New CipherSend Online Security Service Thwarts Email Address Theft And Soothes Password Fatigue

In 1997, I decided after 15 years as a practicing CPA that it was time to put down my pencil and explore a new venture on the exciting new internet which, while perhaps not exactly in its infancy at that point, was still at least a pimply faced teenaged medium still unexplored by most accountants.

I founded CPAsites.com and made a life for myself and a few other employees by designing and managing websites for CPA firms across the country. We had no competition in the early, heady days of the late 90's and were able to quickly secure a name for ourselves by offering quality sites to quality firms.

Since 1997 however, the internet has grown from a pimply faced teenaged medium to a...well, goliath-sized pimply faced teenaged medium. I can recall getting my first spam messages in the early days of email and like everyone else, I thought they were "kinda' neat" in the way that my teenage daughters think college mail is "kinda' neat."

As a website developer in 2005 however, spam has become the bane of my existence. Invariably, once a week, we get a call or email from a CPA exasperated by the volume of spam email he or she is receiving and, also invariably, we - or the website we host for the accountant - gets the blame. "Please remove all of our email addresses off the site!" they proclaim with finality.

So much for the golden age of instant internet communication at your fingertips. Dutifully, we would comply with their requests and it wasn't until I endeavored to solve another common CPA complaint that I stumbled on the perfect solution for email theft.

For several years, the second most common complaint coming from my CPA clients was concerning an easy way to have clients email them securely from their website. After we explain to them the intricacies of password management and secure logins, they immediately dropped their security plans. They, like everyone else on the internet, suffer from "password fatigue" and weren't about to subject their clients to learning and remembering yet another password just to send their CPA some tax information.

About a year ago, we finally decided there SHOULD be an easy way to just click on a website or email link and download a person's encryption key so that you can email encrypted documents to the individual. We searched. There wasn't. Seeing a critical need not only for our CPA clients, but also for attorneys, physicians and other financial professionals, we called an encryption programmer, gave him our idea and said "do it."

The result is CipherSend.com which began selling in March of 2005 for $19.95. As the encryption programmers promised, it works perfectly for what we needed (click the button, encrypt anything and send it with no password), but imagine our surprise when we realized it also solved an even bigger problem - spambots stealing our clients' email addresses!

When our clients replace their email addresses with CipherSend buttons, spambot crawlers are stopped in their tracks. The button-owner's email address is stored on our secure server, not on his or her public website. Needless to say, both we and our clients were rather delighted that a "side effect" of the program was even better than the intended cure!

The service is ideally suited for professionals and physicians who can now quickly and easily receive secure documents from clients, associates and patients at their standard email address without the inconvenience of giving out passwords or secure logins, but it is also finding a huge market among millions of aggravated spam victims needing to replace an email address posted on a public website or included in the coding of a contact form.

CipherSend offers advantages over standard website email or contact forms with its spam-block security and double notification to site visitors when their email has been delivered and again when it is opened by the recipient. Despite the low price, CipherSend uses sophisticated 2048-bit RSA asymmetrical (two-key) encryption algorithms with maximum key length and meets government security regulations required in the healthcare industry for the transfer of patient medical information.

Since messages and documents are encrypted right on the sender's computer with a downloaded public key and decrypted by the recipient's private key, CipherSend represents true end-to-end security. A demo of the button can be found on the CipherSend.com website and the program has a 30 day free trial membership.

Generally, "the law of unintended consequences" is a nightmare scenario for people introducing a new product or service on the market, but for this fortunate CPA, "two birds with one stone" just took on new meaning and made my life a whole lot less stressful!

Fishing for Fortunes. Scam!

Spelt phishing, but pronounced as above, this despicable act is an effort to batter your bankroll or commandeer your cash.

To put it simply, you can get emails from account administrators, which strongly urge you to update details attached to that account. The issue, though, is the pretence of such mail.

You may not even have such an account as referenced.

It doesn’t come from the account provider.

It can use false S.S.L. references, to present an illusion of trust and security.

It can prompt for immediate action on your part, alleging false log-in’s by persons unknown, and from countries unknown. If action is not taken, they can impress on you, that the account will be suspended or closed. Indeed, anything likely to work can be fabricated, to get you to the webpage suggested in the link or hyperlink. Note the word “suggested”. Likenesses to company logos are used to re-enforce “credibility”.

In fact, these phishing attempts actually look pretty good or realistic. So much so that any qualms of guilt or stupidity, experienced by a “conned party” are groundless.

Experience, specific education or forewarning, is all that prevents this type of charade from widening its base of “victims”.

The goal is to get you to type in your details, complete with credit card number and the rest can be guessed.

Some damage is also absorbed by the organisation or company being misrepresented and they can do little about it but warn their customers what to watch out for, and issue security instructions. Indeed, it is from accounts at reputable companies that most passing trade learn the correct or most secure procedures. It is therefore important to read any material that they offer.

Generally though, reputable companies with a mind to preserve their integrity will tell you to log-in at their main page and proceed from there. Not through a link specific to your account!

Hyperlinks can mask the true domain that you’ll be brought to, with the text linked to www.anydomaindotcom (example, only), a replica or fake page. Only going to secure pages where one believes that “https” will do it, will always help but wholly unreliable. The “s” is an indication of a secure page, but are you at the right domain?

Place your mouse over the link and the domain attached to such a link, should show itself. Viewing the source code is another way but some knowledge of it is necessary.

Another ploy, sometimes deliberate and sometimes “convenient”, is inserting a reference to the “legitimate company” anywhere after the domain name. Ex. https://www.anydomaindotcom/ebay/aagle/. Unwary victims may overlook the fact that “ebay” is not the domain, but see it anyway as a directory or file name. Anyone, anywhere can have a file or directory named like that of a company.

To make matters somewhat worse from an “easy to identify” viewpoint, the source code of the link can be represented as an I.P. address rather than its named counterpart. There are some tools that you can use at http://centralops.net/co/ which you can use to type in the I.P. address and cross reference it with the official account domain presented in the e-mail, or web page for that matter. Opening a second window for investigative purposes and re-sizing both to be side by side can be revealing, and comparisons be made between the alleged source and that of the source code.

www.ebay.com can be put in one window and www.suspiciouslyspurious.com can be put in the other. NOTE; you should be checking domains and ignoring everything that comes after the forward slash at the end of the domain. A similar test can be done for email viruses, where suspicious email addresses can be searched for some degree of authenticity.

If you are phished, try to learn as much as possible about it as phishing attempts and email viruses have some aspects in common. Incorrect spelling is one of them. You must understand that the authors can be from anywhere and not necessarily have degrees in English. Legitimate companies can also be from anywhere, with different primary languages, but do perfect their spellings and general grammar.

Attention to upper and lower case can be another giveaway. This is especially true where particular portions of the text are the design of the author, and not just copied and pasted. Typically, these portions are customised to be customer specific in a general sense, and fonts may even be different or out of place. Such “special” additions are to strengthen the sense of urgency and call to action.

Should you be the recipient of “phishy mail”, you can forward it to spam@uce.gov

Avoid Internet Theft, Fraud and Phishing

Since its birth, the Internet has grown and expanded to unprecedented, unmanageable proportions. Information, software, news, and much more flow freely through its twisted pathways. Online services such as Internet banking save time and money. However, from the depths of its vast expanse have come the dregs of society intent on preying on the new, the naïve, and the less informed.

Phishing is one of the main scams in the present moment. People set up phoney websites and email addresses. Then they spam Email inboxes with official-looking messages explaining that your account with Company X has encountered a problem and that they need you to login and confirm some details. The email addresses are masked to appear official and the links provided in the email all seem to check out. If you click on the link provided then you will usually be taken to a site that looks for all intents and purposes to be official. When you click 'submit' your details will be sent to a criminal somewhere who will do as they please with your information, such as withdrawing money from a bank account or purchasing things in your name.

The scam has been labelled 'Phishing' because the criminals engaging in the activity behave similarly to a fisherman throwing bait out in the hope that they'll receive just one bite from the millions of people that receive the email.

So how do you avoid these online scams? First and foremost, it is important to realise that no legitimate organisation should be sending you a request to fill out your personal details because of some server error or for any other reason. Your bank will never send you an email with content along the lines of "We've lost your bank account number and password... please supply them again for our records". You should also know that no bank is going to require your social security number, bank account number, and PIN number just to log in to your account or retrieve your password. Other sites such as Ebay, PayPal, and the like will not email you asking for these details either.

If you're a little unsure as to whether or not an email is official, scroll down a bit until you find the link that they are requesting you to click and simply hold your mouse pointer over the link text without clicking. Now take a look at the bottom left-hand corner of your browser window. The link text is often the address that the phisher wants you to think you will be heading to but the real address will be revealed in the bottom of the browser. This address will most likely not have anything whatsoever to do with the company that the email is attempting to imitate. It could be a dodgy web site or even just a page on someone's personal computer. If the address doesn't appear in the bottom left-hand corner then you can right-click on the link, select 'properties' from the pop-up menu and then read the address listed in the information box.

To avoid further scams make sure that you have updated firewall and anti-virus software active on your system at all times. This will make it harder for anyone to install key loggers, Trojans, spyware, or other similar devices intended to retrieve your information. Keep your operating system up to date with the latest security patches and updates and be careful where you enter your details. Always look into the reputability of the site that is requesting your details and keep an eye on the lower right-hand corner of your browser. If the page you are viewing has a little padlock symbol appear in the corner, then it means that your details are being secured by some encryption method. You can double click on the icon to get more details if you wish. Sites without the padlock icon don't have encryption, which means that your details are a lot easier for malicious crooks to get a hold of.

Even if you're sure the website is legitimate, it's not a good idea to send your details over an unsecured connection. By the way, email does not count as a secure connection, and neither does any instant messaging program, (such as MSN, ICQ, Yahoo Messenger, AIM etc.) so don't give out personal details that way either.

Another common scam very similar to phishing involves the emailing of promises of great wealth. Seriously, what do you think your chances are of winning the lottery, let alone one that you never even entered? Or of some obscure yet ridiculously rich person in Africa dying and you being legally allowed to pick up their money? Or of a foreign prince wishing to smuggle money out of his country using your account? These emails are all scams. I wish it were true that I won three different lotteries every single day, but if you get in contact with the people sending these messages they're going to do their utmost to clean out your pockets. Unfortunate as it may sound, the 'Please Donate to Charity' emails sent are usually also scams.

If you really want to donate money to a charity, look them up and send it the usual way, don't respond to a multi-recipient email that may or may not be real. You also shouldn't donate to some random charity that no one has ever heard of before. Some of the Internet lowlifes have started up fake charities, 'dedicated to helping Tsunami victims' or similar and are simply pocketing the donations.

Everything in this world can be used for either good or evil purposes and the Internet is no exception. Staying alert and having just a little bit of Internet know-how can keep you out of harm's way for the majority of the time, and allow you access to the wonderful online services available with relative safety.