The Internet, the Web and email

The essential point. The Internet is the roads; the Web is one kind of traffic on them. Email, file transfer (FTP), video calling, VoIP, online games and software updates all use the Internet without being part of the Web.

This is why "the Internet is down" and "this website is down" are different complaints, and why the Web could be replaced tomorrow while the Internet continued unchanged.

A useful test: opening Gmail in a browser uses the Web to reach email; collecting the same mail with an application over POP3 or IMAP uses the Internet but not the Web at all.

A URL — Uniform Resource Locator — is the complete address of a resource on the Internet, stating both how to fetch it and where it is.

The parts.

$$\underset{\text{protocol}}{\underbrace{\text{https://}}}\underset{\text{host}}{\underbrace{\text{www.}}}\underset{\text{domain}}{\underbrace{\text{example.org}}}\underset{\text{path}}{\underbrace{\text{/notes/}}}\underset{\text{file}}{\underbrace{\text{unit1.html}}}$$

1. Protocol — https://. The rules for the transfer. HTTPS is HTTP secured with SSL/TLS, so the traffic is encrypted. Others: http://, ftp://, mailto:.

2. Host (subdomain) — www. Names a particular server within the domain. Conventional but not compulsory; mail. or library. may name other servers.

3. Domain name — example.org. The registered name, read right to left: .org is the top-level domain (organisation) and example the organisation. DNS translates this into the server's numeric IP address.

4. Path — /notes/. The directory on the server, like a folder path. Often case sensitive.

5. File — unit1.html. The resource requested, its extension indicating the type.

A URL may also carry a query string after ? (parameters, such as ?page=2) and a fragment after # (a position within the page).

1. LAN — Local Area Network. Connects computers within a single building or campus, typically up to a few kilometres. Owned and administered privately by the organisation that uses it, so it needs no permission from any authority.
Example: a college computer laboratory, or an office floor.
Distinguishing feature: highest data rate and lowest error rate, because the distances are short and the cabling is under the owner's control. Speeds of 100 Mbps to 10 Gbps are ordinary.

2. MAN — Metropolitan Area Network. Spans a city or a large town, up to a few tens of kilometres, usually by joining several LANs. Often built and run by a service provider or a municipal body, using leased lines or fibre laid along public routes.
Example: a cable television network across a city; a university linking its several campuses within one city; a city-wide corporation network.
Distinguishing feature: intermediate in every respect — larger than a LAN, faster and cheaper per kilometre than a WAN — and it typically requires public rights of way, so it cannot be purely private.

3. WAN — Wide Area Network. Spans a country, a continent or the world, with no distance limit. Built from links leased from telecommunication carriers, and usually owned by no single organisation.
Example: the Internet — the largest WAN in existence; also a bank's network joining branches across India.
Distinguishing feature: greatest coverage but lowest speed per link and highest error rate and cost, because signals travel very long distances over infrastructure the user does not control.

The pattern. As the area grows, coverage rises while speed, reliability and degree of private control all fall — the trade-off that makes all three necessary rather than one being simply better.

Also worth naming: PAN, a Personal Area Network of a few metres, such as a phone paired with earphones over Bluetooth.

Parts of a message.

An address has the form username@domain, the @ separating the user's name from the domain of the mail server, and containing no spaces.

To, Cc and Bcc compared.

When Bcc should be used.

1. Writing to a large group of people who do not know one another. This is the important case. Sending a notice to sixty students with all sixty addresses in To discloses every student's address to every recipient — a breach of their privacy, and a gift to anyone collecting addresses for spam. The same notice with the addresses in Bcc reaches everyone while disclosing nothing.

2. Copying someone discreetly — keeping a supervisor informed without making that visible to the main recipient.

3. Preventing a Reply All storm. Because Bcc recipients are not on the visible list, no one can reply to the whole group. On a mailing of hundreds this alone saves a great deal of unnecessary mail.

4. Keeping a copy for a record, by Bcc'ing an archive address.

A caution. Bcc should not be used to conceal a recipient from someone who has a legitimate right to know they are involved — that is a misuse of a privacy feature rather than an application of it. And the ordinary care applies to Reply All itself: it goes to everyone in To and Cc, so the recipient list is worth reading before sending.

All three are email protocols, but they do different jobs. SMTP is for sending; POP3 and IMAP are alternatives for receiving.

SMTP — Simple Mail Transfer Protocol. Carries an outgoing message from the sender's program to the sender's mail server, and onward from server to server until it reaches the recipient's mail server. It is a push protocol and is used for sending only — it cannot retrieve mail.

POP3 — Post Office Protocol version 3. Downloads messages from the server to one device, and by default deletes them from the server afterwards. The mail then exists only on that machine.

IMAP — Internet Message Access Protocol. Synchronises with the server. Messages remain on the server, and the client displays them along with their folder structure and read/unread status. Actions taken on the device are carried out on the server.

Why IMAP is preferred for several devices.

Suppose the same account is used on a phone and a laptop.

With POP3, whichever device connects first downloads the messages and removes them from the server. Open the laptop later and the inbox is empty — the mail is on the phone. Read a message on the phone and the laptop has no way of knowing. Reply from the laptop and the sent copy exists only there. Folders created on one device do not exist on the other. The single account behaves as two unrelated mailboxes, each holding part of the mail.

With IMAP, the server holds the definitive mailbox and every device is a view of it. Reading a message on the phone marks it read on the laptop; filing it into a folder files it everywhere; deleting it deletes it once. Every device shows the same inbox, because there is only one inbox.

$$\text{POP3: mail lives on the device}\text{IMAP: mail lives on the server}$$

Two further advantages of IMAP: the mail survives the loss or failure of any device, since the server holds it; and only headers need be fetched until a message is opened, so a large mailbox is usable over a slow connection.

When POP3 is still reasonable: a single device, a wish to keep everything locally rather than on a provider's server, or very limited server storage.

Phishing is a fraud in which a message impersonating a trusted organisation — a bank, a service provider, an employer, a university — persuades the reader to disclose a credential such as a password, PIN, card number or OTP, or to install malicious software.

The word plays on "fishing": bait is put out to a very large number of people in the expectation that a few will take it. It is an attack on the person, not on the computer, which is why it defeats technical defences: no software fault is exploited when the victim types their own password into a convincing form.

Variants: spear phishing (aimed at one named individual using real details about them), vishing (by telephone), smishing (by SMS), and pharming (corrupting DNS so a correctly typed address reaches a fake site).

How to recognise it.

1. A generic greeting — "Dear Customer", "Dear User". An organisation holding your account holds your name.

2. Urgency and threat — "within 24 hours", "your account will be suspended", "immediate action required". The purpose is to prevent you pausing to check, which is the one action that defeats the fraud.

3. A domain that is close but wrong. Read the address right to left: in sbi-verify-login.com the registered domain is sbi-verify-login.com, which anyone may buy. Words appearing earlier prove nothing — sbi.attacker.com belongs entirely to attacker.com. Watch also for misspellings and swapped characters: paypa1, arnazon.

4. A link whose destination differs from its text. Hovering over it reveals the true target in the status bar.

5. Missing HTTPS on a page asking for credentials. Note the converse is not reassurance — a padlock proves only that the connection is encrypted, and fraudulent sites obtain certificates easily.

6. Poor spelling and grammar, or an unusual tone for the supposed sender.

7. Any request for a password, PIN or OTP — decisive on its own. No genuine bank or support desk ever asks for one. This single feature identifies fraud with no exception worth entertaining.

8. An unexpected attachment, particularly .exe, .zip or a document urging you to enable macros.

Precautions.

1. Never disclose an OTP, PIN or password to anyone, by any channel.
2. Verify independently. If a message might be genuine, reach the organisation through its own published address, its official app, or the number printed on your card — never through details supplied by the suspicious message.
3. Type addresses, or use your own bookmarks, for banking and other sensitive sites rather than following links.
4. Two-factor authentication everywhere it is offered, so a stolen password alone is insufficient.
5. Strong, different passwords per service, held in a password manager. Reuse means one breach compromises every account.
6. Keep the operating system, browser and antivirus updated — most successful attacks exploit a fault already patched.
7. Do not open unexpected attachments or links, even from a known sender, whose account may itself be compromised.
8. Avoid entering credentials over public Wi-Fi; use a VPN if unavoidable.
9. Back up important data — the only reliable defence against ransomware, since it removes the attacker's leverage.
10. Log out of shared computers, and clear the session.
11. Report and delete suspected phishing; providers use the reports to protect other users.

If a credential has already been given: change that password immediately from a different device, change it anywhere else it was reused, inform the bank or provider at once, and watch the account for unauthorised activity.

The principle. Phishing works on urgency and trust rather than on any technical weakness. The habit that defeats nearly all of it is simply to slow down: no legitimate organisation is harmed by your taking two minutes to verify a request through a channel you chose yourself.