World Password Day and Teen Power

   Thurs May 4, 2017 is World Password Day!  I know that's coming up fast, but don't worry, you still

have time to plan your celebration.  No, that's not the day when you share your password with the world.  Nor is it about changing your bank password from 123456 to 1234567.

   I've written about this in the past.  World Password Day is a day to learn and it's yet another opportunity to take a look at what is protecting your personal information, your financial information, your medical information as well as your internet presence and reputation.  Most passwords provide a thin veil of protection

   On World Password Day, we should at the 4 main problems we can very easily fix:

1. People choose weak or easily guessable passwords - the simple fix is to choose better passwords!  As I've said many times in the past, when it comes to passwords, size matters!  Make 'em long.  But even if you choose a good password...
2. Passwords get reused among sites - this is a major problem because the attackers will try stolen passwords at other sites.  And it works.  So choose a unique password for every site on which you have an account.  But...
3. We can't remember all our passwords - so, as we've discussed in the past, use a password vault.  The vault is a program that will help you choose great passwords, recall those passwords and protect them.  But sometimes that's not enough because...
4. Even well-chosen passwords can be guessed or hacked - so for extra protection use two-factor authentication (also called multi-factor authentication).  Typically this means using an app on your smartphone as part of the login process.  That means, to break into your account, an attacker would need both your (long, strong) password AND your smartphone.  That's hard for the attacker to do.  And using multi-factor is easy!    Setting up 2-factor authentication is easier than ever before and is in use on many mainstream sites including Google, Facebook and Twitter.  Here's some info on sites offering 2-factor authentication.

   The WPD website has some high level guidance on each of these as well as those great Betty White videos!

   And if those all aren't enough reasons to move to 2-factor authentication, now... that pinnacle of journalism... Teen Vogue, has put out a really good article on the subject!  You can read it here.

   In addition to really good coverage of 2-factor methods and websites, the article also goes into more advanced topics like the use of a physical fob called a Yubikey.

   What is really significant is that this article is directed at a population who both grew up with technology and is used to sharing everything. The key message is that there are good reasons for protecting your information and reputation, even if you don't yet have financial assets or a job.

   So, are you ready to take the World Password Day challenge?  Start slowly.  Get a password vault and start with your most important sites: banks, insurance, investment and social media.  Change the passwords to unique long strong ones.

(Browser) Caching Fire

   Someone recently asked me a question about the safety of allowing your web browser to save, and then auto-fill, passwords.  That's a very timely question because that issue has been in the news lately.

   Web browsers have all kinds of built-in capabilities.  One "feature" that is only a few years old is the ability to save information you might put into forms such as: your name and address, phone number and other contact info, credit card information.  Browsers can also save your userids and passwords for sites, then automatically fill in that info when you visit the site.

   I've always said that security-minded people should not allow web browsers to save this kind of personal and security info.  This is primarily because all browsers have a track record of having many vulnerabilities.  I've always "said" this but, as it turns out, I've never written about it!  It's about time! [Note... or so I thought! While looking for some other info, I found that I did talk about this issue back in 2013!]

   There are two primary reasons why allowing the browser to save sensitive information is a bad idea:

1. Copycat and phishing websites can grab information directly your browser has stored without your knowledge.  This is the problem that was recently announced.
2. As I just mentioned, browsers have many vulnerabilities and exploits. At this year's Pwn2Own contest (a 2-day event at which teams compete to exploit software vulnerabilities for cash prizes), all of the major browser fell victim!

   The latest issue that was discovered occurs when you are lured to a specially crafted website.  That happens more often than you might think