Security Issues

Issue 5: Security

Why all the fuss? Are you kidding me? Security is a very, very serious issue. Big names like Steve Gibson has raised a big ruckus about the potential vulnerabilities in XP and with hackers targeting Microsoft software with an increasing intensity, it is no wonder. We all know how insecure Outlook and IIS have been, but there are now concerns about changes in the XP Home Edition (and possibly other versions) that will provide support for unrestricted, full raw sockets. It is all pretty technical, and Steve can explain it better than we can here, but the problem is getting a lot of coverage and is getting people concerned. Visit his site at www.grc.com for the gory details on that.

Another concern that people have is the firewall. They feel that it may not be as 'neutral' in regards to letting Microsoft requested information through. This may or may not be a valid concern - only time will tell. Others worry that because the firewall is integrated, XP may not let you install your own third party firewall in the place of that built in one. Many of us use Zone Alarm from Zone Labs, which is perhaps the single best software firewall available for the home user and it just so happens to be free. Others like Black Ice or the Norton firewall products, among others. If users are not allowed to put their own additional security measures in place, Microsoft is going to have a very hard time convincing any of us about having a genuine concern for security. Many users just don't trust Microsoft enough to let them make the decisions about firewall security, and I can't say I blame them.

Perhaps the single biggest concern I have in regards to security is Microsoft Passport. This started as a small issue, but thanks to conscientious users and competitors, the issue has been brought to light in a very public way. The resistance to the Passport concept has Microsoft so worried, they are marching on Washington D.C. to lobby congress about its safety. Well, where there is smoke, there is probably fire.

Passport is designed as a one-stop source for all of your key online information. It is touted as being able to help make the online experience more convenient, but I just don't buy it. Passport is designed to gather information about you as you use the internet to browse, type data into forms, enter passwords to key sites like your online bank and even credit card numbers, email addresses and shipping information that comes up when you buy something off the internet. Given how insecure Windows has historically been, do we really want Microsoft of all people keeping an online database of all of our personal information? Do we want to have all of our internet passwords, bank account information, credit card numbers, shipping address, phone numbers, social security numbers and email addresses on one single file that might be hacked into by people just so we can have the convenience of "One Click Ordering"? I don't think so.

One stop shopping, but only from Microsoft

This one really sends a chill down my spine. It is so open to abuse by Microsoft and its business partners that it is not even funny! What if Microsoft tracks all of your online activities, including your HotMail web mail accounts, and later decides to sell it to marketers? Lotus promised it would never do that, but they changed their minds and planned to until people protested in vast numbers. AOL did the same thing, and have tried two or three times to turn that information into a revenue source and still seem to be trying, even though customers have complained bitterly. Microsoft had such oppressive terms in their original Passport use license that they were forced to remove it or face class action lawsuits. Are you telling me that we should trust these guys with critical information like that? I don't think so.

Not only do people, including myself, not trust Microsoft on this one, but I don't trust hackers either. Why the heck would anybody want all of that information stored in one place at all? Is convenience worth risking financial ruin or identity theft? After all, in order to get that data, Passport has to be open and running, which means people can hack into it. SSL was supposed to be secure, but people have already cracked that code. Who's to say that this code won't be cracked in a matter of weeks?

I sure as heck don't want Microsoft requiring me to use their browser, their firewall and their passport every time I want to buy a book or some other trinket from the internet. I sure don't see why we have to let them track our HotMail web mail accounts with this invasive Passport idea. Who do these people think they are anyway? Of all the things people are freaked about, this should be the absolute biggest one, because it can come back and bite you with more force than any other.