On Tue, May 11, 2004 at 11:33:25AM -0700, D B wrote:
I'm not real sure how to post this, nor am I sure
of
the scope. I am still learning about computers.
Ok, no worries. We all start somewhere, right?
All transactions done via secure websites are
secure,
however the auto mailing feature to confirm orders
sometimes contains sensitive data.
All transactions done via secure websites are
_supposed_ to be secure, but the fact is that
information leakage, poor configurations, MitM
attacks, and user error, amungst other issues, can
render a supposedly secure site insecure.
You are right though. Too many sites will send TMI
back in a confirmation email.
When the customer
is on a wireless connection, be it ISP or home LAN
that data is broadcasted in the clear for anyone
within range to eavesdrop.
Not always. The wireless link itself may be
encrypted between the AP and the user's portable
device - with various levels of security. Also, if
they are using a secure website, the SSL traffic is
encrypted separately from the transport medium.
That is an end-point to end-point system, so even
sniffing "clear" wirelss traffic will only gain the
attacker cyphertext.
A wired internet connection
limits the number of people who have access to
this
data simply by the nature of the internet putting
it
within acceptable risk.
Define acceptable risk? A wired connection is
inherently more secure than a wireless connection,
but there are going to be points where the traffic
can be compromised as long as the traffic is going
over the public internet. Both wired and wireless
suffer from that. The wireless is only inherently
less secure because of the broadcast element
somewhere in the data path. That makes the traffic
easier to eavesdrop on, but it's not extraordinarly
difficult to eavesdrop on wired traffic either.
It is legal according to US law to eavesdrop on
wireless connections.
The safe answer is "No." The real answer _may_ be
more complex depending on your circumstances. For
example if there's an open AP that's not WEP
enabled, the users would have no reasonable
expectation of privacy. However, if it came down to
how a US Court would see it, the safe answer is
usually "no."
This is similar to overhearing conversations on
portable phones. You're not supposed to listen in,
but if you and another user are sharing the freq, it
would be hard to charge either side with
eavesdropping. This is NOT the same thing as
pointing a high gain 900Mhz antenna at the
neighbor's house with the intent to listen in.
Intent does matter in the eyes of the law.