July 21st, 2010
One night my landlady told me, that she had some ”Notification failures” in her Hotmail inbox and if I can help her, since I work for a software security company. So of course I agreed and had a look at her Inbox. It was full of “Notification failure” messages, that some email was not delivered, that some mailbox doesn’t exist and so on. So I had a look at her sent messages and I saw a lot of sent emails to many many emails in BCC (blind carbon copies). Wow, it was the first time I have seen some hacker just hacking someone’s email account and using it for spamming. That was scary. Really scary.
So I told her to immediately change her password and also to tell me her password and guess what, it was the most common password ever!! 123456. Oh my gosh! I was shocked! And then when we tried to change the password I have realized that she had been using this password since she created her email account. Since 1998! That’s right! She had the same poorest password for 12 years. She is lucky that someone hacked her email just 2 weeks ago. So I tried the password changing process and it stopped me with the message: “Please update your browser and system” because she hadn’t updated her browser and system for 2 years! Yes, 2 years. So we had a lot of updates to go through and after 3 hours I was finally able to change her mail account password. So I asked her what password she wanted to use and she told me “Well, if 123456 is not secure enough, lets go with my other password happyhappy.” Oh my gosh again! Come on!
So I told her the basics of selecting a strong password and, of course, I told her about Sticky Password and all of its benefits. She was so surprised about all the password management topics and she also told me, that she has been using 2 passwords for all of her accounts all her life.
Now she is in the middle of starting her new online life.
Petr P
Tags: identity, password, security
Posted in General | No Comments »
April 19th, 2010
I’d like to see the next security survey include a follow-up question to the ‘are you afraid of identity theft’ question. Something along the lines of: ‘do you know what identity theft is and how you can protect yourself?’
I’m not trying to belittle the issue of identity theft. But my own experience is that most people simply repeat the phrase because they’ve heard it so many times on TV and the radio. They don’t understand it and therefore they don’t take even the most basic of precautions to protect themselves.
It’s kind of like the idea of ‘panic rooms’. After the release of the Jodie Foster film (2002), it was all the rage to talk about ‘safe rooms’ and all sorts of new fangled security systems. But do you know anyone who actually did anything to increase the security of his or her home? Lots of talk and no action!
With identity theft, the situation is worse because identity theft is something that can impact each and every one of us. If you have a social security number (in the US, or the national ID in other countries), or credit card, or a bank account, or utility bills you are at risk. Each one of us who is living in modern society is a potential target.
Make sure you protect your personal data. As far as computer usage is concerned, at the very least make sure that your computer software is up to date, including security patches. Make sure you have the basic security programs installed and running: anti-virus software, firewall, anti-spam, and a password manager. With email: don’t open it or click on it unless you KNOW who sent it! Be jealous of your privacy!
Do you know what identity theft is? How are you protecting yourself?
What would your answers be?
Peter L
Posted in General | 3 Comments »
April 18th, 2010
I just ran across a little article about a school having its computer system compromised because of a password being swiped. It seems that a student in the 4th grade got the password from a teacher’s desk and then used it to fiddle with the district-wide computer ‘blackboard’ system. No long-term harm was done, but I’m sure the IT folks were scrambling for a while before they figured out what had happened.
Luckily, the alleged child culprit wasn’t prosecuted! While the 9-year old surely misbehaved, in my estimation, the offense doesn’t warrant a criminal punishment. Instead, it should be a call to the school to figure out why passwords are accessible to curious 9-year olds. (Aren’t all 9-year olds curious!?!)
What is missing from the article is any mention of the security policy of the school. Is it standard policy for teachers to write their passwords on post-it notes and to leave them on their desks? Why did this teacher have a password with administrator rights? Do all of the teachers have admin rights? Did the teacher follow procedures for keeping the password safe? Were there any procedures to follow?
We aren’t given any details, but would we be going out on a limb to conclude that the fault or breach is the fault of the teacher, if not the school or district for failing to follow an appropriate security policy for passwords?!
Peter L
Posted in General | 1 Comment »
Facebook and your privacy online
July 29th, 2010Facebook is in the headlines again today. The reason, as usual, concerns privacy and the personal data of facebook users. A man named Ron Bowes used a program to scan facebook and collect personal data from user accounts. The catch this time is that the personal data was all publicly available under each user’s profile.
By revealing the personal data of 100 Million users (100,000,000 – that’s a lot of zeros), Mr Bowes wanted to highlight the privacy issues associate with facebook. Note that the data he collected was all available to anyone searching the Internet. He just had a fancy tool do the heavy lifting for him. The information was available based on the settings each of the facebook users had for his or her account.
The solution that he and others propose for the issue of data available is to save all the users from themselves. That is, facebook (and presumably other social networks) should by default have all settings set to hide all personal data from view from others.
While this may not in general be a bad idea, it loses sight of the bigger issue which is that most people just don’t make the connection between privacy and the information they make available on social networks. In addition, having all settings switched to ‘maximum secrecy’ is not going to change human nature. It may actually make things worse. Instead of making people think twice about the information they are making available online, they may be upset at the barrier set up to sharing with their friends, and they may simply go and flip all the settings off.
While facebook could do a much better job explaining what it’s privacy settings mean to the user, the task of privacy still remains with the user.
We must be careful with ANY information we put online.
Peter L
Tags: identity, personal security, securing personal data
Posted in News and Commentary, Passwords and Security | No Comments »