A Celebrated Hacker Urges People to Guard Privacy Online

When technology companies tout their systems as "private and secure," Ian Goldberg takes their assurances with a big grain of salt.

That's because Dr. Goldberg, the 28-year-old chief scientist for Montreal software developer Zero-Knowledge Systems Inc. (www.zeroknowledge.com), has a knack for cracking many of the supposedly airtight security codes that are meant to keep online data out of the hands of cyber-thieves.

Now he's putting his code-breaking skills to work on a new task: Building software that allows consumers to travel the Web in a private and secure environment.

More than most, Dr. Goldberg knows where to find the Internet's weak spots. In 1995, less than a month after enrolling as a computer-science graduate student at the University of California at Berkeley, Dr. Goldberg and a friend exposed a major security flaw in the popular Netscape Web browser.

Ian Goldberg

Two years later, Dr. Goldberg managed to crack what was at the time the most secure encryption code allowed for export from the U.S. (He did it in three and a half hours.)

And soon after receiving his Ph.D. from Berkeley last December, Dr. Goldberg and a team of security experts revealed weaknesses in the Wired Equivalent Privacy algorithm, a popular wireless-networking protocol used to connect personal computers and laptops.

In fact, Dr. Goldberg is so respected in the hacker community that recently he was asked to speak in July at Def Con, the 9th annual underground hacker conference in Las Vegas that is expected to draw hundreds of corporate security executives.

Still, Dr. Goldberg believes that the Internet can be a safe place -- if you take steps to protect yourself.

For example, he says, some software allows users to anonymously browse the Web, send e-mails and take part in online chats. Others create personal "firewalls" that prevent outsiders from accessing data on your home computer and manage your "cookie" files to foil the audit trails created by many Web sites.

Several popular Internet companies have fallen prey to hacking in the past few months, including e-tailer Egghead.com Inc. and book-buying service Bibliofind, a unit of Amazon.com Inc. Other Web sites, such as Intuit Inc. and Travelocity.com Inc., recently admitted to security lapses that put customer data at risk.

Meanwhile, dozens of online privacy bills are slowing making their way through Congress and state legislatures.

But Dr. Goldberg argues that stronger security codes will be more effective than stronger privacy laws. "The laws of mathematics are far more stable," he says. "Put your trust in good math, not good intentions."

WSJ.com recently spoke with Dr. Goldberg in an online chat about his views on security and the Internet.

WSJ.com:How much of a risk do consumers face on the Internet?

Dr. Ian Goldberg: It's slowly been getting better over time. The risks depend on one's threat model, of course. With something like e-mail or chat, the risk today is more one of privacy than of security. Without using protective measures, any e-mail you send, or chats like this one, are being sent "in the clear" around the Internet. One of the big risks could be that people you don't intend are reading your messages.

With e-commerce, the privacy issue is that others can find out what kind of things you like to buy online. But there's also a security risk: Hopefully, no one will be able to steal money from you online or fraudulently charge things to you.

Q:What can consumers do to protect themselves?

A: Protocols like SSL [Secure Sockets Layer] and TLS [Transport Layer Security] help protect your online browsing from a security standpoint, and products like Zero-Knowledge's Freedom help with the privacy aspects.

Freedom's e-mail and browsing features protect users' privacy when they're online. But in order for privacy to be effective, you've also got to have security. Other aspects of Freedom, such as the Personal Firewall, help in that regard.

In general, consumers should try to be aware of which products follow open privacy and security protocols and standards, which have been looked at by the world's experts.

Q:Are there things that consumers should never do online?

A: Consumers should be aware of the security and privacy aspects of their actions. This will involve some public education. There isn't a simple list of "do this" or "don't do this."

Rather, consumers need to be able to reason what is safe and what is not. Is sending your credit card number to an e-commerce site over an encrypted connection safe? Probably. Is sending your password to an administrator who asks for it by e-mail? No.

Consumers need to stay informed of the threats to their privacy and security. Zero-Knowledge has their Privacy Eye newsletter (http://privacy.zeroknowledge.com) that can help with such things.

Q:Speaking of credit cards, there have been some widely reported break-ins recently where credit-card data may have been compromised. Isn't there a more secure way to handle online transactions?

A: Unfortunately, right now there isn't a great way to buy things online that doesn't involve credit cards (though some technologies to help are coming down the road). The best thing is for companies to better protect the information they do keep about you: There's no reason to store old credit-card numbers on your Web server, for example.

Being careful about keeping the minimal amount of information you need to run your business will help ensure that customer information isn't needlessly compromised.

Q:What about a PC that's in a person's home. How vulnerable is that to a break-in?

A: If it's connected to the Internet, more than one usually expects. Personal firewalls are almost mandatory nowadays, but even they don't help completely. One of the easiest ways for an attacker to get access to your personal PC is by sending around virus- or worm-infested e-mail.

Again, this comes down to user education. Consumers need to understand the security implications of clicking on an attachment. Even if it comes from someone you know, it could still contain a virus or worm that can completely compromise your PC. Anti-virus tools are important to prevent such infections.

Q:Are there some common fears about online security or privacy that you think are overblown?

A: I think the most prevalent one is sending credit-card numbers over the Internet. Most sites use SSL, which properly encrypts the numbers in transit, and there's the legal protection on the amount you're responsible for (which most banks make $0, anyway). But that of course doesn't include the hassle in getting it fixed. Giving your credit card to a waiter at a restaurant who disappears with it for a while is just as risky.

On the other hand, a lot of people don't have enough concern about a lot of things. For example, everything you say in a chat room online can potentially be archived and indexed and searched for later, and people really don't expect that.

Q:What do you think the biggest security and/or privacy issues will be in the next year or two?

A: One of the really big things that's coming from the privacy front is a shift away from the individual being totally responsible for his own privacy protection. Right now, [tools are available] to help you protect your personal information when you're online.

But sometimes, you need to give out information [for example, to financial or health-care providers]. What we'll see in the next little while are systems to enable corporations to protect the personal data and transaction information they acquire from consumers.

This will be done both in compliance with recent and upcoming privacy legislation in various jurisdictions around the globe, as well as building more trusted relationships with their customers, preventing crackers from getting at personal data, and enabling new business models.

Q:You've managed to crack the security systems of some well-known technology companies. Do you think that the Internet can ever be truly "secure"?

A: Sure. But the primary thing that will help is openness and transparency. The protocols used for securing today's and tomorrow's Internet must be public, and examinable by the world's experts.

We're at a pretty critical time right now; the systems we're designing today will be the ones that will be pervasive for the next generation. The choices we make today regarding privacy and security will be the ones that our children will have to live with tomorrow.

Write to Peter Edmonston at peter.edmonston@wsj.com
