How does https and SSL keep my information safe?

We really need to take a look at this question as two partially related questions. First we’ll look at SSL and how the technology itself works and why it is considered to be secure. Then we’ll look at a couple of cases of customer data theft and see where the data really went and did SSL have anything to do with it?

SSL is an acronym for Secure Sockets Layer 3.0 which has been replaced recently by Transport Layer Security (TLS) 1.1 and you can read all the glorious Technicolor details by reviewing the RFC 4346 (Request For Comments) document over at the Internet Engineering Task Force. But let’s just talk about it as if we were humans, shall we?

SSL and TLS are ways that we can be assured of who we are communicating with (endpoint authentication) and hiding that communication from the outside world. TLS also prevents others from injecting new messages into our conversations and from changing messages from either party. Endpoint authentication is typically only performed for the server side of the conversation. We just want to make sure that we really are on our bank’s web site and not some phony. The bank is not concerned enough about authenticating us as we’ll do that with our account number and other information like that. There are dual authentication applications where they want to make sure we are only on a certain PC or IP address etc. but those are pretty much James Bond 007 circumstances.

When we go to a web site that starts with https:// that tells the browser to use port 443 instead of the normal http:// port of 80. A secure conversation starts with a handshake between us and the server as we decide which encryption protocol we both understand and trade some key information that confirms who is who by the use of Certificates. Certificate Authorities guarantee to us that they have done all they can to confirm that someone handing out this certificate is who they say they are. Look in your IE browser at Tools -> Internet Options -> Content -> Publishers -> Trusted Root Certification Authorities (Figure 1) to see who your browser trusts.

Our browser looks up the certificate and the Trusted Root that created it to see if the certificate is really any good. When we determine that it is we will continue with the conversation and you see the little padlock close on your browser, Figure 2.

What does all this have to do with companies losing private data? Not much. The data thefts that we keep reading about are not due to SSL or TLS failing. They are primarily from people failing to follow basic protection policies, or of companies not having those policies in place at all. When the Veterans Administration lost 26 million records of service men and women it was because an analyst had taken a laptop containing the information home (the analyst claims that he had specific approval to do so, but that’s a different post). The PC was then stolen by local burglars that fortunately never did know what they really had in their possession. The laptop was eventually recovered and there has not been any evidence that the personal data was used to impersonate anyone. Information Week recently reported that TJX Co., the parent of TJ Maxx finally told the SEC that they lost control of over 45 million records of customers over a several year period. There is some evidence surfacing that the original breach may have been due to an unsecured wireless network. These lost records HAVE been used in Florida to create credit cards used to buy Wal*Mart and Sam’s Club gift cards which are then used at the stores.

So you can see that SSL or TLS is not responsible for these thefts, unsecured back-end systems are where the information is being lost. The only way to protect yourself from becoming a victim of ID Theft is to be vigilant about watching your credit card statements and balances and checking your credit report periodically. Go to AnnualCreditReport.com, the official site created by the big three credit reporting agencies to provide you with your required free annual credit report.