Someday the Internet may become an information superhighway, but right now it is more like a 19th-century railroad that
passes through the badlands of the Old West. As waves of new settlers flock to cyberspace in search for free information
or commercial opportunity, they make easy marks for sharpers who play a keyboard as deftly as Billy the Kid ever drew a
six-gun.
It is difficult even for those who ply it every day to appreciate how much the Internet depends on collegial trust and mutual
forbearance. The 30,000 interconnected computer networks and 2.5 million or more attached computers that make up the
system swap gigabytes of information based on nothing more than a digital handshake with a stranger.
Electronic impersonators can commit slander or solicit criminal acts in someone elseôs name; they can even masquerade as
a trusted colleague to convince someone to reveal sensitive personal or business information.
'Itôs like the Wild West', says Donn B. Parker of SRI: 'No laws, rapid growth and enterprise - itôs shoot first or be killed.'
To understand how the Internet, on which so many base their hopes for education, profit and international competitiveness,
came to this pass, it can be instructive to look at the security record of other parts of the international communications
infrastructure.
The first, biggest error that designers seem to repeat is adoption of the 'security through obscurity' strategy. Time and
again, attempts to keep a system safe by keeping its vulnerabilities secret have failed.
Consider, for example, the running war between AT&T and the phone phreaks. When hostilities began in the 1960s,
phreaks could manipulate with relative ease the long-distance network in order to make unpaid telephone calls by playing
certain tones into the receiver. One phreak, John Draper, was known as 'Captain Crunch' for...