Blogger World

Recently, Mat Honan’s frightening account of how hackers destroyed his digital life has been making rounds online, scaring nearly everyone who reads it.

Basically, Honan’s digital presence was all but destroyed after hackers managed to delete his Google Account, wipe his iPhone, iPad and Macbook and deface his Twitter account. The reason for the attack, according to one of the people behind it, was “lulz” and to play around with a three-character Twitter name.

Honan’s position as senior reporter at Gizmodo did nothing to provoke nor protect him from the attack. Though he acknowledges his mistakes the affair, most sharply his failure to backup critical data (which everyone should have), his sharpest barbs were for Amazon and Apple, who’s security policies made the hack possible.

Though he acknowledges his mistakes the affair, most sharply his failure to backup critical data (which everyone should have), his sharpest barbs were for Amazon and Apple, who’s security policies made the hack possible.

Though Amazon and Apple have responded by updating their security policies, hopefully to prevent future attacks along the same vector, many have been wondering what they can do to strengthen their security online.
The truth is, no security is perfect and anyone who is a valuable enough target can be bit. But you can make yourself a more difficult target and someone who can not be trivially exploited and you can minimize the damage an attacker can do.
With that in mind, here are a few mostly common sense steps that can get you started to being more secure online.

• Make or Write Smart Password Using Letter, Numerical, Upper & Lower Case: 

A good password should be long, at least eight characters, easy to remember and contain a combination of lower case letters, upper case letters, numbers and symbols. Most importantly, it should not be a word found in the dictionary nor any variation of one.

Also, you should never reuse a password for more than one site and you should never write your passwords down.

If this sounds like a lot, it is. It’s too much for pretty much anyone to do without help.
One solution is to use a device known as a cipher to generate passwords on the fly. For example, you can look at the domain name of the site and generate a password based on it. Basically, to do this, you look at the site you’re at and create a hard-to-guess password from the domain.

For example, facebook might have a password of g1s@v3r$ if you use the cipher of looking at your keyboard and writing the first four letters of the domain “face” using the keys one to the right of the real ones and then breaking up the letters with the numbers 1-4 alternating with the shift function every other time. Look at your keyboard (US) if you are unclear.

Alternatively, you can also use services like LastPass to help you generate, store and automatically fill in passwords. However, these services are a trade off between random, difficult passwords and a new central point of failure. As long as the service itself is secure, you’re most likely fine.

• Two Factor Authentication Attempt:

Matt Cutts at Google recommended this strongly on his blog and I agree.
Two factor authentication simply means that you need two forms of authentication to log into a site. However, they have to be two different forms (not simply two passwords).

One form, obviously, is your password (something you know) but the other is usually something you have. These days, your cell phone is the most likely thing as many services, such as PayPal and Google, will send you a text that you have to repeat to log in. Google also, has its own app for most phones and that’s how LastPass handles its two-factor authentication.

This is an incredibly powerful tool because, even if your password is compromised, which Honan’s attack shows it can be easily in some cases, your account is not. It’s very unlikely, barring drastic steps, someone is going to have both your cell phone and your password. One or the other is possible, even likely, but not both.

If your account offers two factor authentication, turn it on as soon as possible. It’s a very powerful step.

• Personal Information:

A lot of sites will ask you to create backup security questions in case you forget your password. Common ones involve things such as your favorite pets name or the street you grew up on.
The problem is that many of these things can be trivially researched. However, you can beat this by simply lying on the questions.

After all, there’s no rule that you be honest, just that you remember your answer. If you’re asked for your favorite pet, give the name of your childhood imaginary pet. Ideally, your answers should be related enough to the questions to remind you of what you said, but far enough off base that it’s not trivially guessed.

• Credit Card Common Sense Tips:

Credit cards are like passwords, ideally they should not be used more than once and should never be stored. As Honan’s attack showed, even if they aren’t used for financial gain, they can still be used to open up exploits into other accounts.

If you have a bank or a credit card company that will issue single-use credit card numbers, use them. They are immensely powerful. If you don’t, try to avoid storing your credit card numbers and especially about storing one number across multiple accounts.

It might be annoying to re-enter your credit card data every time you want to buy a book on Amazon, but it could be what saves you from a minor hack becoming a major one.

• Bottom Line:

In the end, security is about the trade off between protection and convenience. Most of the things that make you more secure will also take up more of your time.

It’s really annoying to have to find your phone every time you want to log in to your gmail or you have to enter a complex password that’s difficult to guess. Life would be much easier if we didn't have to deal with those things.

But, of course, that isn't practical. The problem is that others don’t value your life, your privacy, your information or your work. They would happily destroy it all, whether it’s for profit, a vendetta or just “lulz”, there are individuals who will not think twice about destroying your world.

If you realize that and that no one is too unimportant to be a target, then it only makes sense to take precautions now. Today’s hassle may save you from tomorrow’s attack.