Posts Tagged ‘security’

« Older Entries

Not so secret secrets that will keep you safe online

Tuesday, July 27th, 2010

Good article on security ’secrets’ that will help keep you safe.

Start at the end and move to the beginning. The advice about knowing what programs you use and making sure that they are up to date is easy and huge, HUGE – really big! – in keeping you safe. This applies to programs and your operating system. Even though Microsoft and most software developers encourage their users to automate the update process, most people don’t seem to ‘get around to it’. What is it about leading a horse to water…

While they do seem to have a lot of updates, Microsoft doesn’t up-sell in their updates. There is no excuse to not have the latest security patches on a daily basis – or however often they come out. (Whining about Microsoft isn’t going to help, so just get the updates.)

I do see a problem with updates from a lot of the other software vendors. Large or small, a lot of vendors intentionally blur the boundary between security updates and sales pitches for upgrade. This discourages a lot of users – including yours truly – from paying attention to what is included in the latest update. It is easier to say ‘no’ to an update, then to try to decipher whether this is a payable upgrade or something that I need!

It is up to you to know what you have on your computer so that you will know when something fishy is going on.

Peter L

Tags: ,
Posted in News and Commentary, Passwords and Security | No Comments »

Back to basics – protecting yourself online

Monday, July 26th, 2010

Basic advice for staying safe while staying connected on vacation. Actually – it’s very good advice for your everyday usage, also! As with the great majority of advice you’ll see here, or on the Sticky Password facebook page or stuff that we link to, you’ll notice that most of this involves common sense.

Two big issues with being active on …the Internet are 1) that people often think that they’ve built a bond with someone they’ve never just because they both play World of Warcraft online. The truth is that you don’t know who is on the other end of the discussion. Just as you wouldn’t share your personal info with a stranger in the subway who was also wearing a Yankees jersey just because you are also a fan, you should never make your info available online. Someone may misuse it. (Getting away with it 9 times out of 10, won’t take the pain out of getting burned that 10th time!) And 2) the idea of anonymity. Somehow, because we are using a computer, we think that there is a veil of anonymity over anything we do. Nothing could be further from the truth. Unless you are careful, that computer can easily reveal anything and everything you’ve entered – all the sites you’ve visited, your personal data and more.

Taking basic precautions may take a few minutes (really, only a few minutes), but it can save you from the anguish and real problems of identity theft. AND, by taking those few precautions, you’ll probably get even better use of your computer as you learn to use it better.

Peter L

Tags: , ,
Posted in General, News and Commentary, Passwords and Security | No Comments »

How password management is performed by a friend of mine

Wednesday, July 21st, 2010

One night my landlady told me, that she had some ”Notification failures” in her Hotmail inbox and if I can help her, since I work for a software security company. So of course I agreed and had a look at her Inbox. It was full of “Notification failure” messages, that some email was not delivered, that some mailbox doesn’t exist and so on. So I had a look at her sent messages and I saw a lot of sent emails to many many emails in BCC (blind carbon copies). Wow, it was the first time I have seen some hacker just hacking someone’s email account and using it for spamming. That was scary. Really scary.

So I told her to immediately change her password and also to tell me her password and guess what, it was the most common password ever!! 123456. Oh my gosh! I was shocked! And then when we tried to change the password I have realized that she had been using this password since  she created her email account. Since 1998! That’s right! She had the same poorest password for 12 years. She is lucky that someone hacked her email just 2 weeks ago. So I tried the password changing process and it stopped me with the message: “Please update your browser and system” because she hadn’t updated her browser and system for 2 years! Yes, 2 years. So we had a lot of updates to go through and after 3 hours I was finally able to change her mail account password. So I asked her what password she wanted to use and she told me “Well, if 123456 is not secure enough, lets go with my other password happyhappy.” Oh my gosh again! Come on!

So I told her the basics of selecting a strong password and, of course, I told her about Sticky Password and all of its benefits. She was so surprised about all the password management topics and she also told me, that she has been using 2 passwords for all of her accounts all her life.

Now she is in the middle of starting her new online life.

Petr P

Tags: , ,
Posted in General | No Comments »

Protecting yourself against hackers of all sorts

Monday, June 28th, 2010

Now that security professionals are talking about hacking cars, home security systems, and digital cameras, you’re probably wondering if there is anything that is safe from hackers. At least your home appliances are safe – right?! Well, no. Now, even your high-tech blender is a potential risk.

The goal of the hacker isn’t always to get your personal data. In the case of appliances and GPS devices, the experts are saying that the device will be used to mislead or distract you, opening you up to an attack. When you take a look at the things highlighted in the article that hackers are focusing on, or will soon be focusing on, you’ll see that there is something very simple that you can do to improve your own security.

Simple yet critical: use the built-in security options of your devices.

Many of the items mentioned in the article have functionality that relies on communication via a wireless network, or in some other way uses computer technology. Just by following basic computer security procedures like getting the latest software updates, picking strong passwords and using the basic security settings, you’ll stand a much stronger chance of protecting yourself.

Going back a few years to when major brand name viruses like Melissa ravaged the Internet, a huge number of the infected computers were vulnerable because users simply did not perform the suggested Microsoft security updates.

Hackers then and now count on users NOT following basic security instructions.

Don’t become a statistic! Take the time to learn how to use the security features. In most cases, you’ll see that it’s just as easy to use the security as not, with the undeniable advantage that you’ll be safer.

Also mentioned in the article is the ‘last frontier of hacking’ – the human brain. The author points out that at least part of this is the realm of social engineering: a con-game tricking you to act in some way. The realm of phishing and other email exploits try to trick you to click on something or to send your information to someone for your share of millions of dollars.

Ah, but that’s a topic for a different blog…

Peter L

Tags: , ,
Posted in News and Commentary, Passwords and Security | 2 Comments »

Security is manageable – passwords and more

Thursday, June 24th, 2010

Your security online is made up of little things that each and every one of us CAN manage. Much of protecting yourself involves paying attention and being aware of what you are doing when using your computer. Even the settings that you use for your computer and security programs are designed to allow you to make a reasonable decision based on the way you use your computer. The few minutes of paying attention while installing your security software can make all the difference. Know what the software is doing for you, so that you’ll be able to recognize when something strange is going on.

A password manager is there to do for you those things that take up your time and really are an effort. Creating strong passwords for each website and keeping them straight in your head isn’t easy. And it does take time to use them. We recommend Sticky Password, but whether you use a password manager or not, you should be aware of the basics of safe passwords: unique strings of letters and numbers that can’t be guessed for each site and purpose. And, of course, don’t share your passwords with anyone.

And, as has been written in this blog before, DON’T believe everything you read. That’s generally true, but on the Internet, you are likely to be overwhelmed by offers. If you wouldn’t accept the offer from someone on the street, then there is even more reason to reject it from a mysterious someone who wants to share riches with you. Your odds of winning the lottery are better than getting ‘your share’ of the millions of dollars.

Review these general security tips and you’ll see that protecting yourself is something that you CAN manage.

Tags: , ,
Posted in General, News and Commentary, Passwords and Security | 1 Comment »

A brief history of hacking

Wednesday, June 9th, 2010

Check out this abridged history of hacking.

The history of mankind: there is always someone out there who is interested in getting access to other people’s ‘stuff’. While many of the examples given in the post focus on government systems, that’s not the rule. Breaking into a military system is always a thrill (and embarrassment to the government), but breaking into company and personal accounts is more lucrative. Systems can be hacked, so it is YOUR responsibility to take care of your personal data. Strong passwords are a requirement for protecting your personal data.

Also very interesting is the type of people who are doing the hacking. You may not have seen your Aunt Sally in the list, but a lot of those teenagers and students could have lived just down the street from you. Make sure that you are securing your passwords.

Peter L

Tags: , , , ,
Posted in News and Commentary, Passwords and Security | 1 Comment »

Passwords, personal data and Identity Finder

Friday, May 14th, 2010

Here in Essex County, New Jersey, the county is promoting the annual computer and electronics recycling day (this Saturday, May 15), so when I saw the article about Identity Finder on ComputerWorld.com, I was in the right mindset to appreciate the problem.

What’s the problem? Your computer can end up in the strangest places.

Your computer = YOUR PERSONAL DATA

Whether you give your computer to a family member or donate it to a good cause, or someone steals it, all that stuff you put in there thinking that no one would ever see has a way of staying around a long time. And, for as long as the data is there, someone can get to it. (I know that computer recycling projects often claim to wipe all the data clean, but I wouldn’t count on someone else doing it for me.)

Identity Finder (cute logo!) does a deep scan of your computer to locate data associated with your identity – social security and credit card numbers, birthdays, unencrypted PASSWORDS, etc. If you’ve had your computer for any period of time, it is going to have information that you’ve forgotten about. Some of that data should not get into the wrong hands!

The author mentions that Identity Finder can ‘shred’ the files to ensure that the data is unrecoverable, which is very good. It brings up the question of whether Identity Finder can find the data in files that underwent a ‘standard’ delete and therefore are still technically accessible on the hard drive. THAT would be a great service to the average computer user.

All the passwords and personal data that are stored in Sticky Password are encrypted – so even if someone gets access to the computer, he won’t be able to get to your information. Passwords stored in your browser aren’t secure. Neither are passwords in that old Word or Excel file that you labeled with the mysterious title: mypasswords.doc. Knowing where your sensitive data are is a big step in protecting yourself.

I’ll be running Identity Finder scan on my computer this weekend!

My only question: what were all those social security numbers doing on the author’s computer in the first place!?!

Tags: , ,
Posted in News and Commentary, Passwords and Security | 5 Comments »

Password survey results

Wednesday, March 31st, 2010

I ran across an interesting password survey conducted by Kevin Haley at Symantec. About 450 people answered his 9 straightforward questions. When thought about a bit, some of the results are pretty interesting.

The first question asked about the number of passwords. 33% of all respondents said that they have 10 or fewer password-protected accounts (networks, websites, etc.). Mind you that these folks took an online survey. As best as I can tell, they had to login to participate in the survey, which is entirely appropriate, but that would mean that that was one of their passwords – right?! My point is that most people severely underestimate the number of password-protected accounts they have. I’ve mentioned it in earlier blogs – stop someone on the street and ask how many accounts someone has and you’ll get an answer like ‘just a few’, ’maybe 10, or so’, or some small number. But when you think about most people (not technology geeks), you quickly see that even a basic Internet user will easily have 10 accounts, and probably more. Average users will likely have 20, 30 and more. Think about your own password-protected accounts:

1 free webmail (yahoo, gmail, hotmail, etc.)

2 email from your service provider (aol, comcast, earthlink, …)

3 facebook or other social network, maybe multiple networks

4 work

5 Amazon and other online shopping sites

6 Travelocity and other travel sites

7 online subscriptions (newspapers, magazines, newsletters, …)

8 just about any online blog to which contributions are made

That’s not to mention banks, credit cards and other financial stuff like retirement and investment accounts, government sites, libraries and local services, airlines, as well as cell phone accounts, utilities, and so on. This is interesting because a result of this underestimation is likely to be that many people entirely misunderstand the threat to their data, which should be protected by their passwords. If there’s no threat, then you don’t need to manage anything – right!?

The response to question 6 flows from the first: if you don’t think there’s a lot to remember (i.e. that you have only a few passwords), then you’re bound to think you can do it all in your head. 60% of people responding said that their ‘memory’ was their method for remembering passwords. I’ll bet a dollar to a donut that these folks’ passwords aren’t the strongest on the block. Still, quite a few (7%) admitted to storing theirs on post-it notes next to the computer.

Questions 2 and 3 were about choosing passwords. Just over eighty percent (80%) indicated that they recycled or duplicated their password to some extent. This would seem to contradict the 71% of respondents who selected ‘strength’ as one of the most important factors when selecting a new password. I thought the 9% who selected passwords because they were ‘fun or interesting’ were at least a little more aware of what was going on. (In general, this isn’t a good attribute in a strong password.) This is a big aid in remembering your password, but that also creates the temptation to share it with others. And then there’s the risk that others also know that your cat’s name is ‘Precious’.

The detailed results of the survey are worthwhile and so is Kevin’s commentary.

The failure of passwords is because of human nature: we are driven to make things easy for ourselves. Good passwords require the opposite.

Peter L

Tags: , ,
Posted in News and Commentary, Passwords and Security | 1 Comment »

Take my personal data, please!

Monday, February 22nd, 2010

A site called Please Rob Me has been created to highlight the problem that most people don’t make the connection between personal information and security. People are putting way too much information online through twitter and social networks. Note that I said ‘information’ – not just stuff like credit card numbers and other private data. Announcing to the public that you are not at home is like having a ‘kick me’ sign on your back. It’s even worse, because you put the sign on back yourself!

A few years ago, there was a rash of burglaries in the Washington D.C. area. All of the burglaries happened in the fall during football season. It was discovered that all the homes that had been burglarized had received anonymous tickets to watch the Redskins play. Redskins tickets were really hard to get, so many of the people who got the tickets went to the game. The bad guys then watched the homes that had received tickets and waited as the homes cleared out for the afternoon. The bad guys figured out that paying even hundreds of dollars for each ticket was a cheap investment compared to what they could steal from the homes. Many people who should have thought twice about the free tickets, didn’t give it a second thought and opened themselves to being violated by the burglars.

Online security is about more than passwords and secure online ordering. YOU are responsible for your security. Pattern your online behavior after your face-to-face interactions and you’ll be safer.

Check out this article in the BBC.

Peter L

Tags: , , ,
Posted in News and Commentary, Passwords and Security | No Comments »

Good passwords and how to use them

Sunday, February 21st, 2010

More and more, we’re seeing attention being given to passwords and personal security. It seems obvious that passwords are an integral part of securing your personal data, but that part of the security message seems to have been glossed over until recently. Ever notice the strange looks you get from your friends or even the IT guy when they see you taking precautions to not reveal your passwords? If so, congratulations, you’re ahead of the curve on this one.

A lot of the recent articles and blogs are about creating really good passwords. Many of the ideas are sound: create a string of characters and numbers that you will remember but that can’t be easily guessed – not even by people who know you. Your password shouldn’t be a word or a set of consecutive numbers or letters, or a date, like your birth date or anniversary. (Since your pet’s name is presumably a word, it’s ruled out by default!)

So, now you have a great password – great! But what about the rest of the passwords you need for all those online accounts and applications? What’s that? You only have a couple. Really?

When I ask people about the number of passwords they have, most folks say something like ‘only a couple’, or ‘around 10’. No one ever says 30 or 50 – BUT when you ask them to really think about the number of email accounts (hotmail, yahoo, gmail, etc.), banks, e-commerce sites (amazon, zappos, Barnes & Noble, online department stores, and on and on), travel sites (Travelocity, orbitz, priceline, expedia, etc.) local and other government sites, not to mention blogs and other special interest sites, people are surprised to discover that they really have quite a few. Even your list just keeps getting longer and longer.

Keeping them all straight is a big part of safe password usage. That’s where the password manager comes in. It is very difficult to manage in your head all of the good and unique passwords that you’ll need for all of the sites you visit. If you are stressing and spending lots of energy hiding passwords in your datebook or in spreadsheets, you should consider Sticky Password. You’ll have a strong, unique password for each site and you’ll have access to them wherever you go.

Follow sound rules and create a strong password that you won’t forget and that no one is likely to guess: use that as your Master Password in Sticky Password. Let Sticky Password create and manage all your other passwords.

Peter L

Tags: , , ,
Posted in Passwords and Security | 2 Comments »

« Older Entries