Eaves-dropping

Communications over the Internet should normally be assumed not to be private. You should treat your e-mails as postcards that anyone can read as they pass through (although, as with postcards, the chances are that no-one is looking).

There are times when you want your communications to be private, such as when you are giving your credit card details to a web site to make a purchase. In that case, the web site will usually connect to your browser in a way that encrypts (scrambles) the data as they are sent. This will usually be indicated by a little closed padlock at the bottom of your browser window.

It is also possible to encrypt your e-mails before you send them out, using a plug-in component to your e-mail program. The person you are sending them to will need the same program to read them. One such program, PGP, is available as a free download. You can tell everyone a key that allows them to encrypt their mail so that only you can read it. Not many people send e-mail secret enough to make this worth the effort.

Like a lock, the security of the encryption depends on the number of different encryption keys that can be used. Fast computers can try a lot of different keys very quickly. Rather than talk about the number of keys, computer encryption usually talks about the length of the keys (in bits). Adding one more bit doubles the number of keys. Standard Internet security is based on 128-bit keys.

Some companies set up connections to the Internet in such a way that authorised people can establish an encrypted connection and no-one else can, usually for the benefit of people working from home who can be given access to sensitive data. These are known as Virtual Private Network (VPN) connections.

Unauthorised access

This is more of a problem for service providers than it is for users. We use passwords and other mechanisms to control access. We ask you to help by keeping your passwords secure, and letting us know if you have any reason to believe that they might be misused.

You should try to make your password hard to guess. Using your name, or the names of your significant other, children, dog, house, or road, as a password is not a good idea. Any ordinary word is vulnerable to the dictionary-based attacks used by some hackers. On the other hand, you do have to remember your password: it is even worse to write it down and put it next to your computer. There are a number of ways to make a password that you can remember but would be hard for someone else to discover, by starting with words and transforming them to make passwords.

• Think of a phrase and take the first letters of each word to make your password. Hence "a stitch in time saves nine" becomes "asitsn".
• Rather than start with a phrase, start with two words and interleave them, put one inside the other or join them (perhaps with punctuation between). John Smith could use "SJmoihtnh" or "JoSmithhn" (although "John+Smith" would not be a wonderful choice).
• Swap alphabetic characters for punctuation characters or numbers, in a memorable way. For instance, "asitsn" could become "@s1tsn" because "a" looks like "@" and "i" is a Roman "1" (but you should make up your own rules).
• If passwords are case-sensitive, use upper case as well as lower case letters, in unexpected places. ""asitsn" could become "asITsn".

Don't use the same password for everything, but don't use so many that you can't remember them. Use different passwords for unimportant things such as order tracking on websites (but be careful if they have your credit card number) and important things such as bank accounts.

Once you have chosen your password, don't tell anyone else. We will never need to ask you for your password to administer your services once they are set up. However, we do need to ask for a password to set up an e-mail mailbox because we do not currently have a way of allowing users to set their own. We shall offer this capability if and when we can do so safely. We will not retain records of the passwords you have chosen once the mailboxes are set up.

Denial of service attacks

It is possible to slow down individual web sites or ISPs, or even large sections of the Internet, by generating very large amounts of traffic that keep the server busy with trivial requests. This has been done to attack companies that have made themselves unpopular, or to extort money from commercial sites. It can also happen when a new virus starts spreading across the Internet.

You are unlikely to be a direct victim of such an attack. However, they often depend on the attacker having access to a large number of worm-infected PCs that can be instructed to send the necessary messages. This will slow down your PC and our network as well as the rest of the Internet. Again, using a virus scanner and a firewall is a sensible precaution.