Security for Normal People, Part 5: Your Behavior

At the end of last week's article, I alluded to the idea that no software – anti-virus or otherwise – is going to mitigate your own bad behavior online. So what did I mean by that?

It occurs to me that there are things I do, or do not, do automatically because I know they are security risks. Now, having been online since . . . well, when I first got online, I was very young . . . Prodigy was still a thing (remember Prodigy? Anyone? Bueller?); being on CIS (CompuServe Information Systems) or GEnie (General Electric's answer to CIS) meant you were a geek (I was on both); modems were 1200 baud if you were lucky; Internet was dial-up only; and printers were dot matrix (ask your parents).

My point is that I've had a number of years to develop behaviors that are now so ingrained in me that I don't even think about them . . . behaviors that have kept me from having any major security issues. I've never had anything more serious happen than being infected with the odd virus every now and then, and much of that I owe to knowing what kind of behavior can be dangerous. It's a challenge to write this, since some of these things are completely unconscious at this point, but I'll give it a go. . . .

Be careful where you download from. You probably know this is important. But, though an anti-virus can alert you to problems once they've occurred, or warn you about risky behavior, it won't stop you from downloading that file or program. Why? Because if you want to download a new game or trial program, or whatever it might be, and your anti-virus tells you you can't, what is the first thing you'll do? Disable it! So then you have no protection. So the anti-virus will ask you if you are certain that you want to download it, it will warn you that it could give you a virus, but it won't stop you in the end. It's up to you to make sure that you're downloading from a reputable source, that the website is what it appears to be, and not a fake.

Be careful of fake sites that look like the real thing, and always check the URL (Uniform Resource Locator – also known as the website's address) to make certain it is genuine. If it says, ″www.yootoobe.com″ instead of ″www.youtube.com,″ you should run away! You'd be amazed at how many people don't notice, or worse, don't check. It's entirely possible to create a site that looks like the site you think you're visiting – logos, images and all – but is really a fake. This is particularly dangerous if it's your bank or other financial-related site. This is one place where spelling really does count! If you get an email from what you think is your bank, and it has a link, don't click on that link! If you look closely, what you think is a link to Wells Fargo may be a link to ″welsfargo.com″ - notice the spelling? Only one ″L″. It's the kind of thing that is easily-overlooked, and the Bad Guys know this. This type of link can be used to get you to log in to their fake site with your real password, which is then collected and used to drain your accounts. This is what is meant by, ″phishing.″

In fact, people so frequently are oblivious to this sort of ploy that some phishers, who are either lazy or cocky . . . or both . . . have even been known to use fake addresses like, ″www.hackyou.wellsfargo.com″ in the links they send out in emails. If it's hidden in an HTML email – since you don't see the actual link – you should be able to see it in the address bar if you click on it and it opens up a new tab or window. Which brings to mind a few more things you should not do: don't click on links in emails (with few exceptions), and don't use HTML mail.

Never click on links in emails; type the URL in yourself, from scratch. If your bank or other financial institution, or any other important site such as these, emails you, they shouldn't put links in the email; frankly, they should know better at this point. But if you really believe it's from who you think it's from, and you need to log in to your account, do not click on the link! I can't stress this enough! What you should do is to open a browser page and type in the address yourself. Yes, I realize that can be a little inconvenient, but it's much better than suddenly having no money in your account and no way to pay your mortgage or rent, let alone your bills, isn't it?

Don't use HTML Email. Most people, it seems, use HTML in their mail. I suppose that's because they don't know why they shouldn't. But if you use text-only in your email, for one thing, it can clue you in to a fake link like I've described above. If you can't see the links, you have no chance at all of spotting a fake. An HTML link to, say, Bank of America, can be hidden behind the familiar logo. In other words, you click on what appears to be a genuine Bank of America logo . . . and it probably is . . .genuine in that the Bad Guys downloaded it directly from the Bank of America website. And yes, that's easy. I can do it. (And I'm not even a hacker, I'm just a person with lots of experience on the 'net who knows what's possible – though I don't always know how it's possible. But this time I do know.)

HTML email also carries a greater risk of virus. I won't go into the technical details, because that's not what this series of articles is about. Suffice it to say that HTML email is more dangerous in this respect than text.

Other reasons to not use HTML email seem obvious to me, but you may not know about them. Firstly, it's often slow. Why? It requires more bandwidth. Now, this may not seem important to you when you're on your high-powered desk-top, but if you're on Wifi, or a mobile phone network, you might be able to see the difference. Secondly, it often takes longer to appear than regular text, because it takes longer to load. In other words, it just uses up resources unnecessarily. Thirdly, you may not have any problems composing an email in HTML, but think about the recipients. Not everyone needs or wants your email with fancy backgrounds and pretty colors. (Personally I have my settings so that only text appears unless I click to load the rest.) What's more, there are still a lot of email apps that won't even read HTML email.

In the end, it's up to you whether or not to use and read HTML email, but knowing that text email is less likely to be a security risk, I hope you give this question some thought: do you even really NEED anything more than text in your email?! Does it make that much of a difference to you? If you can't answer an unequivocal, ″YES!″ to those questions, I strongly advise you to turn it off.

Another thing that people – especially younger people who have grown up with the internet and mobile phones – do that they should probably be more careful about is giving out information. People simply overshare information . . . about themselves, about their families . . . about all kinds of things. Without going into great detail (that might eventually become another article itself), let me just say here that it would be wise, before you post something on Facebook or Google Plus or even Path, before you Pin or Tweet or Share, and especially before you Snapchat (because just because you think it will go away, doesn't mean it actually does) . . . to ask yourself: do I really want to put this out their for all the world to see? Because on the internet, that's what you're doing. Regardless of where you post or how private you think it is, the rule of thumb is to never post anything you wouldn't want on the front page of the New York Times.

Once again, it looks like this is running long. So tune in next week for more about how your behavior can affect your security . . . and why you should be suspicious!

Security for Normal People, Part 2: Security and Passwords

On first glance, passwords don't seem all that complicated. But too many people use their birthdays, their anniversaries, the names of their pets, or other such easily-hacked information, that an article for normal people – who may not have the experience that I do – about what makes a good password seems like a good idea.

The most commonly-used password, according to ZDnet, is: “password,” believe it or not. The second most common is: “123456.” Also on the list: “letmein,” “baseball,” “superman,” and “111111.”

What this tells us is that most people aren't terribly concerned with their passwords.

They should be.

Being hacked can lead to many problems, aside from the obvious having someone drain your bank account and purchasing expensive items on eBay or Amazon and sticking you with the bill.

Because, make no mistake, once someone has one of your passwords, they can also very likely get into your network and do all kinds of things that will affect you, not to mention your credit report, adversely. And then there's your computer. If someone gains access to your computer it can be used for all kinds of purposes – the most common being as a way to use your computer for what I will just refer to here as Bad Things.

I won't go into a great deal of detail here on what these things are, or how they are done, because that's not really the point. The point this: there are many Bad Things that can be done by devious people who can and will gain access to your computer, files, and/or network. You're just going to have to trust me on this.

The other point is that, though there are other things you can do to help protect yourself, creating good passwords are among the most basic. This is something easy that anyone can do; you don't have to be a computer whiz or a cryptographer, you just have to follow some basic advice.

Firstly, I'll give you the Don'ts:

Don't use any single dictionary word – i.e., any single word that can be found in a dictionary. There are programs that are capable of trying every word in a dictionary in an extremely short amount of time. This includes compound words as well

Don't use your birthday, your spouse's birthday, your children's birthdays, current phone numbers, pets' names, current addresses, social security numbers, credit card numbers, or any other piece of information that is either easily obtained, easily guessed, common, secret, or discoverable – and when I say, “easily,” I mean by people who have abilities or access to things you probably don't have access to, most likely because they've hacked a database that this information is in.

Don't use words related to your favorite fandom, which is to say, if you're a Star Wars fan, don't use things like, “lightsaber,” “Jedi,” or “theforce,” or any other word or catch-phrase from or related to Star Wars. The same thing goes for Star Trek, Game of Thrones, Harry Potter, Grimm, Lost Girl, or any similar universe that has its own vocabulary. And while I'm on the subject, don't use words in Klingon, Castithian, Dothraki, or any other language that is made up for a Science Fiction or Fantasy universe. The same rule that applies to dictionary words applies to these; there are hackers who can run through an entire Klingon dictionary in a very short time, too. Amazing, I know, but true, nevertheless. You'll just have to take my word on this.

And by now you're probably thinking, “What's left?”

So, now I'll tell you how to make good, secure passwords. There are a number of strategies, any one of which (or combination thereof) will help you come up with solid passwords.

Firstly, the longer a password is, the harder it is to crack. While many sites will only let you do eight characters, some will allow you to create much longer ones. I'd say that unless you've got highly sensitive information or are security-conscious to the point of paranoia, usually somewhere between 8 and 16 characters is sufficient. (If you're using a password locker, such as LastPass, you might just want to use the password creation function and set it to 16 characters.)

Other things that make passwords stronger are including both upper- and lower-case characters, numbers, and special characters (such as $ or %, and so forth). Or, better yet, all of the above. The more of these things you include, the harder it is to discover your password. If you use a mnemonic method (or even if you don't), which often won't include special characters or numbers, you can also add a little something additional to all passwords, like, for instance, the phone number or zip code from where you lived as a kid (of course, if you inherit your parents' house, you might have to come up with something else).

So, knowing what makes a password stronger gives you several ways to create passwords. . . .

1. Use three short dictionary words that are unrelated, connected with or interrupted by upper- and lower-case letters, numbers, and/or special characters. For example:

bear!Arm53soccer is good, though if you want go a little further: be2ar!Arm53soc7cer is even better.

Which may be hard to crack, but may also be a little difficult to remember. (Though you might come up with some weird memory trick even for unrelated words like this: “If the bear ate my arm, I'd miss the soccer game.”) So, a couple of strategies that may make remembering your passwords a little easier. . . .

2. Use a mnemonic device to create your passwords, such as the first letters of a line of a song, or a quotation, using capital letters, for, say all nouns (or any other part of speech you like), for example, using this technique, taking the first line of Edgar Allan Poe's “The Raven,” and capitalizing the letters that represent nouns, you would get, “ouaMdwIpwaw,” which may not roll off your fingers, but is reproducible, as long as you know the poem. Of course, there are no numbers or special characters in this, so as I mentioned above, if you add your childhood zip code, and you're from Boston, you might get, “ouaMdwIpwaw02134,” which is probably pretty hard to crack.

3. Make up your own word, then add capital letter(s), numbers, and special characters. So, I just made up a word, “suvavatinz.” I know it's not a word because I just Googled it. If you include less-frequently-used letters in your word, like z, or q, in your made-up word, so much the better. But now, add a cap or two and an old phone number, and you wind up with “suVaVatiNz9084873311,” and that's pretty hard to figure out, too. A good way to remember your made-up word, though, is to give it a meaning that makes sense to you – in this case, it sounds like a competitor to No Doz to me.

You can mix and match these methods, but by now you probably get the idea now how to go about making up your own relatively secure passwords.

There are a few other things you should think about doing for basic computer and Internet security, in addition to mobile phone precautions and good passwords, so I'll do a separate article about those. . . .

Security for Normal People, Part 1: Security and Phones

Firstly I must apologize for my long absence here.  I've just been extremely busy with some great new clients.  However, one of my clients had an experience recently that made me think that I should write a little about security in general, and mobile phones in particular.

What happened to that client is that their smart phone was stolen. It's something we all dread, we all think will never happen to us, and therefore, something most of us don't prepare for.

So here are a few recommendations that I'll be making to my clients . . . all of them, because frankly, everyone should know these, but not everyone does.

Firstly, most smart phones come with the ability to set a combination or screen-lock of some sort, which is the first line of defense. Mine is an Android, and has one built-in, located in Menu/Settings/Location & Security. This particular one uses dots and you create a pattern sliding your finger through them. I'm sure that both BlackBerrys and iPhones both have some version of this kind of screen-lock, and if it doesn't come with it (like my previous Android didn't), you can most likely download a free app that does this.

Next, if you have any confidential data that is accessible on your phone, it should absolutely be password-protected. And under no circumstances should you EVER leave the, “keep me logged-in” box checked. It might be a pain to keep typing in the password on your bank app, but trust me that you'll be very glad you did if your phone is lost or stolen.

I think it should go without saying that you should be careful who you trust with your phone, as well as any confidential information. I also have a client who showed a college assignment file to a classmate they thought trustworthy, only to have a good portion of their work stolen and presented as the work of the thief, thus also getting my good-natured client in trouble as well.

You should also obviously be extremely careful with regards to passwords. Please, don't keep your passwords on a sticky-note on your desk. If they're so hard to remember that you need to do that, then they're too complicated; the whole purpose is defeated. At the same time, you need to keep track of them, and you shouldn't really use them for more than one account. I know, I know . . . who can come up with – let alone remember – the number of passwords you'll need, if you use a distinct password for each account?

So what you really need is one of two things. The first would be a place you can keep your passwords written down that is not accessible online (don't put a file called “passwords.doc” on your desktop – and yes, I actually know of more than one person who did this!). This would be a low-tech solution, such as a notebook that is stored someplace secure, but that you can access yourself, like in a journal mixed in with a bunch of other books on your shelves. If you have something offline like this, it means no one can hack into your home network and retrieve them. It also means that you're going to have to remember the ones you need most often, and that, if you need a less-frequently-used password, and you're not home, you're out of luck (or you have to have someone else you trust know where to look for them). But on the plus side, it won't be wiped out if you get a virus and have to suddenly reformat your hard drive.

The other option is to use a password “vault” program, such as LastPass (the only one I've used thus far, which is recommended by Leo LaPorte, The Tech Guy, and Steve Gibson of Gibson Research Corporation, though I'm sure there are other ones that are equally good). The basic idea of these is that they record and encrypt your passwords and then you no longer need to remember one for each site . . . you need only remember one: your Master Password. LastPass (and probably others) will also create a random string of characters as a password if you tell it to, and use a different one for each site, which is extremely hard to crack. Remember the client whose phone was stolen? I signed them up for LastPass. The one thing you need to remember is to NEVER, UNDER ANY CIRCUMSTANCES, SHOULD YOU CHECK THE BOX THAT SAYS “KEEP ME SIGNED IN,” in LastPass, or you've just negated all that work you just did setting up the program. Not to mention making yourself just as much or possibly even more vulnerable than you were without LastPass.

Also be extremely careful with whom you share your passwords, because if you ever do reuse them for more than one site or program, and you give out, say, the password to your Facebook account, so a friend can post photos for you, and you've reused that password, what's to say that “friend” won't try to get into Amazon or some other store site where you've stored your credit card information? If the passwords are the same, not only have you just bought your so-called friend some new tech, but who knows what else?

If you have to share an account for any reason, before you give your account name and password out, check to see if there's a sub-account you might be able to set up, in order to maintain ultimate control over that account. (Also, never, ever give any account information to your employer or potential employer. Aside from being an invasion of privacy, it's also against the End User License Agreement, which means that account could be canceled for no other reason than that.)

This is where something called Two Factor Authentication (or Multi Factor Authentication) comes in. Even if you have to share a password, if you have this, it helps protect you. This is when you create a password, and then are asked for your alternate email address, phone number, and possibly to select and complete security questions like, “What was the make and model of the first car you owned?” or, “Who was your first girlfriend/boyfriend?” or even, “What was the name of your third-grade teacher?” Don't ignore these! They're there to help you; take them seriously! (You can and should make up the answers, as long as the answers are something you will remember. I never use my mother's maiden name or other such easily-obtained information.) So if someone steals your phone and tries to change your bank password, and your phone gets the text message with the verification code, you may also get an email alerting you to the fact that someone is trying to tamper with your account, so you can take appropriate action. In the meantime, the person with your cell phone still may be trying to answer some question like, “Who was your favorite singer in high school?”

Now, if your phone does go missing, there are several ways to approach it. If you think you just left it somewhere in your daily travels, or, as I have done more than once, had it fall out of your pocket in your car, the first thing to do is call it, and see if you hear your ringtone. But if you think it's actually been stolen, may want to track it (there are apps that will allow you to do that; I believe all iPhones have that installed by default), you may want to call your phone company and have it disabled, or you may use software you previously installed (yes, there's an app for this, too) to brick it, or wipe the entire phone, thus rendering it as useless as a brick.

I have some advice on passwords and other security measures as well, but they can take up their own articles, so I'll deal with them separately.

The whole point here is that you really need to set things up ahead of time. You need to set up the apps for screen-lock, phone location, or wiping your phone now, before anything can happen. You need to be careful to whom you give access to your mobile phone and your passwords. You need to set up Multi Factor Authentication on any account with confidential or financial information. Basically, you need to prepare for the worst and then, if you're lucky, you will never have to use any of these tools. The best time for this is when you get a new phone, because you're setting everything up anyway. But if you're reading this and you haven't really given much thought to this, start with the easiest thing (the screen-lock) and work on the rest as time allows. 

 You can thank me later.

Update: 6/23/13: I've just found an Android app called "Lookout" that's supposed to protect your (Android) mobile phone by detecting malware and allow you to track your phone, and even wipe it if need be.  I'm installing it right now.  At some future point I will probably post more about it, once I've lived with it a while.  Watch this blog!