Let me start with a little imagination. An analogy, if you will.

Imagine, if you will, that you are on holiday. You want to send a “wish you were here” type message to your friend back home. You have two choices: a cheapish picture postcard, or a more expensive sealed envelope. What do you choose? If you’re like the vast majority of us, you will likely choose the postcard, for both picturesque and cost reasons.

On the other hand, let’s assume you want to send your credit card number and salary details to an insurance agency. Again, do you choose the postcard, or the sealed envelope? I will not insult your intelligence by saying what the “right answer” is. I will however allow someone else to continue this analogy on my behalf, with a slight piece of satire:

the government has announced that it will soon be mandatory to use state-approved envelopes to send all mail. these new envelopes will be entirely transparent when viewed under a federally produced lightbulb, but there is no need to worry about these lamps getting out to bad people, since it is time-tested proof that all government employees are completely honest and lack all self-serving traits present in every other human being. besides, it’s for your own good and protection! and if you have something to write that you don’t want everyone to read, maybe it’s time for that all-important self-examination to reveal your underlying paranoia complex…

(quote taken from a Slashdot comment, written by someone called CrudPuppy)

How does that make you feel? If you honestly sat down and thought about that eventuality, would you be happy about the idea of someone, anyone, being able to read your most private thoughts and words? Is it fair to expect that once it’s written down, “The Government” — whoever that may be at the time — has a right to view it? The fact is, some governments are currently attempting to change their laws to curtail the individual’s right to this sort of privacy, whether you want to believe it or not. For example, the American Wiretap Bill prohibits using emails as evidence without a warrant, but this article shows that the authorities want to read parts of such communcations without a warrant. The new proposal is called the Combating Terrorism Act of 2001, and it considerably extends the surveillance powers of the FBI to such an extent that Senator Orin Hatch said “No reasonable expectation of privacy exists”.

This is an important statement from such a high-profile member of the government of the most powerful country on Earth. Most “civilised” countries (and I use that term semi-ironically in light of the meaning it has developed in U.S. media since Sept. 11 2001) have privacy laws, in which “The Individual”, i.e. me and you and your best friend and the milkman, has a right to privacy, to not disclose any personal or “private” information under normal circumstances. Article 12 of the United Nations Universal Declaration of Human Rights reads as follows:

Article 12.

No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.

Although this is not enforced as law, it is understood that member countries in the UN follow the spirit of the Declaration. Specifically in this case, correspondence whether written or by telephone is protected from “arbitrary interference”. Practically speaking, the contents of sealed envelopes are protected by law in many countries, except in certain circumstances such as imprisonment. Unfortunately, most of the legislature of these countries, and indeed the populace at large, and the media that feed the populace, are ignorant of the technological counterpart to the “sealed envelope” privacy I have outlined above.[1]

Let me explain. When you send an email, it is like a postcard. Much worse — it is more like a postcard that passes through many different postal services, and can be photocopied at any point. In fact, it is usually photocopied at (at least) two points along the route: the Internet Service Providers at each end of the connection. If either end is in a business, i.e. if you send or receive email at work, then chances are there will be yet another copy somewhere in that computer. And most people are not aware of that fact, that their daily correspondence is routinely copied and stored by entities outside their control.

Encryption

Enter encryption. Encryption is a mechanism whereby the sender “scrambles” the contents of a communcation at source, with the intention of maintaining privacy until the intended recipient decrypts or “unscrambles” the message. The equivalent of a sealed envelope, if you will. The sealed envelope can be photocopied by anyone en route, but the only useful information on the copy will be the address of the recipient. Similarly, an encrypted email would look like the following:

—–BEGIN PGP MESSAGE—–

Version: PGP Software

Comment: Any Plain text Message you like

hQEOAz23QZbhSPHnEAP/fNq8vWQg0qi0VN/L5QVS8R+Jwvzx+oHSxHOAHsepUYZl

msVIVgYY4g4Ptd4numv67W2+y/eW4qhTlInOmHloAZtu239FPjad/mwapfC4z/EA

QoyhsuzaQt6NsDpRvMnMSW5zwAMQBAlt/b/e3CTO6GpxOehFzPiesi1ltX8hU10D

rNCadlmjwEB7xi9oqcmFawRQmhkNAZ2SWYcxOk3yGXlkx+NWdewq3r+VM8KHdhA

yuT75f+Dw58+jplyjFWhITCZREDSt/EH56K/6NaUVtKI0sDMARWbt69BQSYMO3At

3IkpDtSFdJREJRKK8fpa+hBa9pdGaG1nmTNJYuR91FAYjdll1Rbzfu72zLYnRnuJ

21ECE0rHN3dmcv21ZMtPn8Q8mWTRHapavgJqJkA0GRQmmZ7niJMxi8YknyJwyvyG

=kn6s

—–END PGP MESSAGE—–

As you see, it’s a lot of garbled nonsense, and could be copied as often as you like, without affecting the privacy of the contained message.

The particular mechanism used in the above example is called PGP, aka Pretty Good Privacy, and was created by Phil Zimmerman. (here’s a faq, if you’re interested). It’s what I use, in the form of GPG.

PGP and its relations use a form of encryption known as public key/private key cryptography. The best analogy I can come up with right now is of a castle with two keys to the King’s chambers; one key to lock the door, another to open it. All the security guys can lock the door, but only the King can open it. The “public” key is freely distributable — anyone with a public key can lock the door, and there is no security risk, but only the King has the private key.

In exactly the same way, I have a public key available on www.keyserver.net for each of my main email addresses (put my email into the search box to get the key), which anyone can use to encrypt, or “lock the door to” an email intended for my eyes only. On receiving an email encrypted with my public key, I can then decrypt it with my private key, and read whatever the contents were, or view any attachments.

Currently, PGP encryption is freely available, but still slightly beyond the user-friendly point at which it can be accepted by the masses. I urge you to try it though, if only to give yourself the assurance that your online communication is as hidden as your post. One way to give it a try is to set up an address with www.lokmail.net, which is a free online mail service similar to Hotmail with the added benefit of public/private key encryption. And if you use Outlook, try GnuPG-Plugin, a freely available add-on to Outlook that allows you to encrypt your mails and manage your keys.

Lose ‘em

Back to Governmental Intervention. The media has been brewing up a storm for some time about technology being used to commit crimes. I have written before about the DMCA, which is one example of a very bad law that was passed due to ignorance – certain tools are banned because they could be used to break the law. Imagine banning hammers and chains because gangs use them to fight each other, or banning cars because people can speed in them, or pantyhose because bankrobbers pull them over their heads. I would like you to keep that analogy in mind while considering the following, because a little fear of the unknown is exactly what is allowing the controlling elements of some governments to pass draconian laws without a public outcry.

This USA Today article was released in June of this year, months before Osama bin Laden reached his current level of notoriety. Even the article’s title, “Terror groups hide behind Web encryption”, reeks of a fear of the unknown, this technological monster that aids terrorists. Should the article read “Terror groups use craft knives”, or “Terror groups use demolition explosives” or “Terror groups wield nail files”? These are other tools used by Osama’s crew, but we hear no outcry over their use. Why? Most likely because these are familiar items, things we know and understand in our daily lives, like hammers and chains and cars and pantyhose.

Now here’s the clincher. Encryption is like the envelope you seal your private correspondence in. Well the story about the FBI’s lightbulb looking at your “specially-seethru envelope” is not complete fiction: This article talks of one US Senator and his idea to introduce a “back-door” into encryption software. Another article about the same issue gives an additional insight. Such a back door would be equivalent to the FBI’s lightbulbs spying on your secret correspondence.

Fortunately, I don’t live in the US, nor do most people reading this (I would imagine). US laws don’t stretch as far as Europe yet. An article in the Irish Times in July 2000 discusses a (then new) European law forbidding the decryption by any individual (including the Gardaí, our national police force). This means encryption will keep my communications private indefinitely. Or does it? Much of the technology used on the internet was developed in the United States, and most internet standards are ratified there. If such a law is passed, the encrypted community would suddenly become polarised into those with a backdoor, and those without. I know which camp I would prefer to be in, but knowing the unilateral/isolationist bent of many US leaders, it is likely that such a law would preclude the ability of my software to interact with an american’s software, which means I would be forced to use the special transparent envelopes to communicate with americans.

And hope that the people in control keep a sensible view on how to define a criminal. And don’t move the goalposts[2]. Remember 1984? (the book, not the year). I’d rather not live in a time where Thoughtcrime was punishable. By removing all privacy from my correspondence, we inch closer to that day by day.

Note: this is an article I published in 2001, on an old news site. Leaving it here for posterity. Many links are broken. I may fix this eventually!
Image courtesy of alancleaver_2000, licenced under a CC-A licence

Another one I couldn’t search up information on, so putting it here for posterity.

I was playing with an elderly blogging platform called Blosxom. It’s really simple to use, although that, combined with its age, means it’s not up to the current status quo. Regardless, I found it fun to play with. Plus, it’s written in Perl, and everything else is PHP these days, so it was a nice novelty.

Now, one of the things it expects (as does the rest of the internet, apparently), is that the CGI file may be treated as an application, folder, or directory on the web. Like this:

http://example.com/blosxom.cgi/2010/06/28#Post

Now, the script itself is the cgi file, a file called blosxom.cgi in the root of my server. As you can see, it looks like a directory in that location, and according to the Internet, that feature should work, passing any “trailing pathname information” (as Apache calls it) to the script via the PATH_INFO environment variable.

Apache didn’t think so.

Now, attempts to google for “apache trailing slashes” or “apache cgi trailing slashes” or anything like that ended up fruitless. It shames me to say I spent over an hour investigating things like ExecCGI, mod-rewrite stuff, and all manner of other things to try to find out why that feature wasn’t working for me.

Eventually, I did what I probably should’ve done an hour before, and looked at the server error logs. Yes, they existed and were visible. I didn’t think that particular host would let me see them — it’s a free host — but I was wrong, and they surprised me yet again.

So, here’s the key: the host had switched off the AcceptPathInfo directive. Ordinarily, that’s left to the handler concerned (CGI, PHP etc.) to decide, which explains the ubiquity of the “on” setting, and the lack of anyone complaining when it’s switched off in various places I looked.

So there you have it, folks. If your CGI scripts don’t work when you have trailing slashes or trailing path info after the script’s name, don’t get lost in RewriteRules – have a look for AcceptPathInfo.