The Internet is inherently collaborative in nature. Every time your computer needs to talk to another computer somewhere in the world, it breaks up the message into smaller manageable chunks called packets and hands off the packets to your router or modem. Your device then forwards the message to another router somewhere in your ISP (Internet Service Provider like PTCL or WiTribe), which in turn forwards it somewhere else. Eventually through this chain of interconnected computers and network devices, your message finally arrives at its destination at which point the entire process is played out in reverse as the response to your message finds its way back to you.
The Internet was designed to be inherently trusting and its phenomenal rate of proliferation has prevented a robust solution to address this problem. What we have instead are a multitude of ugly solutions bolted on to the existing infrastructure in an attempt to bring some semblance of trust to the information we consume through our computers.
For example when we exchange emails or browse through websites, we are at the mercy of every single computer between the recipient and us. Some of these computers are owned by your ISP, some are owned by large multinational telecommunication companies and some may be operated by governments. Unless steps are explicitly taken to prevent it, the opportunity for any of these entities to read and/or manipulate our messages in transit exists. To combat the risks associated with communicating sensitive information over untrusted networks, protocols were developed to allow us to encrypt our traffic in such a way that it is both private and trustworthy.
But how exactly does that work? Think of encrypting things in computers as putting a letter in a box, and then locking that box with a key. Let’s take an example:
Ahmed and Bilal are both confined to their respective homes and want to communicate with each other without the risk of their messages being read or manipulated by anyone else. Ahmed writes out his message on paper, puts it in a box, locks the box with his key and hands it over to his chowkidaar (gatekeeper) to have it delivered it to Bilal’s house. If Bilal has a copy of the key, he can unlock the box read the letter, and place his reply back in the box. The problem is, how does Ahmed get the key to Bilal if he can’t trust his chowkidaar (or anyone else he may delegate the task to) to get the key to Bilal safely. What if someone makes a copy of the key, and distributes it to whoever they want? The privacy of Ahmed’s and Bilal’s letters would then be compromised. In cryptography this would be a key sharing problem, and to solve it, computer scientists and cryptographers at MIT (Massachusetts Institute of Technology) invented in 1977 what in our analogy would be a magical key.
This key is magical because when it’s forged, it can be broken into two pieces which are themselves keys too. Each of these two keys is capable of locking and unlocking a box, but the real magical part is this: when you lock the box with one half of the original key, only the other half can unlock it. This means that if I have one half with which I lock a box, even I myself can’t unlock it. So this magical key lets Ahmed and Bilal do some pretty nifty things.
Bilal forges a magical key, keeps one half for himself and makes lots of copies of the other half. He then distributes the multiple copies to the entire mohalla (neighbourhood), including the trustworthy Uncle Tipu. Ahmed then manages to come across these keys, and one day tracks down busy Uncle Tipu to confirm that the key he found does well and truly belong to Bilal. What he has in his hand is known as Bilal’s public key, and trustworthy Uncle Tipu is acting as a certification authority. What Ahmed can now do is write a letter to Bilal, and provided he locks the box with Bilal’s public key he can be absolutely sure no one else can read his message because the box can only be opened with the other half of Bilal’s key which we’ll call the private key (a private key with its corresponding public key is called a key pair). Provided Bilal keeps his private key safe, no one will be able to read his messages.
This is the essence of public key cryptography systems such as SSL (aka HTTPS) which you’ve probably noticed in your favourite browser’s location bar glowing green or with a padlock. Your browser has a list of trusted certification authorities built into it which are used to verify the public keys of the secure websites you go to (such as Google, YouTube, or Facebook). If your browser receives a public key that’s not validated by a trusted certificate authority, it will show a big red warning saying that someone somewhere may have tampered with the information that’s about to be shown.
What this means is that if you’re loading a website, say, YouTube, using SSL (by using the HTTPS prefix in the address instead of HTTP), and your browser uses YouTube’s public key to encrypt your request (the request would contain information such as which video you want to view), then by the nature of public key cryptography described above, only YouTube’s private key can decrypt that message. No one else can see which video was requested.
There are a few ways ISPs can attempt to eavesdrop on an SSL secured request, one of which involves an untrusted computer masquerading as YouTube and sending its own public key instead of YouTube’s legitimate key. This fake key will fail the certificate authority check and cause the browser to show a warning. If the users disregard this warning, they trust the imposter computer with all their secure data including passwords, credit card information and private correspondence opening a multitude of avenues for misuse.
What this shows is that it’s technically very hard to prevent access to information on the Internet. For every technique used to control access to a resource, there are a plethora of ways to bypass that technique, resulting in a cat-and-mouse game between censors and consumers which, taken to its logical extreme/conclusion, results in something that goes against the core purpose of the Internet: a system to allow open access to information on a global scale.
The writer is an iPhone Game Developer based in Lahore.
[…] Originally Published At Bolo Bhi […]