Chapter 5

Chapter 5

1. Privacy notices

   • TRUSTe
     • Do what you say, do not treat privacy statements and disclaimers, revisitn privacy statement, communicate privacy practices to entire company....
   • Trustmarks: TRUSTe, VeriSign, Better Business Bureau are examples.
   • Layered notices: short, with links to full notice.

2. Infrastructure

   • Web Server
   • Proxy server
   • Caching
   • Webserver log
     • Nota 1
   • IP
   • TCP
   • SSL
     • Browser to web server security
   • TLS
   • Javascript
   • Flash

3. WWW

   • HTTP
   • HTML
   • XML
   • URL
   • Hyperlink
   • HTML5
     • Storage can be cleared by deleting cookies

4. Threats

   • Malware
   • Social engineering
   • Phishing, spear phishing and whale phishing
     • Use up-to-date software and anti-malware protection!!
   • Spam email
     • US CAN-SPAM Act requires commercial email to have clear way to unsubscribe.
       • Email server that blocks spam.
     • EU Directive on Privacy and Electronic Communications prohibits unsolicited commercial email without user´s prior consent.
   • Spyware
     • software covertly downloaded
     • keylogging
   • Cross-site scripting
     • Developers, web&database, Testers

5. Cookies

   • session cookie
     • Deleted when user leaves website
   • Persistent cookie
     • Set to expire at some point in the future
   • First party cookie
     • Set and read by hosting webserver
   • Third party cookie
     • Set and read on behalf of a third party
   • Flash cookie
     • Stored and accessed by Adobe Flash, a browser plug-in instead of HTML.
   • Web beacons
     • Web bug, pixel tag or clear GIF. Operates as a tag that records an end user-s visit to a particular web page.
   • Digital fingerprinting
     • Identifies device based on information revealed to the website by the user. Eg. IP, timestamp, browser type and OS.
   • Supercookie
     • Value of cookie persists after deletion.