28.05.2023 Views

The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Additionallyy, there isn’t just one tyype of certificate on the Internet; there

are levels of certificates. The most common certificate, one yyou see all the

time, identifies onlyy that the domain name belongs to someone who

requested the certificate, using e-mail verification. It could be anyyone, but

that doesn’t matter—the site has a certificate that is recognized byy yyour

browser. The same is true of the second kind of certificate, an

organizational certificate. This means that the site shares its certificate with

other sites related to the same domain—in other words, all the subdomains

on mitnicksecurityy.com would share the same certificate.

The most stringent level of certificate verification, however, is what’s

called an extended verification certificate. On all browsers, some part of the

URL turns green (ordinarilyy it’s grayy, like the rest of the URL) when an

extended verification certificate has been issued. Clicking over the address

—https://www.mitnicksecurityy.com—should reveal additional details about

the certificate and its owner, usuallyy the cityy and state of the server

providing the website. This phyysical-world confirmation indicates that the

companyy holding the URL is legitimate and has been confirmed byy a

trusted third-partyy certificate authorityy.

You might expect the browser on yyour mobile device to track yyour location,

but yyou might be surprised that the browser on yyour traditional PC does the

same thing. It does. How?

Remember when I explained that e-mail metadata contains the IP

address of all the servers that handle the e-mails on their wayy to yyou? Well,

once again, the IP address coming from yyour browser can identifyy which

ISP yyou are using and narrow down the possible geographical areas where

yyou might be located.

The veryy first time yyou access a site that specificallyy requests yyour

location data (such as a weather site), yyour browser should ask whether yyou

want to share yyour location with the site. The advantage of sharing is that

the site can customize its listing for yyou. For example, yyou might see ads on

washingtonpost.com for businesses in the town where yyou live rather than

in the DC area.

Unsure whether yyou answered that browser question in the past? Then

tryy the test page at http://benwerd.com/lab/geo.php. This is one of manyy test

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!