Posts Tagged ‘securing personal data’

Facebook and your privacy online

Thursday, July 29th, 2010

Facebook is in the headlines again today. The reason, as usual, concerns privacy and the personal data of facebook users. A man named Ron Bowes used a program to scan facebook and collect personal data from user accounts. The catch this time is that the personal data was all publicly available under each user’s profile.

By revealing the personal data of 100 Million users (100,000,000 – that’s a lot of zeros), Mr Bowes wanted to highlight the privacy issues associate with facebook. Note that the data he collected was all available to anyone searching the Internet. He just had a fancy tool do the heavy lifting for him. The information was available based on the settings each of the facebook users had for his or her account.

The solution that he and others propose for the issue of data available is to save all the users from themselves. That is, facebook (and presumably other social networks) should by default have all settings set to hide all personal data from view from others.

While this may not in general be a bad idea, it loses sight of the bigger issue which is that most people just don’t make the connection between privacy and the information they make available on social networks. In addition, having all settings switched to ‘maximum secrecy’ is not going to change human nature. It may actually make things worse. Instead of making people think twice about the information they are making available online, they may be upset at the barrier set up to sharing with their friends, and they may simply go and flip all the settings off.

While facebook could do a much better job explaining what it’s privacy settings mean to the user, the task of privacy still remains with the user.

We must be careful with ANY information we put online.

Peter L

Tags: , ,
Posted in News and Commentary, Passwords and Security | No Comments »

When it comes to passwords, is your IT guy one of the bad guys?

Friday, April 2nd, 2010

Not intentionally, I hope – but the IT guy (or gal) is usually under a lot of pressure to fix something quickly so that the business of doing business can move on. And that can lead to shortcuts and encouraging bad habits.

When you call the IT guy, you’re the one who wants it done quickly; when he comes knocking with some sort of update or network issue, he’s pushing all the more to get you set up – because he has to repeat the same thing for all of your colleagues. Either way, whatever he is doing usually requires a password – one of your passwords.

He starts working with you standing behind him as you explain the problem over his shoulder. He moves aside to let you enter your password.

You BOTH know that the password is a secret – your secret.

You bend over the keyboard to enter the password as he pretends to be interested in some pictures on the wall of your cubical.

He resumes working with you standing behind him. There’s a little small talk. He looks up at you because he needs the password again.

You BOTH know that the password is not supposed to be shared.

You awkwardly enter the password, again.

You discover that standing behind him is boring and that you don’t want to chat with him anymore. You hope that it’ll be over soon. It doesn’t look like it: he needs the password again. You seize the opportunity and write your secret password on a post it note and tape it to the desk next to your keyboard. You leave your cubical in search of something better to do – like getting grilled by your manager about a missed deadline.

This ritual happens over and over in almost every company. It doesn’t matter whether you have an in-house IT team or outsource your IT support. The IT guys and gals have it tough: they’ve got a job to do and they know better than anyone the company password rules. Yet, they bend the rules so that you can get back to work and they can get to the next customer.

This is bad news for at least a couple of reasons. First, your password isn’t a secret anymore. The person to whom you’ve revealed your ‘princess1’ password has access not only to the specific account or application, but also has an idea of your password philosophy, which makes it a lot easier to crack other accounts. Second, and maybe even more important, is that this type of behavior reinforces the idea that passwords and security aren’t important. Somewhere, deep in your subconscious, you slowly start getting used to the idea that sharing passwords isn’t a big deal; you may start to reconsider whether it is even worth it to have different password for different accounts and websites, and pretty soon, you’re using ‘password’ as your password. It’s a slippery slope!

This is a call to IT guys – come on, make it hard on us! Don’t let us tell you our passwords. Make sure we know that that’s not acceptable.

Peter L

PS Check out IT Crowd for a great look at life on the IT rung of the corporate ladder.

Tags: , ,
Posted in News and Commentary, Passwords and Security | 6 Comments »

Random happenings in the world of passwords

Tuesday, March 30th, 2010

Recently, I was in a meeting where several people gave presentations via a projector. As almost always happens, there were minor glitches in transitioning the projector connection from one notebook computer to the next. As part of her presentation, one unsuspecting person needed to log in to a site. Without looking at the screen to see what was actually being displayed, she ran through her login and password and clicked ‘ENTER’. She then looked up and saw that she had accidentally entered her password in the ‘NAME’ field. The result was that for several seconds, 9 strangers saw her full access credentials for the site. Nobody said anything. She cleared the fields and ran through the process again – this time successfully.

At the break, after talking about the material she presented, I quietly suggested that she change her password. “What do you mean?” When I explained that there were 9 additional people who now knew her information, she looked surprise. “Oh, that little slip when I started! I’m sure that no one here has any reason to do anything funny.”

We humans are a trusting species, especially when face-to-face contact is involved. Unless we have a specific reason to be suspicious of someone, we usually give people the benefit of the doubt about possible bad intentions. That’s fine and necessary for our daily lives: the local grocer and paperboy don’t want to rip us off; if we didn’t trust the other drivers on the road, then we would never be able to get anywhere. But we still have keys to lock up our stuff.

As for accidentally revealing all or part of a password, I’ve had it happen to me at inopportune moments in the past, and it’s not that uncommon to see it when working with people at a projector or a monitor. The people sitting around may or may not notice what happened, and they probably aren’t interested in your passwords. But you never know. And why would you take the risk? Next time something like that happens to you, make sure you double back at the first opportunity to change that password.

Peter L

Tags: , ,
Posted in Passwords and Security | 7 Comments »

Take my personal data, please!

Monday, February 22nd, 2010

A site called Please Rob Me has been created to highlight the problem that most people don’t make the connection between personal information and security. People are putting way too much information online through twitter and social networks. Note that I said ‘information’ – not just stuff like credit card numbers and other private data. Announcing to the public that you are not at home is like having a ‘kick me’ sign on your back. It’s even worse, because you put the sign on back yourself!

A few years ago, there was a rash of burglaries in the Washington D.C. area. All of the burglaries happened in the fall during football season. It was discovered that all the homes that had been burglarized had received anonymous tickets to watch the Redskins play. Redskins tickets were really hard to get, so many of the people who got the tickets went to the game. The bad guys then watched the homes that had received tickets and waited as the homes cleared out for the afternoon. The bad guys figured out that paying even hundreds of dollars for each ticket was a cheap investment compared to what they could steal from the homes. Many people who should have thought twice about the free tickets, didn’t give it a second thought and opened themselves to being violated by the burglars.

Online security is about more than passwords and secure online ordering. YOU are responsible for your security. Pattern your online behavior after your face-to-face interactions and you’ll be safer.

Check out this article in the BBC.

Peter L

Tags: , , ,
Posted in News and Commentary, Passwords and Security | No Comments »

Good passwords and how to use them

Sunday, February 21st, 2010

More and more, we’re seeing attention being given to passwords and personal security. It seems obvious that passwords are an integral part of securing your personal data, but that part of the security message seems to have been glossed over until recently. Ever notice the strange looks you get from your friends or even the IT guy when they see you taking precautions to not reveal your passwords? If so, congratulations, you’re ahead of the curve on this one.

A lot of the recent articles and blogs are about creating really good passwords. Many of the ideas are sound: create a string of characters and numbers that you will remember but that can’t be easily guessed – not even by people who know you. Your password shouldn’t be a word or a set of consecutive numbers or letters, or a date, like your birth date or anniversary. (Since your pet’s name is presumably a word, it’s ruled out by default!)

So, now you have a great password – great! But what about the rest of the passwords you need for all those online accounts and applications? What’s that? You only have a couple. Really?

When I ask people about the number of passwords they have, most folks say something like ‘only a couple’, or ‘around 10’. No one ever says 30 or 50 – BUT when you ask them to really think about the number of email accounts (hotmail, yahoo, gmail, etc.), banks, e-commerce sites (amazon, zappos, Barnes & Noble, online department stores, and on and on), travel sites (Travelocity, orbitz, priceline, expedia, etc.) local and other government sites, not to mention blogs and other special interest sites, people are surprised to discover that they really have quite a few. Even your list just keeps getting longer and longer.

Keeping them all straight is a big part of safe password usage. That’s where the password manager comes in. It is very difficult to manage in your head all of the good and unique passwords that you’ll need for all of the sites you visit. If you are stressing and spending lots of energy hiding passwords in your datebook or in spreadsheets, you should consider Sticky Password. You’ll have a strong, unique password for each site and you’ll have access to them wherever you go.

Follow sound rules and create a strong password that you won’t forget and that no one is likely to guess: use that as your Master Password in Sticky Password. Let Sticky Password create and manage all your other passwords.

Peter L

Tags: , , ,
Posted in Passwords and Security | 2 Comments »

Online security and relationships – a bad mix!

Tuesday, February 16th, 2010

I hope you all enjoyed Valentine’s Day! After reading the previous post, I hope that you all included a note to your beloved in that box of chocolates in which you announced that you’ve changed your shared gmail password. :-) Here are a couple of articles that came out recently that highlight the fact that feelings and security often don’t mix.

In Broken hearts put holes in wallets – the author stresses that “[f]raudsters know that trust is the key to profiting from love”. The bad guys know that people are very likely to share private info including passwords and other data once a ‘relationship’ is built. It’s a game that takes time, but the bad guys have all the time it takes to use social networks to build a sense of trust and then to get your data. (I picture the bad guys sitting at computers with all sorts of chats going on simultaneously like the guys in the park who play several games of chess at once with the punch clock.) Make it your policy to not share your personal data with anyone and you’ll be much safer.

Black hat hackers on demand is scarier. Here we find out just how easy it is for someone you know to pay someone to do the dirty work: your ‘ex‘ pays a few bucks and soon you receive an invitation where you have to enter your password yourself. They pay the money and get your password and access information. Here’s where your diligence comes into play. It takes discipline, but it’s up to you to make sure that before you click on anything or enter your access data anywhere that you know who it’s from. The bad guys in this scenario pretend to be someone you know. This makes it harder to resist the immediate click, but it’s worth waiting a few minutes to confirm who sent it. So much for instant gratification… but you’ll be safer for it!

Peter L

Tags: , ,
Posted in News and Commentary, Passwords and Security | 2 Comments »

Does sharing passwords mean you’re in love?

Sunday, February 14th, 2010

Back in the 7th grade I had my first girlfriend. It was true puppy love: we were together constantly at school and we shared everything, including our locker combinations. Sharing locker combinations was the thing to do. Every once in a while you would hear about a breakup and that he or she had thrown her or his stuff out of the locker onto the hallway floor, and that was just about the worst that could happen. There wasn’t a risk that your personal stuff would be revealed and exploited by bad guys half way around the world.

Back then (I’ll just say that it was in the 1980’s :-) ), that was about the only ‘secret’ security information that a pre-teen had. ‘Online’ wasn’t even a word back then and bulletin board services were just starting up for the techie types.

Well, it’s not the 1980’s and you’re not in junior high, anymore. The Internet is a part of our lives and personal data security and identity theft are on everyone’s mind. Yet, I regularly meet adults who tell me that they share online passwords with their lover – they say it’s cute. I’ve actually had people tell me that sharing passwords is a stage in each relationship that has to take place! (We know that the third date can be pretty busy, so does password swapping come on the 4th date, or maybe the 5th!?!)

It’s not about trusting or not trusting, it’s about common sense. Go ahead and share all your emails with your loved one if you want, just don’t give him or her your passwords. Even if you’re ‘positive’ that he won’t reveal your password, by sharing your password with someone else, you’re increasing the risk that the information may get out by accident. It’s not worth the risk, keep your passwords private. Be safe with Sticky Password Manager.

Tell him you love him with a kiss, not with your passwords.

Tell her you love her with flowers and a diamond, not with your passwords.

Peter L

Tags: ,
Posted in Passwords and Security | No Comments »

Security you’ll use

Tuesday, February 2nd, 2010

The secret to just about all things in life: start with manageable or agreeable amounts and repeat.

What am I talking about?

New Year’s passed recently, so we still have resolutions ringing in our heads. How many friends do you have who loudly proclaimed on January 1, that they just joined a fancy new gym or bought expensive exercise equipment?!  (Or, maybe it was you who made the claim?) Are they still keeping up with the impressive exercise programs? Typically, most people fail in their exercise programs because they choose the wrong program. If Bob doesn’t like lifting heavy things on bars, or staring at a TV while sitting on a bike that doesn’t go anywhere, then he’s probably not going to be inspired to keep going to the gym to do it over and over, for weeks on end until he gets in shape – even though he bought a membership at that fancy gym. But if Sue signs up at the Y because she likes swimming, then she is more likely to keep up with a schedule. In the end, who’s likely to be more successful in attaining their health goals? Sue, not necessarily because of a super strenuous program, but because she found something that she could do in reasonable doses over and over.

So, great, you’ll go to the Y and start swimming, but what does any of this have to do with security?

Actually, a lot. The majority of people consider anything to do with security to be boring, or they don’t like it because it slows them down in what they want to do right NOW. These folks may have all sorts of imposing security hardware and software on their computers, but you’ll note that they often disregard proper usage. They simply ignore warnings from their firewalls by clicking ‘allow all’, that is, if they have their firewall turned on at all. And Microsoft security updates? Why should they bother? Strong passwords with some sort of solid approach to password management? Not likely! And all of these folks want to maintain their ‘health’ -  keep their identities safe online and their personal data secure.

The better approach is to have basic set of tools that you’ll use: an anti-virus program (many include anti-spyware), a firewall and a password manager – and perform those security updates from Microsoft. That’s the minimum. If you’ve read any of the earlier posts in this blog, or the general news, then you know that password and phishing exploits happen too frequently to ignore. A password manager is now part of the basic kit. Start with these few tools, and learn to use them. You’ll see that it doesn’t require any more effort to learn how to use them than it does to click on ‘allow all’ to break through your firewall!

Once you’ve built the foundation for your security health, add more tools in manageable amounts and repeat.

Tags: , , , ,
Posted in Passwords and Security | 2 Comments »

Taking passwords seriously

Sunday, January 31st, 2010

A few recent articles have revealed (again) that most people don’t take their online security seriously. Maybe a better way of saying this is that most people don’t seem to connect the dots between their passwords (online logins) and how they help keep their personal data secure. At a time when everyone is talking about identity theft protection and personal data privacy, a huge number of Internet users still use very weak passwords (anything that is predictable or can be easily guessed) or repeat the same password in multiple accounts.

The purpose of passwords is to keep others ‘out’. By using predictable passwords, you’re making it easier for someone to get ‘in’. That doesn’t mean that someone will get in, or even that someone will try to get in, but you’ve made it easier for him. It’s worthwhile identifying two basic categories of wrongdoers: those we know and those we don’t know. When thinking about security, most people think about a threat that they can imagine. When I was about 10 years old, I had a safe in which I kept my allowance and a few small prized possessions (actually, it was a piggy bank with a very simple combination lock). My only concern at the time was to keep my sister out. I had no concept of other threats and so my security system focused on the threat I could picture in my mind. (Confident that she would never be able to guess it, I probably used something like my birth date as the combination!) With online logins and passwords – when thinking about threats at all – the picture of bad guys for most people is someone trying to access their account just as they themselves would: sitting at a computer and trying combinations of numbers and letters. That’s not always the case.

Most people are generally trusting and don’t think that their friends and family would try to access their online accounts: maybe they wouldn’t, but relationships do change and people are curious, so why open yourself to the risk!? In general, it’s because of the people who know us that we shouldn’t choose passwords tied to our children’s or pets’ names, birthdays, and other personal and family information that may be known by others. These people know your details and would probably start trying to get into your account with this info.

As for the other group – the guys who are usually dressed in black in the movies – people think that really bad guys aren’t interested in their accounts. But these are the bad guys that we all need to protect ourselves against. They don’t care who you are, they just want data – your personal data! These are the bad guys who use brute computing force to access, or hack, accounts. They don’t personally go from one account to the next – patiently trying to get into a specific person’s accounts. They have powerful computers that try millions of combinations of logins and passwords every hour all over the World Wide Web. And, here’s where strong passwords with combinations of numbers, letters (upper and lower case) and special characters come into play. Each little twist to a password makes it that much harder to crack. It doesn’t matter whether you think the info in your email account is valuable, someone out there does. He probably doesn’t want to read your email – but your login and password are $valuable$. Valid logins and passwords are worth more on the black market today than a valid credit card number!

It bears repeating: the purpose of passwords is to keep others out! Make sure you use passwords that will keep others out.

Tags: , , , ,
Posted in Passwords and Security | 6 Comments »

Personal Privacy and that ‘Interview’ with a Facebook Employee

Tuesday, January 12th, 2010

Yesterday, The Rumpus published an interview with an undisclosed Facebook employee. In the article the employee highlights a bunch of practices within Facebook that suggest that member data isn’t as private as we might think it to be. I’ve put quotes around the word interview in the heading, because it really isn’t clear whether the interview actually took place, or maybe rather, how much of the info is really the result of an interview with a real person and how much has been filled in by the author to cover his tracks or because the info intuitively fits into the picture.

After reading several articles about the interview, I keep returning to the same conclusion I had after reading the original article: everyone is responsible for his or her own privacy. It may seem that privacy is out of our control in this technological world, but there’s a lot we can do.

In the era of instant gratification and reality TV, everyone wants to be a star – and that, immediately. The Internet gives us our chance. We’ve grown used to putting anything and everything (pictures, biographical info, financial and other data) on the Internet with such trust – closer to complete lack of concern – that I am amazed that more harm doesn’t come of it. The anonymity that loosens our inhibitions to reveal intimate secrets blends very well with the voyeurism of the Internet generation.

We want everyone to see us in our full glory and yet we demand that we be granted privacy. We can’t have it both ways. The Internet is a tool that must be used with caution, just like any other tool. If you wouldn’t dance naked in your living room with the shades up, or provide your financial info to your neighbors, why would you think it’s OK to do it on the Internet?

Back to the article, nothing in it is really surprising. Regardless of the company, some employees always have access to customer data. That’s because they need to.  While it may be implementing them a little late in the game, I’m sure that Facebook has similar rules that other companies do. It’s what happens or can happen to the data that is important. Think of the government agents who have lost computers with tens of thousands of personal records. It’s not about new laws or regulations or restrictions, because there’s always the human element involved and that is why we need to think about what we can do to ensure that our personal data is secure. If nothing else, we control the information that we put out there on Facebook and other social networks.

Maybe this interview incident will be a wake-up call to people to think about what they are doing for their own security.

Peter L

Tags: ,
Posted in General, News and Commentary | 4 Comments »