What is the external IP address and the Browser Agent String?
A Delivered Secure user recently asked what the External IP Address and Browser UserAgent String values are that we provided in an email notification when someone picks up a file you’ve sent. These two pieces of information help to form an audit trail and provide the sender of the secure message a level of validation that that person who received the files is intended recipient. Are there any security risks associated with highlighting this already public information? Let’s explore that question further.
External IP Address
Every device connected to the Internet has a public IP address. Your ISP assigns this IP address to you, either statically (the IP address never changes) or dynamically (the IP address can change each time you connect), based on your service type.
In most environments where a firewall or router is in place, the public IP address is bound to the external interface of the router or firewall. Each computer on the LAN side of the firewall has a private IP address that your network administrator configures. In these scenarios, most often a service called NAT (Network Address Translation) allows your computer to browse the Internet, but doing so using the public IP address of your firewall/router’s external interface. Each time you visit a website, that web server sees your router’s public IP address and records it in its logs.
Delivered Secure also records this public IP address and reports it back to the sender in the email notification. The purpose of reporting this back to the sender is to provide some level of assurance that the person who picked up the file was indeed the correct person. In all likelihood, this IP address is not the actual IP address assigned to the recipient’s computer inside of her or her LAN, but it is the public IP address of the Internet router or firewall the person connected from. Should litigation ever arise where you needed to provide your recipient downloaded a file, the recipient’s ISP should have records to be able to confirm that the IP address you have listed in your pickup notification was assigned to that recipient or that recipient’s organization on the date and time of the pickup.
Example diagram showing how NAT works
Are there any security risks?
In practical discussion, no, there are no significant security risks of the sender seeing this information. Remember, this is a public IP address. Every website that you visit, every email that you send, and every ad that you view on your device results sharing this information with the serving device.
Purists may argue that this presents an information disclosure risk; however, far more information about your private and public network infrastructure is disclosed in typical email headers every time you send an email. Delivered Secure actually reveals less information than had you sent the file via email (which is not a secure practice anyway). Those with nefarious intent would know where to find this information in the email headers so the fact that Delivered Secure provides you with this information in the email body is not a significant security risk.
If you’re curious to know what your current external public address is, visit this page.
Browser UserAgent String
Your browser reports certain data about itself each time you visit a website, such as the type (Internet Explorer, Firefox, Safari, etc.), the version (11, 32, etc.), and the operating system (Windows, Mac OS, etc.), and other information. Often developers can use this information to allow a website to function properly for specific browsers, but in almost all cases the website you visit will log this information to help the website owner to better understand the traffic the website receives.
Delivered Secure reports this information back to the sender as part of its recipient integrity validation logic. When combined with the external IP address, the Browser UserAgent String can give you further proof that the person who received your file was the correct recipient. In a litigation case, this information could help to determine whether or not the person who retrieved the owns or had access to a device with a Browser UserAgent String matching what Delivered Secure logged.
Are there security risks?
In practical discussion, no, there are no significant security risks associated with this information disclosure. As with the external IP address, this information is shared with every website you visit.
A purist could argue that this could expose computers that are using outdated browsers, such as Internet Explorer 8, which is true; however, if you’re a financial institution still using Internet Explorer 8, then your organization has more pressing security matters to address than this type of information disclosure.
Benefits Outweigh Risks
One of the primary tenets of Delivered Secure is to provide an acceptable level of assurance that the information you send to someone is received by that person. Delivered Secure employs several methods to provide senders with this assurance, including reporting back to the sender certain non-classified information. These two pieces of information can provide further proof of the correct recipient should the need ever arise.