The evils of the modern information age.
Chat programs, e-mail programs, and most non-SSL web pages transfer information back and forth in a clear text format. This means that it's non-encrypted and readable by anyone with access to the text.
Even though the network your computer is connected to seems like a physical straight connection to the router or switch, or maybe the because you've connected your wireless network adapter to a wireless router or modem, the communications to those devices are not two-way in terms of network traffic. Basically everything on a network goes to everything else, and just like a radio broadcast tower sends out a signal in all directions, so does a wireless network card. The difference is the two items communicating both broadcast to each other with information stating the intended destination. Anything on the network has the potential to log all traffic passively and undetected.
People spend countless hours writing applications that scrape and datamine sites that contain logs of interactions and transcripts of chats looking for information in specific formats. Once a match has been found that information is stored. Also people will sit in public places like coffee shops, airports, and private neighborhoods collecting any information they can from over the airwaves or off of networks. Then later they datamine the collected information for patterns such as username/password combinations, social security numbers, credit card numbers, and even something as simple as email addresses.
Does it matter?
This day and age most sites will request that your password be at least 8 characters long and contain random characters. This is the same reason your airplane seat cushions float; to quote Fight Club "the illusion of safety." There are machines that can crack passwords extremely fast. And Social Security numbers are not unique based on the number of people in the country & the number of digits possible in the Social Security Number. Credit card numbers are equally guessable/calculable.
While it doesn't take a lot of work to write a program to guess any of these numbers it does require several attempts to be able to use a number paired with other information effectively without sending up a red flag. Meaning even though someone guesses your password hash they still need to find out your username. Also they need to provide your name and some sort of identification, plus your social security number before they buy that new car you didn't know you were going to pay for.
This is where the statements "don't share your information with anyone" come into play. Just as most companies are slightly worried about being sued for breach of information, they are extremely afraid of negative PR associated with someone stealing identities on their systems because a chat log, e-mail log, web log, or a router log has been compromised. This is evident by the large numbers of attorneys on the payroll at Fortune 500 companies. They also cover themselves with the Terms of Service.
What should responsible companies do about it?
- Store partial credit card numbers in a database or make people provide their CC#s every time.
- Delete live logs from the server or router after a short amount of time (after they've been backed up if neccessary)
- Encrypt backups and logs
- Immediately strip anything that looks like personal data from a public listing where it looks like someone is sharing personal information.
How could they go about warning the user?
Other than placing the warning buried in the terms and conditions of the site they should indicate specifically how the information is being used. Here are a few examples.
- Warning: Everything on this website is public and searchable in a search engine.
- Providing your personal identification to someone allows them to steal your identity.
- This website does not screen criminal histories of its users. Be careful when meeting face-to-face.
- Due to the nature of the internet, online gameplay may not be suitable for children under 18.