The truth about passwords

The science behind hacking passwords has evolved much faster than the passwords themselves. While many websites and programs set limits on password-attempts that make brute-force attacks impossible, there are plenty of sites that do not. With many people using the same password for multiple sites and profiles, they don’t necessarily have to hack everything. They just need to find the weakest link.

The cartoon above by XKCD brilliantly and simply explains why long passwords with common random words are much more effective than the standard 1 capital letter, 1 number, 1 symbol, 8-12 character-long password. Below, we take a look at the most common passwords used. Moral of the story – don’t be dumb but don’t outsmart yourself.

Click to either the cartoon or the infographic to enlarge.

The social network security test

Security is always a concern online, but on social networks it’s doubly so as we put more and more personal information on Facebook, Twitter, and LinkedIn. Some have been accused of lackadaisical measures to keep our data away from prying eyes. With the increase in mobile social networking, the challenges are compounded upon.

This graphic by ZoneAlarm ranks 8 of the top social networks according to their current security standards and describes four of the most famous instances of social networking security breaches. Click to enlarge.

10 tips to keep your family safe online

Safety has been a concern online since kids started showing their parents how to surf. Now, as adults are realizing that there are real-world dangers online, the concern has grown into a threat that must be addressed.

This graphic by our friends at ZoneAlarm breaks down the potential for exposure to the negative elements that fill the internet. Sometimes, even things that seem harmless on the surface can be bad. Here are 10 tips to keep your family safe.

Click to enlarge.

Big names top list for insecure data storage on apps

App watchdog group ViaForensics has been running popular Android and iPhone apps through their system to see who is encrypting sensitive data such as passwords, user names, and application data, as well as over 20 other pieces of details normally stored through apps. The results have been expected, albeit depressing.

Many major apps, including FourSquare, LinkedIn, and Gmail, failed the test for one reason or another. Below is a list of those who failed.

AIM Android
AIM iPhone
Android Mail (Exchange) Android
Android Mail (Hotmail) Android
Bump iPhone
Foursquare Android
Gmail Android
Groupon Android
HTC Mail (Exchange) Android
Hushmail Android
Hushmail iPad
iPhone Mail (Exchange) iPhone
iPhone Mail (Gmail) iPhone
K-9 Mail Android
Kik Android
Kik iPhone
LinkedIn Android
LinkedIn iPhone
Mint Android
Mint iPhone
Netflix Android
Skype Android
Skype iPhone
Square iPhone
Starbucks Cards Manager Android
Wikinvest iPhone
WordPress Android
WordPress iPhone
Yahoo! Mail Android
Yahoo! Mail iPhone
Yahoo! Messenger Android
Yahoo! Messenger iPhone

With recent reports of location and other data being stored by most major mobile OS providers, it makes us question whether keeping any personal data on apps or mobile devices is wise. Still, most simple don’t care, as the infographic by Lookout demonstrates. If we’re not concerned who will be?

Click to enlarge.

Hackers take credit for Playstation network attack, claim possession of credit card data

If you’re an active Sony Playstation network user, you’re aware that it was “game over” last week as hackers made their way into the network and made off with a ton of your personal data. Sony has said that they are not certain whether sensitive credit card data was taken.

According to discussions in underground hacker forums, the hackers got your numbers.

Comments in these forums, which are being monitored by security researchers, reportedly claim that the hacked database included customer names, addresses, usernames, passwords and up to 2.2 million credit card numbers.

The hackers hope to sell the data for $100,000 according to Trend Micro senior threat researcher Kevin Stevens. According to one of the possible hackers, the data has been offered to Sony themselves but the company has allegedly not responded to the demands yet.

“To my knowledge there is no truth to the report that Sony was offered an opportunity to purchase the list,” said Patrick Seybold, senior director of corporate communications and social media at Sony.

Not everyone is buying it.

“Sony is saying the credit cards were encrypted, but we are hearing that the hackers made it into the main database, which would have given them access to everything, including credit card numbers,” said Mathew Solnik, a security consultant with iSEC Partners.

The hackers in the forum had detailed information about the servers that were attacked. The exploit they described is consistent with the presumed vulnerability – hacking into a Playstation 3 console and attacking through the hardware credentials once on the network.

Navigating the Minefield: Facebook Settings

Facebook. If you have an internet connection and a pulse there’s a good chance that you have an account. If you have an account, there’s a good chance that you haven’t made adjustments to your settings to protect your privacy, enhance your experience, or stay as secure as you want to be.

It’s a minefield. Facebook has been under fire in the past for having a complicated interface when it comes to personal settings. Despite recent changes they’ve made to the UI, it’s still not very easy without a roadmap.

Thanks to our friends at ZoneAlarm, we have just the ticket for you. This graphic gives you everything that you need to know to make Facebook work the way you want it to work with your preferences in mind. Click to enlarge.

Twitter Pushes https, Plans to Make it Default

With security being a major concern for Twitter over the years, they have been continuously making improvements and securing internal systems to tighten up the service. The https option has been available for a while, but only by typing it into a browser as such. Today, Twitter announced that they are making it an option for profiles and that they will eventually make it the default setting.

Under a user’s settings, they can now scroll to the bottom and select “Always use HTTPS.” Whenever the account is accessed from any device or Internet connection, it will automatically be secure. The goal is to prevent people’s activities on the site from being monitored, particularly when they are on public WiFi.

The setting is already standard on some specific areas on Twitter (such as the login screen) as well as applications, including the iPhone and iPad official Twitter apps. This news comes a week after a controversial move to tell developers to stop building Twitter clients. The timing and message couldn’t be more apparent: “Use official Twitter apps to access the site – they’re safer.”

We’ve Isolated the Problem

Infections of various types are normally the cause of computer problems. It could be malware, worms, viruses, or any number of security threats that spread from computer to computer through networks and the Internet.

In this case, the problem was pretty easy to isolate. When over 32K objects are currently infected on your device, it’s likely that there is some sort of problem with your security. Did you install Norton or something?

The Google 2-Step: Security, Squared

With online security filling the news, even becoming a government issue with the National Internet ID on the horizon, Google has taken a step towards improving security of the user accounts by adding an optional layer of security. Their advanced sign-on feature allows users to opt-in to a double-tap login process, requiring a second unique identifier to thwart hackers.

Similar to the technique used by many financial institutions, users will need to know a password as well as a separate code sent to their cell phone. This information will be cookie-based so users can set their code to be remembered on particular computers for up to 30 days.

Reactions across the blogosphere have been lukewarm, which makes very little sense. This is an optional program. It only changes for those who want the added security and are willing to take the extra steps necessary. One of the keys to security is taking away convenience both for the user and more importantly for hackers. From that perspective, it really cannot be viewed as anything but a great step forward towards true business application for Google.

Things to do on TECHi

Tech Intelligence Whitepaper