Public Service Announcement On Password Security

[highlander]

No doubt many of you have heard about the numerous social media password breaches as of late. Many sites such as LinkedIn, MySpace, and 939 forum sites managed by a company called VerticalScope have had large numbers of passwords breached/leaked. Mark Zuckerberg is an example of one such person whose account was hacked.

Lessons From Mark Zuckerberg's Social Networking Account Breach

What does this matter to you? What it means is that there is a chance your passwords may have been been compromised in one of these big breaches. Maybe you received a notification from them and you changed your password on their site. That’s good! The thing you might not be thinking about is if your password was compromised and if you use the same password on other sites, your password on those other sites isn’t doing you much good anymore. There are a few places to check and see if you might have a problem. One site that allows you to check this is LeakedSource. Just put in your email address and it will tell you if your password was leaked in any of the recent major breaches. If you pay the $4 you can actually view some of the passwords that were breached but you don’t really need to in order to get the idea. Don't panic if you find yourself on the list - after all it's a social networking site and not your life savings. Just take a few precautions.

I'd like to take this opportunity to make a few recommendations:

1. Don’t use the same password on all the sites you access. It is best to use a different password on every site. Be especially careful about your email account password and accounts where you do financial transactions, like your bank.
2. Change your passwords on a periodic basis. You might want to do this once every six months or so. If you find your password was leaked in one of those major breaches, make sure you change it wherever you are using it.
3. Pick good passwords. Here is an article that has some recommendations on how to do that.
4. Recognizing how difficult it is to do #1, #2 and #3 above if you access more than a few sites, which means almost everyone, get a password manager tool. There are a bunch of them out there. I use LastPass. This password security thing isn't worth messing around with and the password manager tools make make your life a lot easier. For a few bucks you can get some software that picks strong passwords for you, remembers them for you and automatically scripts them when you log in. It works seamlessly across your laptop and smart phone. One thing I like about LastPass is it has a tool to allow you to audit your passwords, gives you a score and look for places where you have bad ones.
5. For sites that are important, use "multi-factor" or "two-factor" authentication. What sites are important? It's the sites where you can access sensitive things - like your email account, bank account or brokerage. The option for two-factor authentication is often there if you check. Two factor authentication generally requires you to put in an additional one time password in addition to your standard password. Think of it as being authenticated by what you know (your normal password) and what you have (a token or your phone typically). We have two-factor authentication available as an option on the forum. You can find it here or look for Two Factor Authentication under UserCP and follow the simple instructions. This technology works differently on different systems. In the case of our forum, it requires you to install a couple of apps on your phone. It took me three minutes to turn on for my account. The way the software works on the forum is that if you come from an IP address that you haven't come from before, it asks you to put in a one time password which is generated every sixty seconds using the Google Authenticator app on your phone.

Anyway, that’s it. I thought maybe not everyone realizes some of these things so it would be good to communicate. Because of these broader problems out there, we might end up implementing a requirement to change passwords on a periodic basis on the Forum - like once every six months or once a year. We have this already for moderators and administrators but not for normal users.

 

[Mal12345]

Oh boo hoo, someone hacked my myspace account in 2011.

 

[highlander]

Oh boo hoo, someone hacked my myspace account in 2011.

Which I guess doesn't matter as long as you don't use the same password for other things now.

 

[Totenkindly]

Oh boo hoo, someone hacked my myspace account in 2011.

Yeah, I found out my MySpace got hacked a few years back.
I forgot i even had an account there.

 

[highlander]

Yeah, I found out my MySpace got hacked a few years back.
I forgot i even had an account there.

That's part of the problem. We create so many accounts on so many places and they accumulate over time. You forget about them. Most people can't remember all the different passwords so they end up reusing them all over the place over a period of years which is really the point of my post above - to elaborate on the risks of it.

The password manager is an ideal solution because it enables you to automatically create a different password on every system you access. So if one account is compromised, it doesn't put others at risk.

 

[highlander]

This is a pretty nice demo and explanation.

 

[PeaceBaby]

A good article outlining different options: Five Best Password Managers

 

[Pionart]

My password is...

password123

shhhhhh

 

[Cowardly]

My LinkedIn account was hacked as well. At least I never got into AshleyMadison, that one proved to be troublesome, and amusing.

 

[Coriolis]

The password manager is an ideal solution because it enables you to automatically create a different password on every system you access. So if one account is compromised, it doesn't put others at risk.

Unless that one account is your password manager account. Then everything else is compromised.

 

[highlander]

Unless that one account is your password manager account. Then everything else is compromised.

Of course. If you want, you can use multi-factor authentication to control that one account.

It's a trade-off. What's worse
A) Trying to remember 60 different passwords and inevitably reusing the same password on a lot of those systems, whereby if one is compromised, a number of them are compromised (high probability this will happen) or
B) Putting all your eggs in one basket and guarding it like hell

 

[SearchingforPeace]

My late FIL used a password manager. Unfortunately, he did not write it down anywhere or tell his wife, so all his accounts were locked and inaccessible after his coma...... it created a huge hassle....

 

[Totenkindly]

I go old school. I have a piece of paper tucked away somewhere with passwords, and all the sites using coded names so that others probably can't read it.

 

[prplchknz]

I go old school. I have a piece of paper tucked away somewhere with passwords, and all the sites using coded names so that others probably can't read it.

that's exactly what international spies would do.

 

[Totenkindly]

that's exactly what international spies would do.

...I guess I should renew my passport.

 

[prplchknz]

...I guess I should renew my passport.

spies don't need passports just private jets and fast internet well maybe you do but spies can just call their boss and not have to do it like us plebs do.

 

[PeaceBaby]

Of course. If you want, you can use multi-factor authentication to control that one account.

It's a trade-off. What's worse
A) Trying to remember 60 different passwords and inevitably reusing the same password on a lot of those systems, whereby if one is compromised, a number of them are compromised (high probability this will happen) or
B) Putting all your eggs in one basket and guarding it like hell

Exactly. A multifactorial authentication system is going to be much less penetrable than the notepad file on your desktop.

And, if you're squeemy about using an online system, use KeePass - it's free, installed locally and you can set it to multi-factor authenticate as well.

 

[Totenkindly]

spies don't need passports just private jets and fast internet well maybe you do but spies can just call their boss and not have to do it like us plebs do.

Times are hard.
My covert agency won't even let me fly economy plus.

 

[Coriolis]

Of course. If you want, you can use multi-factor authentication to control that one account.

It's a trade-off. What's worse
A) Trying to remember 60 different passwords and inevitably reusing the same password on a lot of those systems, whereby if one is compromised, a number of them are compromised (high probability this will happen) or
B) Putting all your eggs in one basket and guarding it like hell

I like Totenkindly's Option (C), and use it myself.

I go old school. I have a piece of paper tucked away somewhere with passwords, and all the sites using coded names so that others probably can't read it.

 

[highlander]

I like Totenkindly's Option (C), and use it myself.

You mean hand written or that you type it in and store it on a computer somewhere?