Computer Security: Chapter 3 - Privacy Enhancing Technologies (PET)

3. Privacy Enhancing Technologies (PET) Bobby Vellanki Computer Science Dept. Yale University Oct . 2003 1 PET [cf. Bobby Vellanki] PET = Privacy Enhancing Technology – technology that enhances user control and removes personal identifiers Users want free Privacy Hundreds of new technologies developed Cf. Electronic Privacy Info Center ­ www.Epic.org 4 categories of PETs: Encryption Tools (e.g., SSL) Policy Tools (e.g., P3P, TRUSTe) Filtering Tools (e.g., Cookie Cutters, Spyware) Anonymity Tools (e.g., Anonymizer, iPrivacy) 2 Encryption Tools [cf. Bobby Vellanki] Encryption tools Examples: SSL, PGP, Encryptionizer Thought of as a security tool to prevent unauthorized access to communications, files, and computers Users don’t see the need Necessary for privacy protection but not sufficient by themselves Pros: Inexpensive (free) / Easily accessible Cons: Encryption Software isn’t used unless it is built­in to the software Both parties need to use the same software Conclusions: Easy access All parties need to use the same tool Good start but not sufficient enough 3 Policy Tools (1) [cf. Bobby Vellanki] P3P (Platform for Privacy Preferences) Developed by World Wide Web Consortium Usage: Users declare their privacy policy on their browsers Websites register their policy with Security agencies The website policy is compared with user policy and the browser makes automated decisions Benefits: Might help uncover privacy gaps for websites Can block cookies or prevent access to some sites Built into IE 6.0 and Netscape 7 as of July 2002 Policy Tools (2) [cf. Bobby Vellanki] Other Policy Tools TRUSTe Non­profit organization which ensures that websites are following their privacy policy Promotes fair information practices BBBonline (Better Business Bureau) Conclusions Users are unaware of Privacy Policies Not all websites have Policy tools Need automated checks to see if websites are following their privacy policy 5 ... - tailieumienphi.vn