If you're like most people (me included, until I changed my ways), you use the same few (or one) "favorite" passwords for all your password-protected accounts, from low-security stuff like on-line newsletter subscriptions to high-security stuff like your bank or credit card accounts. And to make matters worse, your favorite passwords are likely something you can easily remember because they somehow relate to you (all the usual suspects...birth dates, middle names, pets, and so on). Just exactly the kind of passwords that hackers find easy to "crack" once they learn a few things about you.
You probably see where I'm going here already, but this "bad habit" is probably one of the riskiest things you can do--especially in this age of the ever-increasing proliferation of Internet-accessible accounts, multiplied by the ever-increasing rise in fraud and identity theft.
Let me touch on just a few of the problem areas... Using a few identical passwords across multiple accounts means that if one account is compromised, so are they all--plus you have little to no knowledge about the security practices (or even worse--the ethics) of the companies behind any of those accounts, meaning that you just might be handing the keys to your identity over to the "bad guys". Passwords that relate to you in any way are easy for hackers to crack, often with only a few tiny bits of information about you, much of which is generally available through public sources. Many "favorite" passwords are inherently insecure, in that they are short or use only letters or only numbers--such passwords can be cracked through various "brute force" techniques, without the hacker knowing anything at all about you. Bottom line, you wouldn't give out keys to your car or home to everyone you do business with, but in effect, that's what many (even most) people do when it comes to passwords.
I know what you're thinking: "I'm guilty of one or more (or all) of these transgressions, but it's just too hard to keep track of different passwords and even different logins for all my accounts. After all, what good is it to have different passwords for different accounts if there are more of them than I can remember; then I just have to write them down and carry around a list--and how secure is that?" I agree (my words exactly), but this is also the age of "good, cheap software" (and optionally, "good, cheap portable computers" , also known as PDAs and smart phones)...
The good, cheap software I'm referencing is what I would generically refer to as a "password manager", and two good examples are SplashData's SplashID (available for Windows, Mac, and a long list of PDAs and smart phones) and Ascendo's DataVault (currently only available for Windows and Blackberry's). There are others, and this isn't a review of password manager software, so feel free to search around (I will say that I've used both of these, and both are very good at what they do).
So, what is it that they do? In short, they provide a lightweight database that stores sensitive information in an encrypted format; not only passwords, but account numbers, PINs, SSNs, and so on--essentially any information that you need easy access to but don't want falling into the wrong hands. If you have a compatible PDA or smart phone, they will also allow you to sync between your computer and your PDA/smart phone, so you can carry your secure information with you wherever you go (also encrypted on your PDA/smart phone, so the information is safe if you loose the device). The two programs I mentioned, and presumably the others, also allow you to create categories (like Home, Business, etc.) and individual "classes" of information (like Bank Accounts, Credit Cards, Passport Info, etc.) that is searchable through the desktop or hand-held software, so you can quickly find what you're looking for. For example, you might create a credit card record under your home category for your personal Visa card and store in that record the bank name, card number, expiration date, on-line access URL, login, password, and maybe notes on your security questions or your credit line.
OK, so now I have a way to store sensitive information securely, how does that make me less prone to fraud or identity theft? In fact, by itself, it doesn't. The next step involves a bit of one-time legwork and a change in your behavior. What the password manager software does is make it easy to have different passwords (and even different logins, in some cases) for each of your accounts. What you have to do is actually take the time to set them up that way:
- Whenever possible, use a login or user name that is not your name or email address. Many on-line accounts won't allow this--they force you to use your email address or some variation of your name or account number. If that's the case, so be it, but when you have the option of choosing your own, do so. Make up something like "BlueVisa" or "SecureJohn".
- Create "random" passwords that don't relate to you or your family in any way. Some accounts have very specific rules that they password must conform to (such as only letters and numbers, or at least one letter and one symbol, etc.); that's usually not a problem, since you'll be making up a fresh one for every account. A format that works well and is generally considered secure is a random word, one or two random symbols, and a random number, such as "Prosper*382" (so long as your name isn't Prosper and you weren't born in March 1982, of course) or "@focus#4098". Many passwords are also case-sensitive, so "Focus", "focus", "FoCuS", and "FOCUS" are different, and this adds to the security of the password.
- Many of the password manager programs have the ability to generate "fully random" passwords, some even with various password rules (such as what kinds of elements they have to contain, how long they are, etc.) Such passwords are arguably even more secure than what I described above (they look like "3je*F2k+W"), especially because they are generated by the software and are therefore "more random" than anything you can make up. But frankly, I find these difficult to type in when you can't cut-and-paste them from your password manager, and I'm not convinced that they are that much more secure than the word/symbol/number approach. In any case, either of these approaches is far better than any of the "favorite passwords" you're using today.
Once you start keeping track of your sensitive data like this, you'll wonder how you lived without it. Not only does it increase the security of your password-protected accounts by several orders of magnitude (and in turn, protect you from fraud and identity theft), but it's also a much more convenient way to store and manage your sensitive data. And, combined with an automated on-line backup service, it's not only secure, it's also safe.









Get Rich Quick Scams
I've been spending a lot of time lately doing on-line research for one of my new startups--a lot of Google searches and the like, plus often following interesting links I find serendipitously. One thing I've found a lot of is blatant and obvious scams, promising to "generate fast, easy money with little or no effort".
What is it in human nature that allows people to fall for this kind of crap? Seriously? To me, the saddest thing about these scams is that somebody must be buying into them, or the people behind the scams would eventually give up and crawl back under their rock. But the exact opposite seems to be true: there are too many of these sites to count and new ones being added every day.
Has everyone forgotten this simple saying? "If it's too good to be true, it probably isn't".
Consider this: If someone can sell you a piece of software (or a web-based service) for $199 that guarantees that you'll start making $3,750 per week after only 15 minutes of work, why don't they just do themselves whatever their software or service does--do the math...one person working a comfortable eight-hour day could be bringing in $600,000 per week after just one week of "work" (compared with having to sell over 3,000 copies of their software every week from here on out). Wow! Sign me up! (By the way, I changed a few of the details, but I found several examples of "deals" just like this).
Another example: Lots of companies offer to "share" with you some sort of "secret" that will open the floodgates to untold riches that you can collect by doing absolutely nothing...once you know the "secret". Some of these sites don't even charge you for the "secret"; they just want your name and email address. Let's see here... Since I was able to find the site offering the "secret" (and many other similar sites, presumably each with their own special secrets), I have to assume that my ability to use Google is not significantly better than the other billion people that use Google every day, so that means this "secret" is likely to be "shared" with more than a few people in short order. If so, and more than a few people start using the "secret" to create their zero-effort income stream, my guess is that whatever the secret is won't work as expected for very long. OK, that was about as much sarcasm as I could cram into the last couple of sentences. Again, who is falling for this? I do believe that there are various "secrets" that a relatively few people are benefiting from (for example, I've personally seen very elaborate currency trading "systems" that generate a profit 9 out of 10 times), but the only reason these things work is because very few people know about them, and inevitably, they always run out of steam over time. But let's review: If you knew one of these secrets, why would share it with anyone, rather than just use it yourself? But for a moment, let's assume that out of the goodness of your heart (or some other unknown motivation), you decided to share the secret globally (by buying paid search terms to really get the word out, no less). Since the presumption is that any such "secret" takes advantage of some sort of flaw or loophole in some system that lets those who know the secret exploit that system, you must also assume that the system in question (the stock market, Google search, etc.) does not want to be exploited. But through the amazing reach of the Internet, many thousands or hundreds of thousands of people now know the "secret". Assuming there ever really was a secret in the first place, how long would it last with that kind of onslaught? Which brings me back to the first problem with this kind of scam: namely that anyone who knows a "real secret" would never disclose it in the first place (their personal greed getting in the way, you know).
Who are they kidding? Maybe I'm being overly harsh here, but it seems to me that anyone with two brain cells to rub together would see right through these scams in a split second. I imagine that most people reading this post would agree. But the proliferation of scams like these (and they are not limited to the Internet alone) demonstrate that in at least some fraction of the population there is a seed of hope that lets them believe that great rewards can be had with little or no effort. Short of winning the lottery (and I'm not putting any eggs in that basket), it just isn't so.
Some relevant quotes:
--Colin Powell
"Nothing ever comes to one that is worth having, except as a result of hard work."
--Booker T. Washington
"Nothing in the world can take the place of persistence. Talent will not; nothing is more common than unsuccessful men with talent. Genius will not; unrewarded genius is almost a proverb. Education will not; the world is full of educated derelicts. Persistence and determination alone are omnipotent."
--Calvin Coolidge
"Opportunity is missed by most people because it is dressed in overalls and looks like work."
--Thomas A. Edison
Posted at 11:18 PM in Commentary | Permalink | Comments (0) | TrackBack (2)
Digg This | Save to del.icio.us