B
Bob
For everyone out there who's using Roboform...
What assurances do we have that the neat little tool we're using won't
someday - or maybe already has - send the contents of the passcards,
safenotes and identities back to it's maker? Everyone is under the belief
that it's not spyware - and as far as I can tell, it's not. But that's the
problem. It does periodically call in, and check for a new version.
When activating it, it accepts commands from them - invisibly to you - in
the same browser window that you are watching. I captured what it sends one
day, and it looks like a bunch of alphabet soup at the end of a url.
Anything could be in there - it does 3des - and we'd never know what it
contains. All this happens without any complaint from software firewalls
because it talks through IE or Netscape, of whatever other browser that you
use.
After all, you've allowed it to happen so you could use it. Just think, it
knows how to access your bank accounts, credit card accounts, mortgage, etc.
You may have also taught it how to fill in forms that want to know who you
are. Name, address, ssn, phone, birthdate, place 'o birth, drivers license
#.
This thing has shown that it has an effective mode of backchannel
communications. Text can be pretty effectively compressed. It wouldn't even
have to send it all at once. Little pieces here and there.
Any crypto experts out there that can shed some light on this, and what's in
the data it sends on the command line? I asked, and was told it was just to
ensure that it's requests make it the net.
What assurances do we have that the neat little tool we're using won't
someday - or maybe already has - send the contents of the passcards,
safenotes and identities back to it's maker? Everyone is under the belief
that it's not spyware - and as far as I can tell, it's not. But that's the
problem. It does periodically call in, and check for a new version.
When activating it, it accepts commands from them - invisibly to you - in
the same browser window that you are watching. I captured what it sends one
day, and it looks like a bunch of alphabet soup at the end of a url.
Anything could be in there - it does 3des - and we'd never know what it
contains. All this happens without any complaint from software firewalls
because it talks through IE or Netscape, of whatever other browser that you
use.
After all, you've allowed it to happen so you could use it. Just think, it
knows how to access your bank accounts, credit card accounts, mortgage, etc.
You may have also taught it how to fill in forms that want to know who you
are. Name, address, ssn, phone, birthdate, place 'o birth, drivers license
#.
This thing has shown that it has an effective mode of backchannel
communications. Text can be pretty effectively compressed. It wouldn't even
have to send it all at once. Little pieces here and there.
Any crypto experts out there that can shed some light on this, and what's in
the data it sends on the command line? I asked, and was told it was just to
ensure that it's requests make it the net.