Internet Privacy 101

Friday Dec 17th 2004

Got a really angry phone call from the guy who had the site I just dropped from my server (read previous post on the whole message board thing). Was I expecting it? Yeah. I knew it was going to happen. It was one of those things where that conversation was inevitably going to take place.

The bulk of the conversation was a rather lengthy attempt to try to state that what I did was wrong - even though I was 100% in the right.

The rest of the conversation was questioning the legality of what I did. He said he had called my host provider and so on because he thinks that what I did wasn’t “right”. Whether it’s his version right or wrong, here’s the plain fact of the situation:

Any information you send to any computer system can be read by the person who hosts/owns it. This includes, but is not limited to, usernames, passwords, “private” messages and so on. Repeat: Any information you send.

Seriously, I remember back in the DOS BBS days the exact same thing used to occur with the same argument “If I write a ‘private’ message on a BBS, that’s really ‘private’, right?” Wrong. It was an incorrect assumption before the internet and it’s an incorrect assumption now. If the person who hosts the content decides to read all of your stuff flagged as “private” on a system - that is perfectly 100% legal to do. Is it right/correct? Morally, no. Technically, yes. I remember reading lengthy debates on FidoNET about what is considered to be ‘private’ and what isn’t. The result of all those debates ended the same way every time. If you want to reasonably guarantee your privacy, you must encrypt your messages and have them decrypted by the intended recipient. If you do not encrypt your messages, they will be probably read by the person who hosts/own the content on the server.

If you want privacy on the internet.. guess what, no such thing if you’re just running plain text. AIM conversations? Logged. ICQ? Logged. MSN? Logged. E-mails? Logged. It’s all logged. If you want to encrypt your e-mails, the way to encrypt your messages is by using PGP. If you want to encrypt your instant message conversations, use add-on keys like AIM Encrypt.

If you want to encrypt your conversations on a message board… not gonna happen in plain-text world. Your username is plain text stored in a database. Your password is plain text stored in a database. All your conversations, repeat, ALL your conversations are also plain text - in the database. The “private” flag on any message board is not private. It never has been.

phpBB, like just about every other PHP/MySQL based message board system allows the administrator 100% complete access to the database. It’s not like there’s some magical thing out there that will protect you as a user from the administrator viewing all of your information. The database’s content is priviledged information to the administrator. That’s a fact. Anyone who would believe otherwise - check your head.

rss feed for this article's comments

comments and pings are closed for this article

« Day off?New look »