PasswordS Can Save Your Identity

I highly recommend Dashlane to remember and generate passwords.  It uses a master password to protect the logins you have programmed into Dashlane, and then will automatically log you into your websites regardless of which browser you use.

Droid lawyer: A Simple Password Change Can Save Your Identity

by Jeffrey Taylor

It’s one of the hottest industries online and one almost guaranteed to make you more money than you ever dreamed of… as long as you’re willing to risk the price. This is the lure that turns thousands of unscrupulous people into identity thieves each year. In 2012, more than 12 million people were victims of identity fraud, and many of them had no idea how to prevent this crime from happening to them. When it comes to crime prevention, it’s often the simple things that work the best: locking a door, hiding your valuables, and even creating a more secure password for the sites you frequent online.

If it’s memorable, it’s bad

If it’s too much work thinking up elaborate passwords for every site you frequent, you’ve probably got one or two go-to passwords that are easy to remember. Your daughter’s birthday, your childhood address, or your first pet’s name are common examples of simple passwords. The problem is that, although they may be easy to remember, they’re even easier for thieves to find out. One look through your online history, and identity thieves have dozens of possible password phrase ideas based on your interests and past, ready to try out.

The best way to make a secure password is to begin with words that seemingly have nothing to do with your life. Think of a sentence that applies to each site you visit. For your credit union, it may be “I go to First Branch Credit Union every Friday at 3pm.” Use the first initial of each word to create a password, like this: IgtFBCUeF@3pm. Simple to remember, but almost impossible to figure out. Check out this post for more on the importance passphrases.

Make Them Unique

If an identity thief somehow manages to figure out one of your passwords, make it harder for them to access all your information. Create a separate password for every site you frequent. Financial sites, business sites, email, and even social media accounts all hold personal information that can be used against you. Set up a new and unique password every time you join a new site. Google has a great Good To Know page on the best ways to secure your password.

Go automated

If you feel unsure about making random lists of letters and numbers that a thief might somehow hack, find one of the online random password generators and rely on that to create a series of passwords for you. These free sites will create passwords of meaningless strings of numbers, letters, and punctuation specifically designed to be used as passwords. They’re free, the password is never saved, and you can find as many passwords as you need instantly.

Beyond passwords

Creating unique and secure passwords are a great start to online security, but they do no good unless you practice basic internet safety. Never give your password to anyone else. Write the passwords down in an address book or other offline spot away from your computer. Consider using an identity protection service as an added layer of protection above the passwords. Install a malware program on your computer to avoid people from remotely accessing your passwords. And finally, never click on a link in an email, even if it looks like it’s from a legitimate site. Type in the correct address in your browser to go to the site, instead.

With a little diligence and some design, you can make sure you’re a lot safe when you’re online.

5 Ways a Hacker can Crack Your Password

Palindrome Consulting Blog: 5 Ways a Hacker can Crack Your Password

 

All that stands between a hacker and your sensitive information is one puny password. You may think that your password is uncrackable because it has served you well all these years, but the reality of the situation is that an experienced hacker can break almost any password. Here are the most popular methods.

Dictionary Attack
One reason why you don’t want to use simple words when creating a password is because several hackers use software that automatically tries the most commonly used passwords (like “password”), and there are additional hacking programs that can quickly try all the words in the dictionary.

Brute Force Attack
A brute force attack is like a dictionary attack taken to the next level because it goes beyond known and popular words by trying every possible alpha-numeric combination possible, like “aaa1” all the way to “zzz10”. To help clarify what you’re likely envisioning, attacks like this don’t equate to a shady dude sitting at a computer going down a list and entering in the every potential password one at a time. Instead, hackers employ advanced tools that can plug in thousands, millions, or even billions of word combinations per second.

In fact, in brute force attacks, hackers are only limited by their computers’ processing power. For example, a hacker using a single graphics processor like a high performance AMD Radeon HD7970, along with an advanced password-cracking algorithm can try 8.2 billion password combinations per second (and that’s just with one computer). If a hacker installed a couple extra GPUS then they can increase their speeds by up to three times.

Guessing
A hacker attempting to guess a user’s password is likely not a malicious hacking group working remotely with powerful software, instead, a hacker trying the guessing method is typically somebody that knows you well enough to try plugging in the names of your kids and pets into the password form. Don’t underestimate your “friends”. Getting hacked by someone you know can be just as destructive as getting hacked by an anonymous user on the web, except it’s worse because you will feel the pain that comes with betrayal.

Social Engineering
A hacker is able to remove the guess work by employing a method called social engineering. This is where a hacker will resort to trickery to get the password from an unsuspecting user. One example of social engineering is when a hacker calls your company posing as your IT service provider and asks you for your password. At Palindrome Consulting, we would never call you out of the blue just to ask for your password, and we strive to maintain a strong working relationship with our clients so that you will know for sure it’s us calling you. If you’re not sure it’s us on the line, you can ask specific questions that only we would know the answer to.

Shoulder Surfing
Beware of entering your password with someone looking over your shoulder. This is more of a threat for companies that have several employees wearing uniforms. Working in these companies are used to seeing coworkers walk around the office that they may have never seen before. Surfers can obtain passwords in more ways than just looking over your shoulders; they can also rummage through your desk and find the piece of paper that has all your passwords written down on it.

Fortunately, hackers primarily target accounts with weak security or users that aren’t careful with keeping track of their passwords. You can protect your accounts by implementing solid strategies to protect your network’s security, and by coupling it with the latest and greatest security solutions available.

One comprehensive security solution that Palindrome Consulting offers is our Unified Threat Management (UTM) tool that covers all of your network security bases. Even if you engage a UTM solution, you will still want to educate your employees on solid practices like how to store passwords digitally instead of using Post-it notes. To learn more about UTM, best practices in password creation, and network security, give us a call at 305-944-7300.

Two-factor authentication: What you need to know (FAQ)

Two-factor authentication: What you need to know (FAQ)

Twitter just got it. Apple recently got it, too. Google, Microsoft, Facebook, and Amazon have had it for a while. But why's two-factor authentication important, and will it keep you safe?

by Seth Rosenblatt

Twitter announced Wednesday that it has started supporting two-factor authentication, joining a growing list of major Web services that offer the more secure log-in method.

Two-factor authentication, or 2FA as it's commonly abbreviated, adds an extra step to your basic log-in procedure. Without 2FA, you enter in your username and password, and then you're done. The password is your single factor of authentication. The second factor makes your account more secure, in theory.

---

How to enable two-factor authentication for:

• LinkedIn
• Twitter
• Microsoft
• Apple
• Google
• Dropbox
• For popular sites

---

"Twitter made the decision to use SMS [to deliver its second factor] because it makes sense from their position," said Jon Oberheide, chief technology officer of Duo Security, which uses apps to prove identity. SMS is "universal in some respects, all you need is a mobile phone."

But Twitter has faced some backlash, he said, because many of the highest-profile Twitter hacks have been against corporate Twitter accounts.

"Two-factor authentication does help, but Twitter is a high-value target, and it needs to be protected like one," said Jim Fenton, chief security officer at OneID, an enterprise password replacement system.

Here's a rundown of what two-factor authentication is, how it can work for you, and what its limitations are.

What is two-factor authentication?
Two-factor authentication adds a second level of authentication to an account log in. When you have to enter only your username and one password, that's considered a single-factor authentication. 2FA requires the user to have two out of three types of credentials before being able to access an account. The three types are:

Something you know, such as a Personal Identification Number (PIN), password, or a pattern

Something you have, such as an ATM card, phone, or fob

Something you are, such as a biometric like a fingerprint or voice print

How old is two-factor authentication?
Older than life itself.

OK, not really. But 2FA is nothing new. When you use your credit card and you must enter in your ZIP code to confirm a charge, that's an example of 2FA in action. You must provide a physical factor, the card, and a knowledge factor, the ZIP code.

But just because it's been around for a long time doesn't mean that it's easy to set up and use.

Wait, it's hard to use?
It definitely adds an extra step to your log-in process, and depending on how the account vendor, such as Twitter, has implemented it, it can be a minor inconvenience or a major pain. Much also depends on your patience and your willingness to spend the extra time to ensure a higher level of security.

Fenton said that while two-factor authentication makes it harder to log in, it's not "hugely" more so.

"An attacker might be able to collect a cookie or an OAuth token from a Web site and essentially take over their session," he said. "So, 2FA is a good thing, but it does make the user experience more complicated...It's done when you're logging into an account on your device for the first time, for example."

Will two-factor authentication protect me?
Well, that's a loaded question when it comes to security.

It's true that two-factor authentication is not impervious to hackers. One of the most high-profile cases of a compromised two-factor system occurred in 2011, when security company RSA revealed that its SecurID authentication tokens had been hacked.

Fenton explained both sides of the effectiveness problem. "The thing that concerns me as a security guy is that people don't look at what the cause of the threats might be. 2FA mitigates the problems, but a lot of awful attacks can run on 2FA."

At the same time, he said, two-factor offered more protection than logging in without it. "When you make an attack harder, you're disabling a certain subset of the hacker community," he said.

How is 2FA vulnerable to hackers?
To hack two-factor authentication, the bad guys must acquire either the physical component of the log-in, or must gain access to the cookies or tokens placed on the device by the authentication mechanism. This can happen in several ways, including a phishing attack, malware, or credit card-reader skimming. There is a another way, however: account recovery.

An RSA SecurID key fob.

(Credit: Via Wikimedia Commons)

If you remember what happened to journalist Mat Honan, his accounts were compromised by leveraging the "account recovery" feature. Account recovery resets your current password and e-mails you a temporary one so that you can log in again.

"One of the biggest problems that's not adequately solved is recovery," said Duo Security's Oberheide.

Account recovery works as a tool for breaking two-factor authentication because it "bypasses" 2FA entirely, Fenton explained. "Just after [the Honan story was published], I created a Google account, created 2FA on it, then pretended to lose my data."

Fenton continued: "Account recovery took some extra time, but three days later I got an e-mail helpfully explaining that 2FA had been disabled on my account." After that, he was able to log back into the account without 2FA.

Account recovery is not a problem without a solution, though. Or, at least, solutions are being worked on.

"I see biometrics as an interesting way to solve the recovery problem," Oberheide said. "If I lost my phone, it would take forever to go through each account and recover them. If there's a very strong biometric recovery method, a passcode of my choosing, and a voice challenge or something like that, it becomes a very reasonable and usable recovery mechanism."

Basically, he's suggesting using one form of two-factor for logging in, and a second, different two-factor combo for recovery.

What's next for 2FA?
As two-factor authentication becomes more commonplace, it's more likely that attacks will be more successful against it. That's the nature of computer security. But by virtue of being more commonplace, it will become easier to use, too.

Oberheide said that many of his customers start off thinking that implementing 2FA will be expensive or hard to use, but often find that their experience with it is the opposite.

"I think that will come faster in the consumer space because they're not dealing with all this cruft from the legacy of 2FA from the '80s," he said. But he noted that older systems can have a hard time getting 2FA going. "A few months ago, we published the bypass of Google's two-factor scheme," he explained. "It's not a ding against two-factor in general, but against Google's complicated legacy system."

Fenton noted that increased adoption could create opportunities to refine the technology. "Should we be planning now on designing something that can scale to large numbers of sites? It seems that 2FA is really exploding right now," he said.

Despite its problems, Oberheide sounded an optimistic tone for two-factor authentication. "If we can increase the security and usability of 2FA at the same time, that's a holy grail that's often difficult to achieve," he said.

Two-factor authentication: What you need to know (FAQ) | Security & Privacy - CNET News

DASHLANE RememberS YOUR Passwords

Remember All Those Passwords? No Need

60 Seconds With Pogue: Dashlane: David Pogue on the convenience and security of Dashlane, a free password manager.

By DAVID POGUE

“If you want to avoid having your identity stolen, use long passwords that contain digits, punctuation and no recognizable words. Make up a different password for every Web site. And change all of your passwords every 30 days.”

Have these security pundits ever listened to themselves?

That advice is clearly unfollowable. I currently have account names and passwords for 87 Web sites (banks, airlines, blogs, shopping, e-mail, Facebook, Twitter). How is anyone — even a security professional — supposed to memorize 87 long, complex password strings, let alone remember which goes with which Web site?

So most people use the same password over and over again, and live with the guilt.

There are solutions. Most Mac and Windows Web browsers now offer to memorize passwords for you. But that feature doesn’t work on all Web sites, and is generally of little help when you pick up your phone or tablet. At that point, the only person you’ve locked out of all your online accounts is you.

The only decent solution is to install a dedicated password memorization program (like Roboform, KeePass, LastPass, 1Password, and so on). Last week, one of the best was just improved: Dashlane, now at 2.0. It’s attractive, effective, loaded with timesaving features and available for Mac, Windows, iPhone and Android — and it’s free.

Installation is quick. Dashlane works in Safari, Chrome, Internet Explorer and Firefox. It can import existing password “vaults” from rival programs.

Dashlane has two primary features. First, yes, it’s a password memorizer. Every time you type your account name and password into a Web page and press enter, Dashlane pops up, offering to memorize that information and fill it in the next time.

In fact, it also offers to log you in — not just to enter your password, but also to click “log in” for you. In effect, Dashlane has just removed the login blockade entirely. When you go to Facebook, Twitter or Gmail, you just click your bookmark, smile at the briefest flash of the login screen and arrive at the site.

Since Dashlane is now storing and auto-entering your passwords, you’re now free to follow the security experts’ advice. You can make up long, unguessable passwords — a different one for every Web site, since you don’t have to remember any of them. In fact, each time you sign up for a new account, Dashlane offers to make up such a password for you, and then, of course, to memorize it.

Dashlane’s second huge feature is even more amazing. It can also fill in other kinds of Web site forms: your name/address/phone number, and even your credit card information.

When you’re buying something online, and you click into the credit card number box, Dashlane displays pictures of your credit cards: Visa, MasterCard, American Express or whatever — even PayPal.

When you click the one you want to use, Dashlane instantly fills in the long card number, your name, the expiration date, even that accursed security code, in the right boxes. Every time you order something online, you save between 30 seconds and five minutes, depending on whether you have your card information memorized or have to go burrow through your wallet.

When you make a purchase, Dashlane even offers to store all the details in a digital receipt that you can call up later, along with a screenshot of the Web site where you shopped. This feature makes online shopping so frictionless, every dot-com retailer on earth ought to be promoting Dashlane as if its profits depended on it.

In fact, Dashlane can fill in all kinds of forms automatically: phone numbers, job titles, tax numbers and so on. If you’ve ever recorded multiple answers — you have two different Twitter accounts, say — two tidy buttons appear beneath the name box, bearing the account names. Click the one you want.

Unlike some rival programs, Dashlane doesn’t require you to associate one set of personal information to each “profile.” If you have three addresses, for example, you’re always offered those three when filling in a form. You don’t have to create three personalities’ worth of personal information.

So far, Dashlane probably seems designed for convenience, and that’s true. Behind the scenes, of course, its ultimate goal is security.

No system is foolproof. But Dashlane notes that it doesn’t ever see your passwords or your credit card information. They’re all stored on your own computer, encoded by the AES-256 encryption method, an open-source standard approved by the National Security Agency. Your entire Dashlane universe is protected by a master password. It’s intended to prevent a laptop thief from heading online with your missing computer and going on a shopping spree.

In version 2.0, furthermore, you have the option of using two-factor authentication — fancy lingo for an extra layer of security. To unlock Dashlane, you have to enter your master password as well as a code that Dashlane texts to your phone. It’s a pain, yes, but it effectively ruins the day of any ne’er-do-well who was hoping to guess or steal your master password.

Version 2.0 also introduces a convenient security dashboard, which identifies reused and weak passwords. It also eliminates the baffling points system of 1.0, which rewarded you for logging into Web sites. Thank goodness. There are iPhone and Android phone versions of Dashlane — also free and also fantastic.

The other big change in Dashlane 2.0 isn’t quite so joyous. True, Dashlane can wirelessly synchronize all your passwords between your computer and phone, so that the phone, too, automatically enters them as you surf. But in 2.0, that feature now costs $20 a year. (It used to be free, and still is if you used earlier versions of Dashlane. The company does urge the earlier Dashlane fan to make a one-time contribution — $40 seems to be its favorite suggestion.)

An annual fee? Really? That seems a steep charge by a company that, until now, seemed remarkably customer-friendly. Alas, that seems to be the model these days. Dashlane’s archrival LastPass is also free for Mac and Windows computers, and also stores your credit card and other information. But to use LastPass on a phone, you have to pay $12 a year.

Still, Dashlane is much better looking, better designed and easier to use. To fill in credit card information, for example, LastPass requires you to choose a “Choose Profile and Credit Card” command from a menu. Dashlane saves you one step and six pounds of terminology.

It’s not perfect. Each time Dashlane stores a password for you, it also nudges you to put it into a category (e-mail or social media, for instance) and associate it with one of your e-mail addresses. The company says that all of that paperwork is only a convenience — you can click right past it — but it’s still a befuddlement every time.

Now and then, I found a Web site that Dashlane couldn’t auto-log into, too.

And Dashlane doesn’t work in the built-in browser on the iPhone. (No password keeper can, Dashlane says, thanks to Apple’s rigid programming rules.) Instead, it offers its own little iPhone browser. (The Dashlane app for Android also has its own built-in browser now.) It’s fast, it’s almost exactly like Safari and it auto-fills all the Dashlane-ish stuff, but it’s more trouble to find and open.

Still, complaining more than briefly about Dashlane’s drawbacks is like grumbling about the taxes when you win the lottery. It saves you infinite time and hassle, it’s (mostly) free, and it belongs on your computer and phone this very day.

Remember All Those Passwords? No Need - NYTimes.com

Email VIRUS Infections

HTG Explains: Why You Can’t Get Infected Just By Opening an Email (and When You Can)

Email viruses are real, but computers aren’t infected just by opening emails anymore. Just opening an email to view it is safe – although attachments can still be dangerous to open.

Past security problems with Microsoft Outlook resulted in a lot of damage, and some people still believe that just opening an email is dangerous. This isn’t true.

Why Opening an Email is Safe

Emails are essentially text or HTML documents (web pages). Just like opening a text file or web page in your browser should be safe, opening an email message should also be safe. Whether you are using Hotmail, Gmail, Yahoo Mail, Outlook, Thunderbird, or another web-based or desktop email client, opening an email – even a suspicious looking one – should be safe.

However, some emails may try to infect you after you open them. They may contain malicious programs as attachments or have links to malicious websites full of malware and scams. You should only run trustworthy attachments – even if someone you trust sends you file attachment with a .exe file or another program file, you probably should not open it. They may be compromised.

As with everything on the web, you shouldn’t run programs that try to automatically download onto your computer after you click a link.

Why Opening Emails Was Once Unsafe

In the past, Microsoft Outlook had a serious security problem. Emails – which were once just plain text – are also allowed to contain HTML code: the same code that web pages like this one are written in. An Outlook vulnerability allowed emails to run JavaScript code and infect your computer. For this reason, just opening an email was potentially dangerous.

However, this vulnerability was fixed. Emails cannot use JavaScript. Modern email clients don’t even automatically display images in emails. As with web browsers, operating systems, and other computer programs, security holes are occasionally discovered and patched.

As long as you are using up-to-date software – including your mail client, browser, browser plugins, and operating system – you should be able to open email messages and view them without fear.

Email Safety Tips

File attachments and links in email can still present danger. Follow these best practices to stay safe:

• Keep Your Mail Client, Web Browser, and Operating System Updated: Software updates are important, as the bad guys regularly find holes and try to exploit them. Software updates close these holes and protect you. If you are running an outdated browser and email client, you could be compromised. (If you have Java installed, you should uninstall it or at least disable the browser plugin to protect yourself, too.)
• Use Antivirus Software: On Windows, antivirus software is an important layer of protection. It can help protect you from both mistakes and software bugs that allow malware to run without your permission.
• Don’t Run Dangerous Attachments: If you get a PDF file from someone, it’s probably safe to open (especially if your PDF reader is up-to-date). However, if you suddenly get an email with a .exe file or another potentially dangerous type of file you aren’t expecting – even if it’s from someone you know – you probably shouldn’t run the attachment. Exercise extreme caution with email attachments – they are still a common source of infection.
• Be Careful of Links: Clicking links should be safe, just as loading a website in your browser should be safe. However, if the link looks like it leads to a site packed with malware and acai berry scams, you probably shouldn’t click it. If you do click a link, don’t download and run any potentially dangerous files. You should also watch out for phishing – if you click a link in an email that appears to be from your bank and end up on a similar-looking website, it may not actually be your bank’s website, but a clever imposter.

For more information about dangerous phishing emails, read Online Security: Breaking Down the Anatomy of a Phishing Email.

---

There are a variety of problems you could encounter with email: dangerous file attachments, scams that try to take your money, phishing emails that attempt to steal your personal data, and links to dangerous websites. However, just opening an email shouldn’t cause any problems.