to anyone cares to know about the security of your broker's DAT(direct access trading) platform.
possible problem:
transfer of sensitive data such as brokerage username, password.
why?
all discount brokers(et. ameritrade, etrade) uses SSL on their web based platform. it is as secure to the point that the password and browser cookies are sent through encrypted channel, using public key encryption algorithm(very hard to break).
this does not apply to DAT brokers, because they all write their own software to implement different trading features, including their own account access algorithms.
it is imperative that every DAT brokers adhere to the minimum standard of security used on the web.
targeted audiance:
if you only trade at home and your connection is connect to a home router directly to a cable/dsl modem, T1 box. you are okay.
if you trade in public places such as, work, school. the connection might travel through several routers before going into a fiber optics network. this can be problematic. at various points of this network connection, a hacker can collect data(sniffing data). your user/password information can potentially become compromised.
a typical senario: assuming user/password not encrypted.
a person saw your username on the platform screen, writes it down. by sniffing the network to collect data for hours(not to go into too much detail). he can filter data coming from your computer, and search for your username(he wrote it down), and he can end up with various potential maches of your password.
check for problem: might be too advanced for many people
check if your DAT platform encrypts at least the password information.
1. download ethereal (google it, its open source). its a packet sniffer that you can use to to check if your sensitive data can be compromised.
2. shutdown all other programs that might be using the internet connection.
3. open your DAT platform, type in your user login info.
4. start ethereal, start sniffing packets. and immediately log into your DAT platform. perform a few common tasks, such as, viewing account data.
5. stop sniffing. ethereal will display all the packets been collected. it has a search function that allow you to search for your username or password in the data collected. and look for signs of your password is being displayed in plan text.
6. now you know. if you can see your password, tell your broker to do something about it IMMEDIATELY!
possible problem:
transfer of sensitive data such as brokerage username, password.
why?
all discount brokers(et. ameritrade, etrade) uses SSL on their web based platform. it is as secure to the point that the password and browser cookies are sent through encrypted channel, using public key encryption algorithm(very hard to break).
this does not apply to DAT brokers, because they all write their own software to implement different trading features, including their own account access algorithms.
it is imperative that every DAT brokers adhere to the minimum standard of security used on the web.
targeted audiance:
if you only trade at home and your connection is connect to a home router directly to a cable/dsl modem, T1 box. you are okay.
if you trade in public places such as, work, school. the connection might travel through several routers before going into a fiber optics network. this can be problematic. at various points of this network connection, a hacker can collect data(sniffing data). your user/password information can potentially become compromised.
a typical senario: assuming user/password not encrypted.
a person saw your username on the platform screen, writes it down. by sniffing the network to collect data for hours(not to go into too much detail). he can filter data coming from your computer, and search for your username(he wrote it down), and he can end up with various potential maches of your password.
check for problem: might be too advanced for many people
check if your DAT platform encrypts at least the password information.
1. download ethereal (google it, its open source). its a packet sniffer that you can use to to check if your sensitive data can be compromised.
2. shutdown all other programs that might be using the internet connection.
3. open your DAT platform, type in your user login info.
4. start ethereal, start sniffing packets. and immediately log into your DAT platform. perform a few common tasks, such as, viewing account data.
5. stop sniffing. ethereal will display all the packets been collected. it has a search function that allow you to search for your username or password in the data collected. and look for signs of your password is being displayed in plan text.
6. now you know. if you can see your password, tell your broker to do something about it IMMEDIATELY!
