FAQs
MyInstantID.com
Home
Advance
Custom
Tutorial
FAQs
Security
Contact
Sign In
Frequently Asked Questions:
What is a jPocket?
What does "j" stands for?
What is an encryption/decryption algorithm?
How big can the document and protected data segment be?
Why I cannot re-edit or remove jPocket record from my document?
What if lose my password?
May I use different passwords for different jPockets in the same document?
Why do I need your Advanced service if it is free and an open source solution?
Why is https used in Advanced service if no un-encrypted data is going outside the browser?
What are Open Source benefits?
What are the risks when using this solution?
What if my healthy dose of paranoia is still not satisfied?
Should I have an Electronic Digital Signature?
-
What is a jPocket?
jPocket is unique part of your web document. The jPocket holds data segments of your document, which you want to protect. Besides holding your data, the jPocket upon initiation utilizes the encryption/decryption algorithm on the data it holds, so the data can be safely hidden or examined within the document. For this action the password is required and provide control criteria. Multiple jPockets can coexist in a single web document.
- What does "j" stands for?
"j" stands for JavaScript since the JavaScript language and concept is the underlying principle for this service.
-
What is an encryption/decryption algorithm?
AES/Rijndael with 256bit key.
- How big can the document and protected data segment be?
Data records with length of 4 – 5 kbytes that correspond to text document of three to four pages of word document and can take several minutes to process with older/slower (prior to year 2000) PC. Rather use smaller sizes of data in multiple jPockets since it is processed one at a time.
- Why I cannot re-edit or remove jPocket record from my document?
Unless you have Advanced service account this free web service does not have data of your document after time out (typically 24 hours). If you need to change the content of your document you can always create the new one and discard the old document.
- What if lose my password?
Nothing can be done if you lose the password. To prevent this from happening use the recommended methods to prevent loss of your password.
- May I use different passwords for different jPockets in the same document?
Yes you can, but rather consider multiple documents instead.
- Why do I need your Advanced service if it is free and an open source solution?
The Advanced service does not provide any additional security to the FREE service. It provides additional easy to use tools to organize and save your files on the web server. It provides tools for protection of images of your documents, backups, password sharing mechanism, and limited support.
- Why is https used in Advanced service if no un-encrypted data is going outside the browser?
Although https protocol encrypts message it is used primarily to authenticate the Advanced service and to prevents malicious proxy server impersonating myInstantID.com service.
- What are Open Source benefits?
The main benefit of Open Source is transparency. Any security-related tool is only as good as its design and implementation. Transparency means that, in essence, all the moving parts are visible so you can judge for yourself whether the tool merits your confidence. In the case of a program, this means that complete source code must be available, and that you can verify that the program you're running corresponds to the source code provided.
The very nature of JavaScript achieves this transparency. The programs are embedded into the Web pages you interact with; to examine them you need only use your browser's "View Source" facility, or save the page into a file on your computer and read it with a text editor; any JavaScript components the pages reference can be similarly downloaded and examined in source code form. JavaScript's being an interpreted language eliminates the risk of your running a program different from the purported source code: with an interpreted language what you read is what you run.
Transparency is important even if you don't know enough about programming or security to determine whether the programs contain any flaws. The very fact that they can be examined by anybody allows those with the required expertise to pass judgment, and you can form your own conclusions based on their analysis.
- What are the risks when using this solution?
Security. The sole reason for encryption is to protect privacy. This means the process cannot involve any link whose security is suspect. If messages were encrypted by a Web server, they would have to pass over the Internet, where any intermediate site might intercept them. Even if some mechanism such as secure HTTP could absolutely prevent the data's being intercepted, you'd still have no way to be sure the site which performed the encryption didn't keep a copy in a file, conveniently tagged with your Internet address. In order to have any degree of security, it is essential that all processing be done on your computer, without involving any transmission or interaction with other sites on the Internet. A Web browser with JavaScript makes this possible, since the programs embedded in these pages run entirely on your own computer and do not transmit anything over the Internet. Output appears only in text boxes, allowing you to cut and paste it to another application. From there on, security is up to you. Security is never absolute. Data encrypted with these pages might be compromised in a variety of ways, including but not limited to the following:
· Your Web browser and/or JavaScript interpreter may contain bugs or deliberate security violations which report activity on your computer back to some other Internet site.
· Some other applet running on another page in your browser, perhaps without you being aware of its existence, is spying on other windows.
· Some other "spyware" application running on your computer may have compromised your system's security and be snooping on your activity.
· Your Web browser may be keeping a "history log" or "cache" of data you generate. Somebody may come along later and recover a copy of your data from that log.
· The implementation of these pages may contain a bug or deliberate error which makes its results insecure. This is why transparency, discussed below, is essential.
· Your computer's security may have been compromised physically; when's the last time you checked that a bug that transmits your keystrokes and/or screen contents to that white van parked down the street wasn't lurking inside your computer cabinet?
One can whip oneself into a fine fever of paranoia worrying about things like this.
- What if my healthy dose of paranoia is still not satisfied?
One way to rule out the most probable risks is to download a copy of the tool page with the JavaScript programs they reference and run it from a "file:" URL on a computer with no network connection whatsoever located in secure premises under your control. And look very carefully at any files created by your Web browser.
- Should I have an Electronic Digital Signature?
Here is what Arnold G. Reinhold wrote:
"When I was visiting Japan, my hosts gave me a chop: a carved wooden stamp with my name translated into Japanese kanji characters. They offered to take me to an office in Tokyo where I could get certificate, written in calligraphy, which I could then frame. The only problem was that the chop would then become "official", and anyone who stole it could sign my name in a legally binding way.
I declined."
An electronic signature is a lot like a chop, with two big differences: You might notice if your chop were stolen, and it is significantly hard to copy. Your private key and its enabling pass-phrase could be simple copied off from your computer disc in several ways, and you would never know until it was too late.
But doing business and being productive on Internet requires us to efficiently use digital signature in professional, official or even in private capacity.
You may consider putting similar NOTE as integral part of your digital signature associated with signed document:
"In the case of dispute there is logical mechanism to legally (disputable however) determine whether content or signature is original or temper. "