online self defense - passwords
DESCRIPTION
Passwords are the main authentication method used for internet sites and applications. But passwords get stolen and have many weaknesses Here are tips you can use at home and at work to protect your information.TRANSCRIPT
Online Self-Defense:
Passwords
[email protected] @bcaplin
http://about.me/barrycaplin
http://securityandcoffee.blogspot.com
Barry CaplinChief Information Security
OfficialFairview Health Services
PasswordsWhy Are They A Problem?• Hard to remember• Hard to enter• Need too many• Inconsistent Rules• Changes
How Passwords Work
• Site saves encrypted pw• At login – enter pw – it’s
encrypted and compared to stored value
• Some sites:- Don’t encrypt well- Don’t encrypt at all!
And Passwords Get Stolen
It was a busy year
And Bad Choices Are Made
How Passwords Get Stolen
• Phishing or…• Site attacked – many methods• Encrypted pw file downloaded
(should be more difficult!)• Over time, attackers crack the
file
• What does that get them?
• Avg. web user has:- 25 separate accounts but- 6.5 unique passwords password reuse – not good
• So…
Passwords
Password Self-Defense
Tips for Home:
1. Choose good (long) passwords
2. Don’t reuse passwords
3. Use a Password Vault
4. Only enter on secure sites
Password Self-Defense
5. Care with “secret” questions
6. Care with linking accounts
7. Login notifications
8. 2-step authentication
9. Use separate email addresses
Password Self-Defense
Tips for the Office:
1. No one will ask for your password
2. Choose a good (long) password
3. Follow the policy
4. Don’t use a work password on a non-work system
Handouts•Password Self-Defense tips and resources
Password Self-Defense
Tips1. Don’t reuse passwords
The average online user needs passwords for 25 different websites and services, but uses only 6.5 different passwords. If one site gets compromised it can expose your password for another (perhaps more important) site.
2. Only enter on secure sites
Look for https:// in the address bar and a lock symbol to assure your passwords are kept confidential when traveling across the Internet.
3. Login notifications
Some sites will let you know when you last logged in, or if it looks like your account was logged in to from another country. Some sites allow you to block this.
4. Choose good (long) passwords
Length is more important than complexity! Choose 16-20 or longer length passwords if available. You can use all letters (upper and lower) if you are using 20 or more characters.
Tips5. Vault it
Password vaults are a great way to store all your passwords. Make sure you choose a good long master password and don’t forget it! Some great password vaults include: LastPass, 1Password, PasswordSafe and KeePass.
6. Care with “secret” questions
Many sites use “secret” questions to help identify you if you forget your password. Choose questions and answers that people can’t just look up on Facebook! Your place of birth, high school mascot, and other common information are not good choices. Or… you could provide fake answers to common questions. Just be sure you know what answers you give!
7. Care with linking accounts
Don’t just log into every site using your Facebook or Twitter logins (when available). If either of those accounts get compromised you could lose a lot more than just the one (or two) accounts).
Tips8. Write down your passwords
What??? You were always told to not do that! Well, you’re best option is using a password vault, but you can write down your passwords. Here are the “rules”: don’t write down what they’re for; keep them with your money (you already know how to protect that!), and; for extra credit – insert “fake” characters into the password – these are extra characters you know aren’t really part of the password but someone else would not.
9. 2-step authentication
Google (google authenticator), ebay, paypal, dropbox, facebook and other sites now allow 2-factor or 2-step authentication. It’s a bit more complicated to set up but definitely worth it. See the individual sites for info.
10. Use separate email addresses
If you use the same email account to associate with all your online accounts, then a hacker can own you online by compromising that email account. For instance, most online sites will send a confirmation email to your associated address if a change is made or to process a password change. If you can use different email addresses, then having one compromised won’t affect all your other online accounts.