How cookies threaten user privacy and Internet security

Cookies and Their Impact on Internet Security

Cookies are tiny bits of information that is stored by a web site when a user enters its site. The next time the user enters that site; the user's browser sends the information back to the site (Andrews, 1996). A cookie is typically designed to remember and tell a web site some useful information about the user.

For example, an online music store may uses cookies to keep track of what products each individual customer purchases. When the customer returns to the site, the company's browser allows it to read the cookie. The site could then make a list of similar products that the customer may be interested in, based on the cookie's information (p. 20).

Cookies are invisible to users, unless the users set preferences that alert them when cookies are being used. In most cases, cookies are harmless (Cole, 2002). Cookies cannot be used to gather personal information about users, unless the users provide the information.

However, some companies use cookies develop a profile of Internet users' interests based on the sites visited and the things they do at the sites (Descy, 1999). As a result, advertisers can tailor online advertising based on the interests and buying habits of Internet users, or use the information in a variety of other ways. This can present a significant threat to Internet security, if Internet users do not exercise caution.

Introduction

Many Web surfers have a fear of cookies that is based on ideas from the media that cookies are a dangerous risk to Internet security (Lowe, 2002). However, the majority of cookies are actually harmless.

Cookies are small text files that many websites place on a user's machine to identify it (Cole, 2002). Different websites use cookies for different reasons. Many use cookies to store registration details, so that users do not have to enter all their details every time they visit a site.

Others use them as an additional security check, or to verify a user's identity. In addition, some use websites use cookies to record which areas of a website a user has visited. Advertisers can also use cookies to monitor which advertisements have been seen by users and how successful their campaigns are.

Cookies are actually beneficial to Internet users and websites when properly used to personalize the Web experience. However, some websites' use of cookies has a negative impact on Internet security, such as DoubleClick Network's use of cookies to record the Internet habits of users (Davidson, et al., Sterne, Philips). This type of use poses a threat to the privacy of the users, as the company uses information obtained through cookies for marketing purposes.

Weighing the Benefits of Cookies with Their Threat to Internet Security

Cookies are mechanisms developed by the Netscape Corporation to make up for the stateless nature of the HTTP protocol (Netscape). Without cookies, every time a browser requests the URL of a page from a Web site, the request is treated as a completely new interaction.

The request, which is often just the most recent in a series of requests as the user browses through the site, may be lost. While this makes the Web more efficient, this stateless behavior makes it difficult to create things, such as shopping carts, that must remember the user's actions over a long period of time (Philips, 1995).

One of the major issues surrounding Internet security in today's society is keeping information secure and private. The Internet is a public network, so information can easily be shared with or stolen by others.

Cookies have a significant impact on Internet security when companies cross the line between using cookies as a simple data management tool and infringing on the online privacy of Internet users (Narayan, Gunderson). The users are often the victims here, because cookies are tracking all of their movements on the Internet, and the users do not know that it is happening.

Fundamentally, cookies are harmless pieces of text. They cannot be used as a virus and cannot access the hard drive. However, cookies, when transmitted through a website, can have an impact on Internet security.

Cookies cannot be used to steal data or information over the Internet. They are simply used to store information that was provided by the user at some point. For example, if a user entered his name when filling out a form, a server can turn this information into a cookie and send it to the user's browser. The next time the user visits the site, the site may welcome him by name. This is a harmless use of cookies.

However, cookies can negatively affect user security when they are used for other purposes (Andrews). When a browser accesses and surfs Web sites, it leaves a trail of information across the Internet, including the name and IP address of the computer, the brand of browser used, the operating system that is run, the URLs of the Web pages accessed, and the URLs of the pages last viewed (p. 17).

Dangers of Cookies to Internet Security

Cookies basically enable companies or individuals to follow this trail to learn about the Web browsing habits of the user.

For example, the DoubleClick Network develops profiles of individuals using the World Wide Web and sends them advertising banners customized to their interests (Descy, 1999). DoubleClick's clients are Web sites that want advertise their services.

Each of Doubleclick's clients becomes a host for the advertising of other members of the network. The clients also create advertisements for their products and services, and submit them to DoubleClick's server.

Each Web site uses it site to link with DoubleClick. If a user views on these pages, his browser automatically links to DoubleClick's server to retrieve one of its member's advertisements and return it to the browser. When the user reloads the page, a different advertisement appears (p. 50).

The user typically does not even notice the difference between DoubleClick's graphics and any other Web banner, but there is one important difference. When a user initially connects to the DoubleClick server to select a banner, the server assigns the browser a cookie with a specific identification number.

When the user has been assigned this number, the server will recognize him any time he connects to any Web site that subscribes to the DoubleClick Network. Over a period of time, DoubleClick develops a list of which member sites the user has visited and revisited, using this information to create a personal profile of the user's tastes and interests.

The DoubleClick server then uses this profile to handpick advertising banners based on the user's individual preferences. This also allows the company to create audience profiles and rating the success of the advertisements.

While names and e-mail addresses are not part of the information that DoubleClick tracks, other information that the browser leaves behind is enough to allow it to identify the user. Therefore, many critics say that DoubleClick's use of cookies violates Internet security.

While the majority of cookies are harmless efforts to improve Web browsing, many can be intrusions on Internet privacy. There are many features and methods that allow users to refuse cookies. Woodruff suggests that users allow transient cookies, which are only active during a particular browsing session and refuse persistent cookies, which store user identification information over an extended period.

The impact of cookies on Internet security implications has grown along with the size of the Internet. Many websites use cookies to implement access control schemes of different types.

For example, a site that requires a user name and password may pass a cookie back to the user's browser the first time the user logs in. After the initial session, the site may allow the user access to restricted pages if his browser can produce a valid cookie.

This process can be advantageous to the site but may also make it vulnerable to exploitation by hackers or other third parties. A hacker could use a packet sniffer to intercept the cookie as it passes from the browser to the server, using it to obtain free access to the site.

Due to the fact that browsers use the domain name system to determine what cookies belong to a server, browsers can be tricked into sending cookies to a rogue server simply by temporarily subverting the domain name server. If the cookie is persistent, it can also be stolen from the user's cookie database file.

Cookies can also impact Internet security when they are used as session IDs in a transaction processing system to preserve state throughout a multi-part transaction. For example, some systems use cookies in a system that allows employees access to corporate information. If the cookie is intercepted, a hacker could use it to make unauthorized transactions.

For this reason, systems that use cookies for authentication and state-preservation must take measures to protect the system from cookie interception (Lowe). Woodruff advises that system developers ensure that cookies contain as little private information as possible. In addition, cookies should contain data that allows the system to verify that the authentication of the person using it.

By incorporating these security measures, system developers can reduce the negative impact of cookies on Internet security and limit the damage that an intercepted cookie can do.

Cookies have had a positive impact on the Internet, as they allow both users and websites a variety of additional convenient features. However, the use of cookies has stretched beyond adding convenience.

Today, advertisers can use cookies to keep track and record the sites individuals are using and exactly what they are doing on the Web. This can have a positive impact on the Web's capabilities or a negative impact on Internet security, depending on what information is used and how it is used.

These companies can often correlate this information with the name and contact information of the user, which goes against the user's security. Cookies are an example of how technical design and individual website decisions have a direct impact on Internet security.

The majority of cookies used on the Internet are harmless, identifying users by placing information, not obtaining it. This can actually be beneficial to the user's Web experience.

Conclusion

Basically, cookies only present a problem to users if they are submitting their personal information to websites that they do not know or trust. Most reputable sites do not use cookies for information like credit card numbers or telephone numbers.

In rare cases, webmasters, who are usually amateurs, store credit card or other sensitive data directly in cookies. This poses a definite threat to Internet security, as the information is in a position in which it could be intercepted, stolen, or used for other purposes.

In general, cookies are very valuable. Sometimes they may let others know more about what you've been doing than you desire. According to Woodruff, it is in the best interest of users to find a good cookie management product and install it on their computer. Then they can selectively accept or decline cookies from individual sites, increasing their Internet security.