[117423] in Cypherpunks
Secure Browsing? Not So Fast
daemon@ATHENA.MIT.EDU (Anonymous)
Thu Sep 2 21:46:17 1999
Date: Fri, 3 Sep 1999 03:17:52 +0200 (CEST)
Message-Id: <199909030117.DAA16258@mail.replay.com>
From: Anonymous <nobody@replay.com>
To: cypherpunks@toad.com
Reply-To: Anonymous <nobody@replay.com>
<http://www.wired.com/news/print_version/technology/story/21561.html?wnpg=all>
Secure Browsing? Not So Fast
by James Glave
1:45 p.m. 2.Sep.99.PDT
As soon as a new Web service was launched this week promising completely anonymous and private
Internet use, along came a renowned crypto expert to punch a huge hole in the claim.
And what was the immediate reaction of the director of technology for PrivacyX, which uses a Web browser's
built-in digital certificate technology to offer completely anonymous Web browsing, email, and chat?
"Cool," said Wil Boucher.
His next reaction was to fix it.
"The hole has been repaired, and will not be a problem," Boucher said within an hour of being alerted to the
flaw.
In any event, this wasn't the way PrivacyX CEO Douglas Whorrall had hoped to launch his service after
building it up for the last year and a half.
Whorrall promised customers a new level of privacy at an optimum time: the very week of the Hotmail
security breach, the most widespread security failure in Web history.
"We have no idea who our customers are," Whorrall said. "We can't show the info to advertisers because we
don't know it."
Then Ian Goldberg, chief scientist at Zero-Knowledge Systems, quickly cracked the PrivacyX system.
"It took me and another guy here [at Zero Knowledge] about 20 minutes to figure out how to [break it],"
Goldberg said. "Anyone with a Web page on the Net, if PrivacyX visits them, they can tell who they are."
The PrivacyX browser uses a proxy to strip out IP addresses and any other identifying information so, in
theory, a user can browse the Web without leaving any identifiable footprints.
The PrivacyX software also filters JavaScript and other scripting languages that can be used to track users.
Until mid-Thursday, though, it failed against Goldberg's hack.
"Click me to go to a site that will show you your real IP address and hostname," Goldberg's demonstration
page read.
Goldberg also said that his hack could even show the IP address of other PrivacyX users.
Whorrall was immediately notified of the problem and put Boucher on the case.
"As with any software that is put out there for public consumption, we depend on the feedback of others to
ensure that we have the best product available at the time," Boucher said. "Any feedback relating to our
services can only help us make it better."
Goldberg also said he uncovered problems with the way the PrivacyX proxy uses Secure Sockets Layer -- the
crypto that secures Web browsers for e-commerce.
He said that when a user uses the browser to log into a site that already uses SSL, such as Amazon.com,
the user loses some of the protection offered by that site's use of the crypto technology.
But PrivacyX's Boucher said that his firm's browser was never intended to be a replacement for trust; rather,
it was designed to allow users to visit sites without revealing their identity.
"If you are comfortable enough with a site that you will be performing transactions on that site (which in
most cases are going to reveal your identity anyway), you would not need a proxy device to go to that site,"
Boucher wrote in an email.
In fairness to PrivacyX, Goldberg is one of the world's most esteemed security experts.
In 1995, while a computer science student at the University of California at Berkeley, Goldberg cracked
Netscape's SSL implementation.
Three years later Goldberg was part of the team that cloned a GSM cell phone -- a feat the cellular industry
had said was impossible.
With the first-week snafu behind him, Whorrall said he hoped his Vancouver-based company will have 1
million subscribers within 18 months, largely because he said PrivacyX offers secure email in addition to
private Web browsing.
PrivacyX users can only send secure email to other users of the system.
The company requires members to reconfigure their email client software to send and receive mail through
its servers. Customers must then toggle their preferences to switch between email sent and received from
PrivacyX, and that handled by their regular ISP.
One competitor remained unimpressed.
Lance Cothrell, president of anonymous Web browsing service Anonymizer.com, said that PrivacyX was
jumping on the anonymous browsing bandwagon.
"It always concerns me when people with no background in privacy or security start launching sites like this,"
said Cothrell.
"I am concerned about their motives and their ability to provide the protection they are promoting."
Whorrall described his team as "young businessmen who have a computer background," and said that they
are all long-time advocates of privacy.
Cothrell said that the more consumers understand the value of their privacy, the safer the Web will be for
everyone.
"The more people who are doing this, the more the word gets out about this issue, the better."
