Gwebs Cryptographer

Sarah Palin’s hacked Yahoo! Mail account is old news. But the sheer simplicity of the method used to gain access should still be of concern to every computer user.

Almost everyone knows a strong password is important. (Check out how to make an ultra-strong password in three steps.) However, even if you have a strong password, there are other ways to gain access to your accounts.

As Palin found out this past summer, the weakest link in account security isn’t the password itself, it’s the password reset mechanism. Many online accounts will allow users to reset their password by answering a few security questions. If a hacker answers those questions correctly, they can reset your password and gain complete access to your account.

Herbert Thompson, a writer at Scientific American, wrote an article detailing how he broke into an acquaintance’s online banking account using information that was freely available online. His first-hand account of strong-arming his way into sensitive financial information (with his friend’s permission, of course) made me question the security of all my online accounts. If it only took him a couple of hours to figure it out, how long would it take a professional hacker?

This could happen to you. Find out how to protect yourself from this security loop-hole.

Read more…

how to, passwords

Using a strong password is an important part of keeping your information secure. Even if you encrypt your data and email, using an easy-to-guess or machine-guessable encryption password makes encryption a completely moot point.

Creating a strong password doesn’t have to be hard. Making a strong password really is as simple as 1, 2, 3. Check it out.

Read more…

how to, passwords how to, password, password guessing

Facebook, if you didn’t know already, asks you for your email address and password when you create an account, or even if you don’t. It’s a highly visible link on their homepage. The stated reason is so that you can send invite letters to your contact list. And you can’t blame the peeps for trying, right? We all gots our hustle. It’s just that Facebook’s particular hustle leaves a lot of room for doubt. It could be Facebook doing exactly what they claim to do and nothing else, or it could be that the largest data mining company in the world is applying to email what Nigerian scammers have been doing with bank accounts for years.

But it’s also a royal pain in the tuches to have to invite every one of your friends to your social networking site manually, and with the importance of social networking sites to many businesses, people in fields that require a little publicity, and people who really like attention, this is a useful feature.

Which is why this article from blogger Dragon’s Flag caught our eye. It’s not just a plug for our product (although an independent testimonial to how awesome we are it certainly is), it’s also a fantastic little piece of know-how that makes you kick yourself for not thinking of it. And so here it is, translated for your edification:

On National Day (October 1st), 2007, I created a Facebook profile, and as part of the registration process, Facebook asked for my email account and password. To test if Facebook poses a threat to social networks by doing this, I gave them my password. I can hand out my password to pretty much anyone who asks for it, but can you?

My email address is dragonflag@gmail.com, and there are over 3000 emails inside. (Facebook supports most of the major services, including gmail, hotmail, live, yahoo, aol, etc.) Before uploading my password, I changed it to 123456.

I’m a longtime user of the notable Gwebs WebmailSafety software. I have more than 50 people in my address list there, and all the email we’ve sent back and forth is stored on Google’s servers is encrypted using a RSA+AES mixed cipher. I’m definitely not worried about Facebook searching or selling my email, because they can’t understand a word of it.

So after I gave my password to Facebook, those 50-odd received their invitation letters, and after 30 minutes I changed it back. Everything was alright, and now Facebook and don’t owe each other anything, nor do we have to be concerned about one another.

I also used the same method to register at the domestic (mainland Chinese) social networking site XING.com, without any apparent danger to my privacy or data. My advice when dealing with commercial web service companies like this is not to trust them lightly. Their promises to you don’t mean a thing, and it’s never a bad idea to have some basic self-protection in place.

So take my advice, especially if you’re one of those people who haven’t invited their email contacts because you’re afraid of your email being searched or revealed.

Italicized text added by translator.

Encrypting his email, we approve of, and using our product to do it, we approve of even more. But another important step he’s taken is:

Before uploading my password, I changed it to 123456…and after 30 minutes I changed it back

This is very important, because people are often predictable when they create passwords, and even if you use “rules” to create less breakable passwords and change them regularly, if someone gets a sample or two of your work, they can figure out your formula, and you’re right back where you started. Change your password to a no-brainer before giving it to someone, and change it back as soon as possible.

The best advice here, though, is not to let a company that makes its living by selling highly specialized user data to advertisers rummage through your inbox. Using Gwebs WebmailSafety; which is free, remember; or any of the other programs on the market means that your email is safe from advertisers as well as hackers.

Security, email, encryption, marketing, passwords, personal, privacy address book, data mining, email, encryption, Facebook, password guessing, privacy, XING.com

Cnet.com is running a news article on our fifth amendment rights entitled “Judge: Man Can’t be Forced to Divuldge Passphrase.” I thought this was noteworthy because, as I argued just last week, being forced to reveal passkeys is tantamount to self-incrimination.

encryption, government, law, passphrases, passwords

Today I was helping my mom setup new Gmail and AIM accounts, (now that gmail chat and AIM are linked, its essential to have an account on AIM and gmail, and to link them) and I was horrified to discover that she keeps all of her passwords, including her bank, email, credit card, web and domain hosting, and other crucial sites, in a word doc on the root of her laptop’s hard drive. AHHHHHA! What a recipe for disaster! “But what should I do?” she asked me. Her passwords are myriad, and all different (good), but she can remember none of them (bad!).

Here are several ways to keep your passwords safe (and the pitfalls):

1) Do like my mom, and keep all your passwords different, and in one “password file”, but encrypt that file with PGP, GWEBS WebmailSafety, or some other asymmetric encryption.

Pitfalls: A) You could forget your PGP password. B) You could lose your private key or your password file. C) Someone could steal your private key and your password file and guess your password. D) Someone could steal your password file and crack your private key.

Avoiding Pitfalls: A) Write down your pgp password somewhere, but don’t label it “PGP password” and keep it safe and long. B) Keep both a copy of your private key and your password file backed up and offsite, but not on someone else’s systems. C) Not likely, but again, you have to keep your password long and secure. D) Even less likely. Use a high bit rate algorithm. WebmailSafety, for example, uses 2048 bit RSA, and you would need to string together several of today’s most powerful supercomputers to crack that within your grandchildren’s life time.

2) Use a commercial password keeper, like Apple’s keychain or similar.

Pitfalls: these password keepers are only as secure as their implementations – and the user must decide which software to trust. Apparently Apple’s keychain is pretty secure, but you should always find out as much as you can about critical security software.

3) Use several passwords that you can remember, but different passwords on important or often-used sites. And never write any passwords down. For example Password A for email, password b for your online bank and password C for everything non-mission critical.

Pitfalls: The more you use a password, the less secure it is, and the more places you use, the less secure it is.

Avoiding pitfalls: For daily use and important passwords, choose long, strong, and hard to guess passwords, enter them manually and change them often. Daily use passwords are easy to remember because you are entering them all the time, and repetition breeds memories. Your non-mission critical passwords may be guessed, and if the intruder guesses one, they know them all, but again, these passwords are non mission critical, so this isn’t such a big problem.

Well, there are three solutions that I recommend. This is a big topic, so I look forward to user comments. Tell me what you do. How you keep your passwords secure, and if I missed some pitfalls, help me fill those in too!

PGP, passwords, personal, privacy encryption, IT, PGP, Security