And the Password is... Monkey!

   If you've been following the news about hackers and cracked passwords, then you know that one of the most often used passwords for online sites and services is: Monkey.  Who would have guessed?!

   All the buzz is about an article appearing in ArsTechnica, Why passwords have never been weaker - and crackers have never been stronger, by Dan Goodin.  It's an eye-opening piece about how the state of the art in password cracking has been greatly advanced by the security information intelligence gained from recent hacks, and password file disclosures, from LinkedIn, eHarmony, Battle.net and others.

   Everyone "knows" they should be using strong passwords - yet passwords like 123456, password and Monkey are routinely on the top of the list of the most used passwords on hacked sites.  Similarly, everyone "knows" they should not reuse passwords between sites (is your Facebook password the same as your online banking password???).  But the article refers to a 2007 Microsoft study which reports that the average web user has accounts on 25 different sites, but protected by only 6.5 unique passwords!

   Here's my take...

Inspiration, Aspiration and Perspiration

   I recently read the book, "Start With Why" by Simon Sinek.  Actually, as I usually do with books, I listened to the audiobook.

   One of the key points in the book, and one that I am using, is what Sinek calls the Golden Circle.

Is the Help Desk the New Perimeter?

    Unless you've been under a rock, you've read about the unfortunate hack of tech jounalist Mat Honan's home iPhone, iPad, Mac, Gmail, iCloud, Amazon and Twitter accounts (not necessarily in that order).  You can read the details in Mat's Wired article here.  Also, some great twit.tv podcast coverage on TWIT, TWIG and Security Now!.

   I won't rehash what others have said on this matter.  But I do have a couple of different thoughts.  A number of people have written takes on what you should do to protect yourself.  I have some thoughts on this that I'll share in a future post.

The Case for Security Awareness

   There have been a number of articles lately talking about the value of Security Awareness. In particular, this post, by CSO Online blogger Dave Aitel makes the case that Security Awareness training is not useful or effective. A number of examples are listed trying to show that even in supposedly "enlightened" companies, like RSA, simple mistakes like opening a malicious email attachment, still happen.

   I think this is too simplified a view.

   It's hard to quantify how many things don't happen, prevented by basic awareness training. But, a big problem could be the training itself.  From this Dark Reading post:

Think Before You Tweet

   I love listening to audio podcasts. One of my favorites is The Social Hour on the TWIT network. On a recent episode, hosts Sarah Lane and Amber MacArthur started off the show talking about a couple of instances of people using very poor judgement when posting on Twitter.

   First, top Greek triple-jumper and former Olympic team member Voula Papachristou showed very poor judgement, tweeting a racist message in the weeks leading up to the London Olympic games. You can read the tweet as well as some commentary here and here. There are a few things that make this case interesting.

Excellent Service Every Time

   Perhaps you've heard of Seth Godin. He's an author and speaker who usually covers subjects like marketing and leadership. You should follow him on twitter and read his blog.  Watch his TED talks (you do watch TED talks... right?)

   In a recent post entitled "Marketers with Power", Seth discusses situations when we have no choice in an action, such as when:

I have to fill out this form before the doctor will see me

Customer or the Product?

   The idea has been talked about before here, here and here.


see more Very Demotivational

   There are many free services out there.  Don't get me wrong... many are quite useful and I use many myself.  But people get upset when there is an outage (like this).  And more than one social network has had issues over changes in privacy policy (I'll talk more about this in a future posting).