 for Windows 98 from their site at http://www.opera.com, and noticed that it was only about 20% of the size of my recent downloads of IE6 and Netscape 6.2. It installed smoothly and quickly, and was ready to run in minutes. For the record, there is a larger download of Opera available, but it is the exact same browser bundled with Java software; if your computer already has Java, the larger download is not likely necessary. Opera recommends that if you are not sure, download the larger version. As downloaded, Opera is free, but is financially supported by advertising appearing unobtrusively in a small window in the top-right corner of the browser. Registering Opera removes the advertising, and frees up a small amount of space in the browser window.

The first time I ran Opera, I was pleasantly surprised. It loaded much faster than IE6, and web pages also loaded faster. I went to a variety of sites, and could not find any that would not load properly. Since Opera is strictly compliant with all major web standards (and Internet Explorer is not), some web pages may look slightly different than with other browsers, but the differences were not really noticeable. Advanced security features were evident, and easy to customize. I like the cookie control and other privacy features available. The custom configuration of Opera was much easier to understand and perform than it was for IE and Netscape, and options were also available to control some of the common annoyances such as "pop-up" windows. Another interesting feature of Opera was the extensive availability of optional but simple shortcuts and mouse actions to activate features of the program.

If you would like to try a full featured browser, which only lacks the "bloat" of its better-known competitors, but loads pages significantly faster, give Opera a try. I did, and I really enjoy it.

PRIVACY:

In the previous edition of the Examiner, this column discussed some common annoyances on the Internet. I have found a suite of free or inexpensive programs that may dramatically reduce some of the annoyances mentioned. Panicware, at http://www.panicware.com, has some very effective programs that many readers may find useful. The free "Pop-Up Stopper" offers basic but effective control of the annoying pop-up windows that have become so common and annoying. Compatible with both Netscape and IE, but not AOL, (I have not yet tried it with Opera), this small program is quite capable. For those desiring more features and control, and willing to pay $20, "Pop-Up Stopper Professional" offers many more features and controls to reduce annoyances, but currently lacks Netscape support. Their premium privacy program, the $35 "Surf Pal" has all of the features of "Professional", plus offers browser cleaning, cookie control, and link maintenance. Free lifetime upgrades are available for all of the Panicware products, unlike many of their competitors who charge for upgrades. I tried Surf Pal, and it worked well preventing those pop-ups that I find annoying, but allowing those that I wanted. The cleaning functions appropriately and quickly deleted unnecessary cache and temporary browser files, and provided the opportunity to manage cookies.

To discuss these products, or any other computing issues, please listen to my two weekly call-in radio shows on KLVI, 560am, Tuesdays from 6-7pm, and Saturdays from 1-3pm. There is also a new website where much of this information will be available at http://www.mycomputershow.com.

Firewalls
Possibly Free But Necessary PC Protection

Some months ago, one of my daughters called from her dorm room and told me that something strange was happening on her computer. She was connected to the campus network, and was typing a paper for her economics class. As she was typing, her cursor moved "all by itself" to a prior paragraph, deleted words, and "you're crazy" appeared. The cursor then moved elsewhere, deleted more content, and an obscenity appeared. Additional windows started opening and closing, her CD tray opened and closed, and her computer was ".out of control." All this occurred in a matter of seconds, and continued until she shut down her computer, losing that portion of work since her last save. I asked her if she had recently updated of her McAfee antivirus, and she assured me that she had. I walked her through rebooting the computer, and instructed her to immediately update McAfee, shut down the computer, unplug from the network, reboot, and scan for viruses. Moments later she asked, "What is Backdoor-G? McAfee found that on my computer." She joined the millions of other PC users who unknowingly have had their computers infected with one of hundreds of programs that allow others to access their computer without their knowledge or consent. I instructed her on removing Backdoor-G, reconnecting her computer to the network. Her next step was to download ZoneAlarm, arguably the most widely used firewall in the world.

This true anecdote is indicative of a problem facing millions of PC and MAC users on a network, or surfing the net. Previously it was thought that the problem only affected network users, and then broadband users such as DSL and cable modem users became prime targets of hackers. Now, even dialup users are prone to hack attack, and a firewall, properly installed and updated, may now be a more important piece of protective software for a computer user than antivirus software. The function of a firewall is to protect unauthorized network or online access to a computer, and to prevent rogue software already on a computer from transmitting information. The reason is that while a virus may possibly destroy the data on your computer, a hacker using a backdoor program can access all of the files on your computer, monitor and interfere with computing activities, track and record web surfing, and capture keystrokes used for usernames and passwords. Identities can be stolen, and existing financial accounts can be accessed and new ones created by the intruder. There are also documented cases of hackers accessing online banking and investment accounts, conducting transactions, and transferring balances to offshore accounts. Incidents have been published about hackers accessing individuals' personal accounting, checkbook, and tax software and then changing critical numbers and balances. Some hackers, have also downloaded personal files, and other vital information, and then deleted the originals on the target computers, making account repair and correction difficult. For businesses, important proprietary information may be accessed, compromised or altered. These destructive acts are not some theoretical happening, but genuine occurrences that happen far more often than many computer users realize. There is also published anecdotal evidence that the majority of users with infected computers are unaware that they are candidates for identity or financial theft, and access and destruction of their files. Personally, I have helped local individuals who thought that their hard drive had "crashed" only to find out that critical files had been purposely deleted or altered by a hacker using a backdoor to access the computers. A selling point of Windows XP has been that it includes an integral firewall, but it generally does not have the protection ability of many third party products.

Cost should not be an issue, because there are several fine firewalls that are free for personal use, and in the free - $50 range for business use. Stopping just one unauthorized access will likely make the small investment the bargain of a lifetime. The reason why several software companies give away their firewalls is to build up a loyal following of users, who will then recommend the paid version of the firewall they use to their employers.

Below are those products available free for personal use. Not listed are the fine commercial products published by McAfee, Norton, BlackIce, and others. It should be noted that in many of the published side-by-side comparisons, some of the "free" firewalls significantly out perform their expensive commercial competitors, and may also include features lacking in their expensive counterparts. Just as antivirus software must be updated frequently, firewall users must also check for periodic updates. According to published reports, the most widely used personal firewall is Zone Alarm, published by Zone Labs, and available from http://www.zonelabs.com. The basic version is free for personal use. A more advanced version, ZoneAlarm Pro, is $40 for all users, but the free version is very adequate for home users. In published reviews, ZoneAlarm has been top rated by many of the computer magazines, including receiving the most awards, and has been adopted as standard equipment by several networking companies, and some internet service providers.

A lesser known, but more comprehensive firewall is Agnitum's Outpost Firewall. Outpost is free for personal, business and educational use. In addition to the typical protection from external hackers, and internal backdoor programs, Outpost also includes ".protection from, and control of, cookies, banner ads, e-mail viruses, backdoors, spyware, crackers, adware, and virtually every other Internet danger." For those concerned about child or employee access to questionable Internet content, Outpost, available for download at http://www.agnitum.com, also includes content filtering. A unique aspect of Outpost is its "open architecture" which encourages developers to create software plug-ins to enhance its capacity. A "Pro" version, with several additional enhanced network features, is available for $40.

Tiny Personal Firewall, available at http://www.tinysoftware.com, is also available free for personal use, and $39 for commercial use. Highly regarded by many of the computer publications, and including some features not included in ZoneAlarm, this product is also capable of protecting a computer from hack attack.

Sygate at http://www.sygate.com publishes both a free personal firewall ($20 for commercial use), and a professional version ($48). While popular and reliable, it lacks many of the features of the products above. According to information on the Sygate website, there are "millions" of users protected by Sygate firewalls.

Lacking many of the "bells and whistles" of other free personal firewalls is "Look 'N' Stop Lite". The free version is available at http://www.looknstop.com. The "Pro" version costs $27-$35, depending on the operating system.

Considering the risks of not having firewall protection are potentially greater than the risks from a virus, and also considering that there are free firewalls available, there is absolutely no reason why all computer users on networks and surfing the net should not have the protection of a firewall.

Cookies
They May Not Be Good For You

If you are using Internet Explorer or Netscape to surf the web, and you use the default security settings, you likely have accumulated a large number of "cookies" or small text files from web sites that you have visited. At the least, they take up valuable space on your hard drive; at the worst, they may be used to violate your privacy and track your Internet activities for others to utilize without your knowledge or consent.

Cookies fall into a few broadly defined categories. First, is what I call the "necessary" cookies. These are small text files placed on your computer by websites that are explicitly for your personal benefit. Sites that use these types of cookies are My Yahoo, My Netscape, My CNN, etc. These cookies are the ones that tell the website of choice what stocks to follow, news categories to track, sports teams to follow, account numbers, and other information of choice. When connected to the selected site, the cookie is read by the website, and appropriate information is utilized. Since these cookies often contain personal information, they are typically encrypted by the website before they are placed on the user's computer, making it difficult for other sites to read that cookie.

Another type of cookie is the very short term "temporary" or "session only" cookie that is only used once and then deleted, or automatically deleted when the browser is closed. Cookies of this type are commonly used by websites with online address books (Yahoo mail), storing temporary logon information that does not have to be reentered (Ebay), and shopping sites to track shopping cart contents. In order to use such sites, this type of cookie is often required to take advantage of the online conveniences. Some sites, such as many Microsoft sites, require that cookies be accepted. Since these cookies disappear, they are generally considered safe.

The type of cookie that is of most concern to those interested in privacy and security is the "tracking" cookie that complies websites visited and other personal information intended to be collected by marketing companies. Some of these cookies fall in the realm of "spyware" and can be detected and removed by software such as the AD-AWARE mentioned in recent columns. These types of cookies have caught the attention of agencies such as the Federal Trade Commission (FTC), and many privacy groups. In a recent FTC filing it was stated, "...marrying the offline and online behaviors of consumers into one database (merger of Double Click, the major collector of personal information from cookies, and Abacus, a direct mail company) ... (t)he profiles created from information in the new database show a much more detailed view of individual consumer behavior than either of the separate databases could have shown alone. Once consumers become informed of the extensive abilities of corporations to track and profile consumers' online habits, consumers may be less likely to visit particular web sites, engage in e-commerce, or post to newsgroups, particularly if there are negative consequences, such as a potential employer gaining access to that profile and making hiring or firing decisions based on the contents." This type of activity has also attracted the attention of European regulators. Last November, the European Union (EU) voted on legislation to ban the use of cookies that gather personal information. In a report presented to the EU, "...the use of cookies by companies is an infringement on personal privacy and therefore a human rights violation under the European Convention for the Protection of Human Rights and Fundamental Freedoms. So-called cookies, spyware, web bugs, hidden identifiers and other similar devices that enter the users' terminal equipment without their explicit knowledge or explicit consent in order to gain access to information, to store hidden information or to trace the activities of the user may seriously intrude the privacy of these users. The use of such devices should therefore be prohibited unless the explicit, well-informed and freely given consent of the user concerned has been obtained."

It should be noted that Double Click has made it possible for users to opt-out of having their personal information collected by Double Click or any of its clients. Simply click on "privacy" on the doubleclick.com website and follow the links to the opt-out cookie. Double Click will then place an "opt-out" cookie on the hard drive, which will prevent any Double Click client from harvesting personal data from that computer.

It is very easy for web surfers to control the cookies that websites attempt to place on their computers. In some versions of Internet Explorer 5, simply click on TOOLS - INTERNET OPTIONS - SECURITY - INTERNET - CUSTOM LEVEL and set the cookie setting to "Accept" and "Prompt". In IE 6, from INTERNET OPTIONS click on PRIVACY - ADVANCED and click on the desired settings. Personally, I allow "session" cookies, but "prompt" for all others. When a cookie window pops up (using IE6), the choices are "Allow Cookie", "Block Cookie", "More Info", and "Help", with a box to apply the decision to all cookies from that site. The "More Info" button will give the details of the cookie. With this information, the user can decide if he, not the browser default, wants the cookie on the computer. With Netscape, go to EDIT - PREFERENCES - ADVANCED and select "Prompt" to control cookies. The alternative browser "Opera" discussed in a recent column here in the Examiner has what is claimed to be the best cookie management of any browser. It gives much more information about cookies, and has a greater selection of cookie handling options which can be quickly and easily customized for any website using a pull-down cookie management menu.

It is easy to view the cookies stored on a computer. Internet Explorer stores cookies in the "WINDOWS" directory, in a "COOKIES" subdirectory. If viewing IE cookies with Windows Explorer be sure to click on VIEW - DETAILS to see all of the cookie information. Netscape uses a simple text file "cookies.txt" in the Netscape - Users directory. Cookies.txt can be opened and read with Notepad or any other text editor or word processor. To find these files quickly, simply click on START - FIND - FILES AND FOLDERS - and search the hard drive for "cookies".

There is a large variety of cookie management software available, much of it free. From any major download site, such as the local site at tucows.exp.net, or download.com, search for "cookie" or "cookies" and a variety of software will be available. While most of the cookie management software will work with most browsers, there are several fine ones that are specific for Netscape, IE, or AOL.

Many webmasters, knowledgeable about surfer resistance to invasive cookies, have also implemented another device in order to gather personal information from the users' browser, without the users' consent. This is called the "1 Pixel GIF" which is a very tiny graphics file of only 1 pixel in size (each tiny dot on your computer screen is a pixel). This method defeats many of the tools utilized to manage cookies, but some newer versions of cookie management software are able to detect and stop this method of gathering personal information.

Protect your privacy by managing and controlling your cookies. The slight inconvenience of managing, rather than accepting all cookies, may well pay off by restricting someone else from accessing your personal information without your consent.



For more information on the Tulsa Computer Society click here





Tulsa Computer Society 03/02/2002
Don Singleton, President