Password Security Hard To Swallow

Passwords have to be the bane of modern life.  Along with Personal Identification Numbers (PINs) they must rank amongst the most evil of the necessarily evil  inventions known to mankind. 

Take PINs first - there's no end of people queuing up to take mine, judging by my spam folder.  I wouldn't mind, but I've just had one of those reminders from the bank - you know the one, asking who is banking with who?  Anyway, for something that has a mere ten thousand combinations, they don't half create some mayhem. 

We're encouraged to either use the number combinations provided by the card providers or to create our own while complying with some basic rules.  The first rule is to use the numbers provided by the card provider, for the simple reason that any guessable number combination is a pure coincidence.  To be fair, they are right and that's the best way to gather your card numbers, because mangling up your pet dog's date of birth is bound to become compromised sometime.

But we have so many of these darned cards these days and trying to remember all the relevant numbers for all of them is an almost impossible task.  In fact I tend to remember the shape rather than the numbers, so don't bother holding me up at knife point.  I might be able to draw you the PIN, if you get my drift, but it makes a mugging more like a game of Pictionary.  The weirdest number situation I found myself with a few years ago was two independent PINs sent by two separate banks that were identical.  I did run with those cards using the same PIN for a while, but inevitably one got compromised on PayPal and I forgot the other so now they are two completely different number sequences rattling around in my head along with all the others.

Then there's passwords.  General wisdom is at least eight characters, letter in mixed case, numbers and symbols, preferably a completely random collection.  Don't even think of writing them down anywhere, even in a code that GCHQ would struggle to crack, otherwise anything you use the password for is compromised and any losses are yours to absorb.  Don't forget to have a different password for each and every website you pass by now and then, plus your computer log in, that's right, those at work and at home.  And do change them at least once a month without reusing any.

I hate to point out that there are a finite number of such 8 digit passwords in the universe and currently I've used about half of them.

Google thinks there's a better way - well it seems clear that there are few worse options.  They've developed a tablet that interacts with your stomach acids to create a battery - that bit probably isn't too difficult although FDA registration is likely to be a bitch - they insist on a lot of documentation for anything like this.  I don't know if Google have considered the paper chase, but at least they've cracked the security, which is another FDA requirement.  Once the battery is up and running the pill uses the electricity to power an 18 bit code that can be used as a wireless password.  I'm guessing the pill interacts with some other part of the body's chemicals to create a unique signature but Google are being a little sketchy about that.  They don't mention how long the pill lasts for, either.  I don't fancy becoming a pill popping techno geek.  I don't even know what made Google think about Android tablets in the first place.

If popping pills isn't your idea of authentication fun - that sounds like some sort of adult party concept - then they've developed a method of authenticating using a tattoo.  For goodness sake, one minute we're told not to write the flipping things down, now Google want us to have them permanently painted on our ankles or butt.

Neither of these ideas are likely to feature in Google Android releases any time soon, according to the company - phew, I'm not sure I want 8 random letters, numbers and an obscure symbol that means infinity minus the number of cornflakes in my bowl this morning tattooed on a secure part of my body any more than I want to pop a pill every time I want to log onto my work account.

But Google do have one thing right in that we need to move on from collections of letters and numbers to authenticate our computers.  Conceivably our data is now more valuable than our savings and anyway the passwords and PINs give access to those anyway.  I'm not convinced I'll be slipping pills down my gullet any time soon but at least Google's thinking outside of the (pill) box.

------------------------------------------------------------------------------------

                                                          Visit my Book Website here

        Visit Project: Evil Website here                                        Visit DLF Website here

        Follow me on Twitter  - @RayASullivan

        Join me on Facebook -  use raysullivan.novels@yahoo.com to find me

Passwords Are Barking Up The Wrong Tree

There's an organisation called FIDO - yes, I know, it featured in at least one Scooby Doo episode and a couple of Tom and Jerry cartoons too - that wants to change the way we shop and interact generally with the internet.

You see, most on-line transactions are only relatively secure.  Sure, the retailers you use will have a secure server, there's encrypted messages and of course, your password.  I say password because most normal people have just the one, maybe two.  Because remembering Aunt Mabel's wedding anniversary and the title of the first film you ever saw in the cinema are difficult enough to remember.  Add another couple of random facts and your mind is going to meltdown.

In fact the industry would be rather pleased if everyone used passwords as complex as the one I've suggested - and if any wannabe hacker is looking up my family tree, I don't think I've ever had an Aunt Mabel.  I'd hate to waste your precious if illegally spent time.

But the reality is that remembering truly complex passwords - you know, random combinations of letters, numbers and punctuation marks - is hard work, especially if you have a lot of accounts out in cyberspace.  And it's not as though the holders of the secure servers have been immune to successful attacks over the last year or so.  Sony was hacked - that we know because they owned up.  There have been other high profile hacks recently, too.  My guess is not all organisations, when hacked, tell us.

This is where Michael Barratt, PayPal's Chief Information Officer comes in. Not content with working tirelessly at managing PayPal's information, he's also the president of the Fast Identity Online (FIDO) Alliance.

FIDO is keen to migrate us away from secure passwords because basically they're not really secure.  They note that while we may have a few very secure passwords we do have a habit of using them in a number of locations and therefore the password is only as secure as the least secure location.  They also realise that being mostly human, we'll continue to do this until we're all compromised.

So, what's better than a secure password?  No password, reckon FIDO.  They make the observation that most of us carry out our transactions on a limited number of devices - sure, you may hop onto a mate's iPad to bid for something on eBay once in a blue moon, but most of your online transactions will be on a finite and auditable number of computers.

They want us to migrate to FIDO enabled devices that use a combination of fingerprint matching, hardware tokens and USB memory sticks plus some trick software.  They've developed the standard and hope that FIDO enabled equipment will start shipping this year.

OK, details are necessarily scant, but for me I'm not wholly on-board.  I agree that passwords are an imperfect solution to the problem but I'm not convinced about the FIDO approach, either.  Fingerprints, while largely unique, are reproducible, hardware tokens sound like they will work until they won't, and that day will be the day I want to access my bank account, USB memory sticks are becoming persona non grata in many ways and software - don't talk to me about software.

There will be a way to solve this problem and biometrics will probably be part of it - as the FIDO fingerprint standard suggests - and I suspect that the solution will be simpler than the proposal.  I think FIDO do have a point about us using a finite number of devices and that insight is probably pure genius - maybe we will need a super password to access our stuff when away from any of our normal devices, but if a way of carrying out our transactions using our regular devices can be devised then that will make hacking harder.  After that it probably boils down to finding a sensible biometric we can use.  It may even be staring us in the face.

------------------------------------------------------------------------------------

                                                          Visit my Book Website here

        Visit Project: Evil Website here                                        Visit DLF Website here

        Follow me on Twitter  - @RayASullivan

        Join me on Facebook -  use raysullivan.novels@yahoo.com to find me

Has Yahoo Mail Been Hacked?

Just before logging off from my work computer the other day two emails dropped in, apparently sent from one of my Yahoo accounts.  Now I knew I hadn't emailed myself anything and any computers with my Yahoo email on were safely powered down at home.  So I guessed I'd been hacked.

By the time I got home I had a raft of legitimate emails from friends and family suggesting my account had been compromised and some reporting that the links embedded in the emails being sent out were being flagged by anti-virus programs as containing malware.  I also had an email apparently from Yahoo suggesting that someone in Italy had logged on to my mail account and suggested I use a link in the email to change my password.  I was relatively unconvinced by the Yahoo email as the address looked a little suspicious - the address was yahoo-inc from memory - so I deleted that one, although I now have reason to believe it was legitimate.  I deleted all suspect emails from my tablet, then hopped onto my laptop and changed my password.

Then when I mentioned this in work I discovered that other people I know, some in my address book, some who have never been near it, have experienced the same issue over the last month.  The only common denominator is that they have Yahoo accounts.  Some may have had easily hackable passwords - others, including myself, had suitably complex passwords.  Most now have much more complicated passwords to add a layer of difficulty for those who pass their time hacking accounts.

But was the account hacked at all?  Well, certainly somebody gained access to the account as they gleefully used it to email malware to persons in my address book.  However I'm unconvinced that the amount of persons I know locally who have had their Yahoo accounts compromised recently is a coincidence.  Perusal of the web suggests that since January there have been a lot of Yahoo customers who have had their accounts hacked.  My unproven theory is that Yahoo themselves have had their security breached.

It makes sense for a hacker to put in the extra work needed to compromise the likes of Yahoo rather than trying to crack individual accounts piecemeal.  Even if a hacked file is encrypted, it's one big job to break it rather than lots of smaller jobs to break into individual accounts.

It's a bit of a growth industry, this hacking lark.  And sometimes it seems that  the criminals don't even need to hack a password to slip malware into people's email.  I've had a run of 'comments' posted by anonymous visitors to this blog recently.  Apart from all being anonymous the other common thread has been the insertion of a link 'to their website'.  Some attempt to massage my ego with kind words and slip a link in at the end, others offer to help me improve my blog and slip a link in to supplement the unsolicited advice.  Now I'm assuming that these links might be suspect - there's no way I would ever click on an unsolicited link provided by an anonymous person  - and consequently I delete these comments along with their links from the blog.  Don't get me wrong - if you want to make a comment about the blog, even if it is unflattering advice, then I'm happy for it to be posted.  But don't slip a link on the end of the comment if you want me or anyone else to read your comments.  OK, I'll see the comment, but if the posting has a link then I'll ditch the whole kit and caboodle, in a heartbeat.  Apart from anything else, I don't want any reader of my blog inadvertently being infected or scammed as a result of reading my posting.

As a result of these tainted comments, I now moderate any comments before they hit the blog.

The obvious question I have been asked by some of the less tech savvy victims of these Yahoo hacks is about the purpose.  What are the hackers hoping to achieve?  Well, short of  trying one of the suspect links, I have to guess a little here, but my best guess is that the links either insert keystroke logging malware, or otherwise try to persuade the recipients of the emails to enter their personal details - you know, name, address, date of birth, ATM PIN, mother's maiden name, favourite bank (easy one that - none of them).  The second approach is called phishing, and it's attempted all the time, all over the place.

In fact, some kids in Alaska have just been caught out running a phishing scam at their school.  The thirteen and fourteen year olds, obviously smart, managed to send their teachers a phishing email that extracted the teachers' login details.  They then used that information to access the student records.  The scam worked because the teachers, who probably resist phishing attempts all the time at home, felt they were safe within the school network so their guard was down.

Which is why scammers like to send people in your address book phoney emails that look like they're from you.  Luckily most of these scammers aren't anywhere near as bright as the average Alaskan  school-kid - they've got a lot to learn from those kids who succeeded where many thankfully fail.

So if you have a Yahoo email account -including the alternative suffixes such as rocketmail - then there's reason to believe that your details may have been compromised.  My advice is to run, not walk, to your settings and change the password - make it complex enough to be hard to guess, use numbers, letters and symbols, but make it easy enough for you to remember when sober.  Me, I use number, letters not in the alphabet and a squiggle that represents infinity minus the date of my last dental appointment.  Hack that if you can (oh shit, my dentist reads this blog).  Of course, the compromise I experienced may have been a good old fashioned laborious hack of my password, trying random combinations of letters and numbers one-by-one, but given the number of people I know to have experienced the same recently, I'm not convinced.

If you have experienced your email account being hacked, please feel free to post a comment at the foot of the page.  But don't insert a link if you want anybody else to read it!

------------------------------------------------------------------------------------

                                                          Visit my Book Website here

        Visit Project: Evil Website here                                        Visit DLF Website here

        Follow me on Twitter  - @RayASullivan

        Join me on Facebook -  use raysullivan.novels@yahoo.com to find me