The Internet is a public network of millions of computers, all sharing information. On the Internet, communications move back and forth across public lines and through numerous connections. As with all public lines, eavesdropping is possible.
Fortunately, your browser contains features that safeguard security. There are also several things you personally can do to safeguard your privacy and security while on the Internet. Click one of the links below to learn more.
In addition to the information in this document, you can always find the latest news about security at Netscape's Security Center. For more information about privacy and security, including information about viruses, secure email, safe online shopping and banking, and safe surfing for children, see Understanding Security, a document located at the Security Center.
For the quickest introduction to privacy issues, see the Privacy Tutorial.
There are two ways that a site can obtain information about you:
There are two ways for sites to store information about you:
A web page can't find out your e-mail address, name, or any other personal information unless you explicity provide it. You are in control---nobody can obtain personal information about you unless you allow it.
When you request to view a web page from a site---which you do each time you click a link or type a URL---a small amount of information is given to the site. This information includes your operating environment, your Internet address (not your email address), and the page you're coming from.
Operating Environment
The site is told something about your operating environment, such as your browser type and operating system. This helps the site present the page in the best way for your screen. For example, the site might learn that you use the French version of a mozilla-based browser on a Windows 2000 computer.
Internet Address
Your browser must tell the site your Internet address (also known as the Internet Protocol, or IP address) so the site knows where to send the page you are requesting. The site can't present the page you want to see unless it knows your IP address.
Your IP address can be either temporary or fixed (static).
If you connect to the Internet through a standard modem that's attached to your phone line, then your Internet Service Provider (ISP) assigns you a temporary IP address each time you log on. You use the temporary IP address for the duration of your Internet session. Each ISP has many IP addresses, and they assign the addresses at random to users. A web site can tell which ISP a temporary IP address comes from, but it can't learn anything about you personally from your temporary IP address.
Important: Your IP address is not your email address. Your email address uniquely identifies you in cyberspace just as your social security number identifies you in the real world. A temporary IP address is no more a part of your identity than the phone number of a pay telephone you use to make a call.
If you have DSL, a cable modem, or a fiber-optic connection, you may have a fixed IP address that you use every time you connect.
Whether your IP address is temporary or fixed, you might not want that information to be given to a site you intend to visit. To block your IP address from being given out, see Browsing Anonymously.
Referring Page
The site is also told which page you were reading when you clicked the link to the page you are now requesting. This allows the site to know which site referred you. Or, as you traverse the site, it allows the site to know which of its pages you came from.
A cookie is a small bit of information used by some web sites. When you visit the site that uses cookies, the site might ask your browser to place one or more cookies on your hard disk.
Later, when you return to the site, your browser sends back the cookies that belong to the site.
By default, this activity is invisible to you, and you won't know when a site is setting a cookie or when your browser is sending a web site's cookie back. However, you can set your preferences so that you will be asked before a cookie is set.
There are times when it would be to your advantage to allow a site to know something about your previous visits. For example, if you were previously filling out a long form and got as far as page 17, it would be nice if the site could take you immediately to page 17 on your next visit.
If a site can store a cookie, it can keep track of everything you've done while visiting the site by writing these things into a cookie that it keeps updating. In this way, a site can build a profile on you.
This may be a good thing or a bad thing depending on what the site does with the information. For example, it might be good if a bookseller knew you frequently looked for information on dogs so it could tell you about a new dog book. It might be bad if the bookseller then sold that information to the local dog pound so they could cross-check for potential dog owners who do not have valid dog licenses.
Web sites can use cookie information to tailor their presentations to you, and advertisers can use such information to target online ads to your interests and buying information. Reputable web sites have prvacy policies that describe how they use the information they receive.
When in doubt, always check a web site's privacy policy before permitting a cookie to be set, and before providing any personal information (such as your name and email address).
If your browser stores a site's cookie, it will return the cookie only to that particular site. Your browser will not provide one site with cookies set by another. Since a web site can only receive back its own cookies, it can keep track of your activities while you are at that site but not your activities in general while surfing the Web.
But suppose that while you visit site ABC.com, a cookie gets stored not by ABC.com but by a different site called XYZ.com. ABC.com can cause that to happen very simply by displaying an image from XYZ.com. So when you visit ABC.com your browser makes a side-trip to XYZ.com to get the image, and XYZ.com stores the cookie at that time.
If XYZ.com enlists many sites to display its cookie-storing image, it can build up a cookie that contains information about your behavior at all those sites. The more sites that display XYZ.com's image, the more encompassing a profile it can build on you.
Such cookies that are stored by the site other than the one that you think you are visiting are called foreign cookies. If you are concerned about foreign cookies but not about ordinary cookies, you could give permission for sites to store ordinary cookies only but not foreign ones.
You use Cookie Manager to specify what types of cookies you want your browser to accept.
The best way to keep your information private is to be cautious about providing it to others. The Internet is a public network, and you should assume that when someone asks you for your name, phone number, address, and other information, they may share that information with others.
Providing your name, address, and phone number on the web is like having a listing in the telephone book. In fact, if you are listed in the white pages of the telephone book, your name, address, and phone number are probably listed in online directories and other databases on the World Wide Web. (Try looking yourself up in a directory such as People Finder or Yellow Pages.)
If a web site asks for information about you, always check the site's privacy policy before proceeding. Here are some questions you might ask about a web site's privacy policy:
When you request to see a page from a site, your browser must tell the site your Internet address (IP address) so the site knows where to send the page. Your IP address can be either temporary or fixed (static).
Whether your IP address is temporary or fixed, you might not want that information to be given to a site you intend to visit. But if your browser doesn't provide this information, the site won't know where to deliver the requested page. So this is the one piece of information that you can't ask your browser not to reveal.
If you really want to hide your IP address from the site, you need to use some trusted intermediate site. You go to the intermediate site and tell it the name of the site whose page you want. The intermediate site requests the page on your behalf, using its own IP address as the return address. Then, when it gets the page, it forwards it on to you. The site that supplied the page never gets to see your IP address.
There are several sites that provide such services. Use your favorite search engine to find them---try search words such as "anonymous" and "surfing".
[ Return to beginning of section ]
Personal Security Manager helps you protect the security of your communications over the Internet. Personal Security Manager can check the security settings of web sites you visit and help assure security in several ways.
Personal Security Manager has its own extensive online Help, including general information about maintaining security on the Internet, and definitions of security-related terminology.
To access Personal Security Manager and view its Help, open the Tasks menu, choose Privacy and Security, and then choose Security Manager. Personal Security Manager also appears when you click a lock icon in the browser window.
[ Return to beginning of section ]
A cookie is a small amount of information used by some web sites. A web site that sets cookies will ask your browser to place one or more cookies on your hard disk when you visit the site. Later, when you return to the site, your browser sends back the cookies that belong to the site.
Before loading a web page that uses cookies, your browser handles the page's cookies by doing two things:
In this section: Specifying How Your Browser Should Handle Cookies |
Your browser lets you specify how cookies should be handled, by setting your cookie preferences and by using the Cookie Manager.
If you select "Warn me before accepting a cookie" in the Cookie Preferences (see Step 4 above), Cookie Manager lets you control cookies on a site-by-site basis.
When you are warned that a web site is requesting to set a cookie, you can click Yes to allow or No to deny the cookie. You can also select the option for your browser to "Remember this decision."
If you select "Remember this decision," you will not be warned the next time that site tries to set or modify a cookie, and your "yes" or "no" response will still be in effect.
If you wish to change a remembered response later, use Cookie Manager as follows:
Another way to control cookies site-by-site is to use the Allow and Block menu options.
You can use the Cookie Manager to view detailed information about cookies.
Item | Explanation |
Cookie Name | This is the name assigned to the cookie by its originater. |
Information | This string of characters is the information a web site tracks for you. It might contain a user key or name by which you are identified to the web site, information about your interests, and so forth. |
Host or Domain | This item tells you whether the cookie is a host cookie or a domain cookie. A host cookie is sent back, during subsequent visits, only to the server that set it. A server is a computer on the Internet. A web site resides on one or more servers. A domain cookie is sent back to any site that's in the same domain as the site that set it. A site's domain is the part of its URL that contains the name of an organization, business, or school---such as netscape.com or washington.org. |
Path | This is the file pathway. If a cookie comes from a particular part of a web site, instead of the main page, a path is given. |
Secure Server | This lists whether the cookie was sent over a secure server. If a cookie is secure, it will only be sent over a secure (https) connection. Before sending a secure cookie, your browser checks the connection and will not send if the connection is not secure. |
Expires | This is the date and time at which the cookie is de-activated. The browser regularly removes expired cookies from your computer. |
Important: To remove cookies, follow the steps in this section. Do not try to edit the cookies file on your computer.
To remove one or more cookies from your computer:
You can also choose to prevent the removed cookies from being re-accepted later.
[ Return to beginning of section ]
Many web sites require you to type a user name and password before you can enter the site. For instance, personalized pages and web sites containing your financial information require you to log in.
The user name and password you use at a particular site can be read by the site's administrator. If this concerns you, you may wish to use a different password at every site with which you register. Unfortunately, it is very difficult to remember every single password you've ever used.
Password Manager can help you by storing your user names and passwords on your computer's hard disk, and entering them for you automatically when you visit such sites.
In this section: Using Password Manager to Remember User Names and Passwords Entering User Names and Passwords Automatically |
When you enter your user name and password at a web site a dialog box appears asking, "Do you want Password Manager to remember this logon?" You can choose the following options:
Password Manager saves your user names and passwords on your own computer in a file that's difficult, but not impossible, for an intruder to read. See Encrypting Stored Sensitive Information for information on protecting your stored user names and passwords with encryption technology.
If you use Password Manager to remember your user name and password for a web site, then the next time you visit the site Password Manager will automatically fill in your user name and password on the site's log in screen.
Password Manager is on by default. To turn it off:
To see a list of the user names and passwords you have stored:
[ Return to beginning of section ]
Many web pages contain forms for you to fill out---order forms for online shopping, information databases, and so forth.
Form Manager can save the personal data you need to enter when you fill out a form, by storing such information as name, address, phone, credit card numbers, and so forth. Then, when a web site presents you with a form, Form Manager can fill it out automatically.
In this section: Filling Out Forms Automatically Form Manager's Automatic Notification Feature What Happens If I Provide Personal Information to a Web Site? |
When you fill out an online form, Form Manager normally detects the form and gives you an opportunity to save the personal data you entered into the form. Soon, Form Manager will have enough data to begin filling out forms automatically.
There are two ways to save personal data:
Form Manager stores your personal data on your own computer in a file that's difficult, but not impossible, for an intruder to read. See Encrypting Stored Sensitive Information for information on protecting your information with encryption technology.
To fill out an online form automatically:
Form Manager is set to prompt you to save information whenever it detects that you have filled out an online form. If you don't want to see these prompts, do this:
If you provide personal information such as your name, phone number, email address, and so forth, the web site is free to store that information in its database and use it later. A web site might use this information to improve its service to you or target advertising to your interests. A web site could sell the information it has gathered to other companies.
One way to find out how a web site uses the information it gathers is to check its privacy policy.
Before providing personal information on an online form, you must decide whether or not you trust the company---just as you judge whether or not you trust a catalog company before you provide your credit card number on the company's order form.
[ Return to beginning of section ]
If you use Password Manager or Form Manager to save passwords and personal data, then this sensitive information is stored on your computer in a file that's difficult, but not impossible, for an intruder to read.
If you are not concerned about unauthorized use of your computer, you may not need further security. However, if your computer is in an area where unauthorized people have access to it, it's possible for a determined person to read the file containing your sensitive information.
For a greater degree of security, you may want to protect the file with encryption. Encryption makes it nearly impossible for an unauthorized person to view your stored sensitive information.
In this section: Encrypting Stored Sensitive Information Setting a Personal Security Password Changing Your Personal Security Password |
To choose encryption:
If you choose encryption, you'll need a Personal Security Password. You can set your Personal Security Password by using the Personal Security Manager. With encryption selected, you'll be asked for your Personal Security Password at least once during a Netscape 6 session in which you access any of your stored sensitive information.
If you choose encryption, but don't already have a Personal Security Password, you'll be prompted to create one the first time you try to save or retrieve your sensitive information.
Normally, you are asked for your Personal Security Password once during each Netscape 6 session in which you access any of your stored sensitive information. However, you can log out of your Personal Security Password so that it must be entered again before any sensitive information can be stored or retreived. This is useful if you are going to leave your computer unattended for a period of time.
To log out of your Personal Security Password:
If you forget your Personal Security Password, you may have to reset it. In this case, you will need to clear all the sensitive information stored by Password Manager and Form Manager, because without your original Personal Security Password you will not be permitted to use the information.
To reset your Personal Security password:
To clear all stored passwords and other sensitive information:
After you clear the saved personal information, you must remember all the user names and passwords Password Manager had stored for you, so you can enter them when you visit the web sites that require them.
[ Return to beginning of section ]
10/6/00
Copyright © 1994-2000 Netscape Communications Corporation.