Practical Computer Security for Transgender Forum Readers
by Jamie Faye Fenton
Many Transgender Forum readers worry about security when accessing our
service. When done right, this is a good thing: secrets are kept, the
computer operates smoothly, bad things don't happen to ourselves and
our loved ones. When done wrong, worry can become paranoia, and despite
our intentions, our secrets leak.
So what are the sensible security precautions and policies and how does
one make them work?
Security is not something you buy, rather it is an attitude, a form of
awareness that you attain and practice.
A place to begin is with a "risk analysis". You draw up a list of
things that could go wrong and the agents that could cause them. This
list includes unforeseen natural events such as disasters and power
failures, as well as man-made problems such as user errors, sneaky
hackers, and snoopy fellow employees and family members.
Beside each item, estimate how likely the event is to happen and what
the extent of the potential damage would be. Then go down the list and identify
precautions you can
take to minimize or mitigate
the dangers involved. In some cases further research may be required.
Some precautions are easy, others are not worth the time and trouble involved.
While the remainder of the article will focus on protecting the secret
of one's transgender nature when using the computer, I cannot emphasize
enough the importance of basic precautions against data loss, power
failure, virus infection, and the like, that are essential for any
computer user.
To protect one's transgender secret, list the
people who "you don't want to find out" and the potential for damage.
This could include family members, co-workers, employers, and the
general public. For example, your wife may know and accept, but the
other guys in your military unit would not. In such a circumstance, one
should only visit Transgender Forum from home and take precautions
about revealing any information to other subscribers that could link
your identities. A TV who has not told his spouse but who works for a
free-wheeling Silicon Valley startup company may choose to do the
opposite.
Here is a incomplete list of possible risk situations and how one could
deal with them. Each threat is assigned a danger level based on how
likely it is to present a problem to a typical closeted TV. It is up to
you to determine the applicability of each scenario to your
circumstances.
Someone sees me visiting Transgender Forum [high]
- Arrange to visit from a safe place. Close doors, ascertain the
whereabouts of anyone likely to intrude. Use a computer isolated from
those you do not wish to find out. Visit during safe times.
- Have a window you can bring in front of the TG Forum window in a
hurry.
- Memorize and practice using the command key sequence for quickly
closing a window.
- Turn graphics off so it is harder to see what you are reading from a
distance. A smaller font could buy you another second before an
intruder can read your screen.
- Be ready for an ambush with a fast explanation like: "Look what I
found! An entire web site about transvestites! The Internet sure has a
lot of weird stuff on it!".
Other people using my computer discover traces of my
visit to Transgender Forum [high]
- Do not leave bookmarks mentioning or referring to Transgender Forum.
Instead use a search engine or memorize our URL and type it in each
time.
- Close the browser window and clear the disk cache after you are done
visiting. Also clear the browser's memory of "recently visited places"
so that links to TG forum are not highlighted in a special color.
- Remove e-mail messages and transgender-oriented disk files after
viewing them. If you need to save them, use an encryption program and
change the file names to be innocuous.
- Some programs, like Microsoft Word, keep a shortcut list of recently visited
files, viewable in the File menu. Opening several other files, one after another, can
push a suspicious one off the bottom of the list. (Some programs have an option for clearing this directly).
- When printing, make sure all pages have emerged before leaving. Sometimes the
printer will run out of paper with a page or two left to go. Later someone else puts
more paper in and gets a surprise.
- For highest e-mail security, get a "shell account" in your femme name
on another server and log in remotely to send and receive e-mail. Then
no messages are stored locally for others to find.
- Use the password facility on your personal computer to protect your
browser program bookmarks, e-mail in box, and so on. Don't
automatically memorize the password, rather type it in each time. Make
sure the password feature itself is not extremely easy to defeat (like
many screen-saver programs are).
- Some sites store profiles of you and your preferences on your hard disk which
they can retrieve later if you visit them again. These are called cookies. While
transgender-oriented servers would take care not to leave such traces, mainstream
sites may not. The latest versions of Netscape and Internet Explorer have options
to control cookie storage. A program called Internet Fast Forward, published by
PrivNet, can block advertisements and cookies.
Eavesdroppers at my company or on the Internet detect
me reading Transgender Forum. [medium]
(Note: The eavesdropping threat is greater at your company than on the
Internet at large.)
- Use our SSL encryption feature. This will obscure the content of our
pages. Do this by using the URL: https://www.3dcom.com/tgfs/. (It is
still possible for your opponent to determine that you have connected
to a place called www.3dcom.com - it just won't be obvious what that
means).
- Use a modem and connect to an Internet Service Provider (ISP) directly rather than using a local
area net. (This frustrates someone with an eavesdropping program or packet sniffer, located elsewhere in
your building from spying on you).
- Find out if your company uses a corporate firewall and if they log
accesses to outside web servers. If they do and the company is strict
about Internet use, you would be wise to stay away from us at work.
- ISP operators are unlikely to monitor their customers browsing
habits. Getting caught doing so would be regarded as a serious
violation of "netiquette" and the offending ISP organization would be
immediately shunned and would have to shut down.
- Most browser software that you download from the Internet use a weak
form of encryption that can be broken by a determined college student. Software
purchased in a shrink-wrapped box uses a stronger cypher. This disparity is due
to US export regulations. (Recently Netscape and Microsoft have permitted downloading
of browser software enabled for strong encryption. You are required to prove that you
are downloading from the U.S. and are a U.S. citizen or legal resident.)
- The Government can monitor whoever they wish and can break codes easily.
Since cross-dressing is not a crime, they don't care.
Somebody else reads my e-mail messages. [high]
- Many companies log and monitor their employee's e-mail traffic. This
invasion of privacy is allowed under US law. Transgender Forum will
never send e-mail to you unless you specifically ask us to, moreover
our messages are designed to appear innocuous. Other correspondents may
lack discretion. Find out what your company's policies are, and if needed, get an
independent e-mail account. These can be had for as little as $5/month.
For a lengthy list of email service providers, visit Yahoo's Email Providers Page.
- Remove e-mail messages from the server after reading them. Some
e-mail programs default to keeping your old mail around forever if you
don't change an options setting. (Note that deleting your messages
probably won't protect you from your company's e-mail monitoring
policies).
Other Transgender Forum subscribers "Out" me, on
purpose or by accident. [medium]
- Do not use you actual e-mail address in BBS posts, personal ads, or
in correspondence. Rather, use an anonymous remailer service such as
http://www.edtec.com/anon.html or http://www.nymserver.com/
. Remailer services tend to come and go
on the Internet as they can be abused. (Note that U.S. law allows the National Security Agency to
monitor all overseas communications, so bear this in mind if you use a remailer located outside of the U.S.)
- While we do not presently recommend AOL due to extremely poor web
access, they do provide the ability for subscribers to assign
themselves up to 5 alias e-mail names.
- Take care not to out someone else! Never assume that another
subscriber is the only person who reads the messages sent to a given
e-mail address. Also don't assume that once a person comes out, that
they are still out - often people have to go back "in" for one reason
or another.
- Please do not link to www.3dcom.com from your home pages. Instead
use www.tgforum.com, www.cdspub.com, or
www.transgender.org. We want to
keep www.3dcom.com disassociated.
- Work to further the acceptance of transgender people by society and
to secure our political rights. If you want shade, plant trees.
Someone in the TG Forum chat area offends me. [medium]
- Ignore them if you can. If they seem honestly clueless, you might
tell them "this is not a sex chat place" so they know they did
something wrong.
- If the person makes threats or is otherwise abusive, report them to
jamie@tgforum.com or cindy@tgforum.com.
Remember to include date, time, the
names involved, and a description of the conduct involved.
- Be very careful with the Private Message feature. If someone sends
you a private message, the reply you type is not made private
automatically - rather you must click the arrow by their name each time
to maintain a private conversation.
- People can choose any name they like on chat. It is possible that
someone you are conversing with is an impostor. If you suspect such
shenanigans, please let us know.
My wife notices a check or a credit card charge used
to pay for my TG Forum subscription. [medium]
- The credit card charge will say "3D Communications" and won't mention
transgender in any way. Think of a cover story - perhaps "a book of 3D
pictures", if you think you may need it. (There are many books of 3D
pictures at your bookstore if you need one fast!)
- Use a money order instead of a check. Save the receipt at least until
the subscription turns on.
Someone steals my user name and password and goes on a
rampage. [low]
- The only risks here are that they could steal service from us, and
possibly pretend to be you or someone else, damaging your reputation.
They can not spend your money.
- Keep your password to yourself.
- Please do not use the same user name and password for our service
that you also use somewhere else to protect valuable secrets. If
managing all your passwords is a problem, consider having one that you
use for "low security" applications like subscriber identification, and
others for "high security" applications like computer accounts, bank
accounts, etc.
- If you need to change your user name and password, let us know. Eventually
we will make it possible for you to do this directly through a web page form.
An evil hacker breaks into the Transgender Forum server
machine, determines my identity, and attempts blackmail. [low]
- We endeavor to operate the TG Forum server according to recommended
security practices to make compromise difficult. TG Forum runs on a
dedicated computer in a secure location.
- We try to be a "low value target", by storing as little sensitive
information as possible on our server.
- Blackmail is an extremely risky crime to perpetrate on gender
community members, because many of us are "out" and would gladly
cooperate with law enforcement officials.
A malevolent system administrator captures a record of my
identity while I visit their transgender-oriented server and "Outs" me. [low]
- Most web sites do log accesses to their server by IP number, a
process similar to Caller ID on the phone system. These numbers can be
traced back to the Internet Service Provider who issued them, and in
some cases, to individual computers. Many browser programs will give
out additional information about you if asked by the server. One way to
avoid giving out a number that others can trace is to use an ISP that
issues IP numbers dynamically - in effect you are given a different
number each time you log in.
- People in the gender community are generally very security aware so TG-oriented sites
are safe.
- If browsing anonymity is very important to you, Community Connexion
operates a free service that shields your IP number and personal
information. Visit: http://www.anonymizer.com/ for more information.
Someone steals my credit card number on the
Internet. [very low]
- Use our SSL feature to encrypt it when you subscribe!
- This is an example of an overblown threat - a product of media hype.
Remember the difference between being
security minded and being paranoid has to do with realistically
assessing the threats you face and taking the reasonable precautions
necessary. You are still far more likely to get caught if your wife
returns home unexpectedly or someone discovers your hidden cache of
lingerie than by having your secret leak through your computer.
If you have any comments or suggestions regarding additional items for this article, please send them to Jamie at
jamie@tgforum.com.
Back to our home page