Four Clues That Show a Web Service Doesn't Understand Security

Users have a responsibility to look after themselves on the Internet. It's their job to make sure they use long and random passwords, don't write them down where just anyone can see them, and don't use their dog's name as a password on their favorite Manga forum and their main email account.

But users can only be safe on the Internet if the sites and services they use meet them halfway. Online services need to provide secure authentication, not get in the way of users' efforts to keep themselves safe, and most importantly, make sure they manage, communicate, and store sensitive information responsibly.

How can a web user tell if their favorite site has implemented security best practices or is playing fast and loose with their data? Unless the company makes their security policies and procedures transparent, it's almost impossible for the average web user to be sure. For a non-technical user, most web services are a black box. They see an interface and use the features with no idea of how it all works. But that doesn't mean users of cloud applications and web sites are without recourse — there are clues or heuristics they can apply to a service to test its security.