The Cryptographer | AOL | The Cryptographer

Again the great password scandal - Are users lack of common sense?

October 19th, 2009

2 comments

Almost every week I can read news about smaller or bigger scandals about passwords or private data exposures. What’s wrong with today’s users ? Lack of common sense or are people just getting more and more stupid ? So many times I have faced these situations that someone is asking my email address and password, just for checking my address book. Or then the Microsoft Messenger trick “See who have blocked you from their MSN”. Or the one with credit card number “So many credit card numbers are exposed, check if your one is on the list”.

Come on, how easy can average user really be ?
I really think that people are getting more and more reliable on internet and all the services, but they really cannot see that there are also thiefs and other “bad people” around. So many of us are thinking that of course it’s safe, because it’s somehow related to service what user is using. But at the same time on the streets when someone is humbly asking to borrow their phone they get scared that the person will steal it or use it for illegal activities. Why this question never comes into their minds when acting in internet ?

At this time, a bit more than a week ago, Google’s Gmail and Yahoo’s Mail were also targeted by a large-scale phishing attack, perhaps the same one that harvested at least 10,000 passwords from Microsoft’s Windows Live Hotmail, according to a report by the BBC.

The BBC also said it has seen a list of some 20,000 hijacked e-mail accounts; the list included accounts from Gmail, Yahoo Mail, AOL, Comcast and EarthLink. The latter two are major U.S. Internet service providers.

I assume that when people are reading these news, they are first over sensitive, maybe one week, after that paying attention what they do online and where they use their passwords, max. one month. And after this, they start acting like before. Maybe that one month they haven’t seen any progress of safety or increased privacy, so “it’s okay to continue the old style, no-one is interested about MY emails and passwords“. But this way of thinking is just that what might lead to scandals. Everyone’s email account is interesting, not necessarily the emails or the content itself, but all Your addresses, contacts, your passwords and login info for everywhere else, because still on these days normally the login infos are posted to one’s email, when starting to use new services.

And also one other thing, which I think is very important here, is that so many users used to use same passwords for different places. I know by myself, that it will be very difficult to remember all the passwords if they are just randomly made. For example 20 passwords for tools at work, 5 for your own emails, 20 for other services online (social networks, online banking, bookstores, games, etc.) And I’m not encouraging people to write them down, but just inventing some patterns to remember them or then using some other tools for securing all those passwords. I know that there are so many nice software available, which are taking care of your passwords, but for me, I don’t know can I trust them or not.

Here are links for more information about this scandal:
http://www.infoworld.com/d/security-central/gmail-and-yahoo-mail-passwords-exposed-737
http://www.techradar.com/news/internet/exposed-the-great-password-scandal-596064
http://www.computerworld.com/s/article/9139000/Gmail_Yahoo_Mail_join_Hotmail_passwords_exposed

Here is nice collection of hints and tips for boosting online security:
http://www.techradar.com/news/internet/10-easy-ways-to-boost-your-online-security-591191