If you're like most people (me included, until I changed my ways), you use the same few (or one) "favorite" passwords for all your password-protected accounts, from low-security stuff like on-line newsletter subscriptions to high-security stuff like your bank or credit card accounts. And to make matters worse, your favorite passwords are likely something you can easily remember because they somehow relate to you (all the usual suspects...birth dates, middle names, pets, and so on). Just exactly the kind of passwords that hackers find easy to "crack" once they learn a few things about you.
You probably see where I'm going here already, but this "bad habit" is probably one of the riskiest things you can do--especially in this age of the ever-increasing proliferation of Internet-accessible accounts, multiplied by the ever-increasing rise in fraud and identity theft.
Let me touch on just a few of the problem areas... Using a few identical passwords across multiple accounts means that if one account is compromised, so are they all--plus you have little to no knowledge about the security practices (or even worse--the ethics) of the companies behind any of those accounts, meaning that you just might be handing the keys to your identity over to the "bad guys". Passwords that relate to you in any way are easy for hackers to crack, often with only a few tiny bits of information about you, much of which is generally available through public sources. Many "favorite" passwords are inherently insecure, in that they are short or use only letters or only numbers--such passwords can be cracked through various "brute force" techniques, without the hacker knowing anything at all about you. Bottom line, you wouldn't give out keys to your car or home to everyone you do business with, but in effect, that's what many (even most) people do when it comes to passwords.
I know what you're thinking: "I'm guilty of one or more (or all) of these transgressions, but it's just too hard to keep track of different passwords and even different logins for all my accounts. After all, what good is it to have different passwords for different accounts if there are more of them than I can remember; then I just have to write them down and carry around a list--and how secure is that?" I agree (my words exactly), but this is also the age of "good, cheap software" (and optionally, "good, cheap portable computers" , also known as PDAs and smart phones)...
The good, cheap software I'm referencing is what I would generically refer to as a "password manager", and two good examples are SplashData's SplashID (available for Windows, Mac, and a long list of PDAs and smart phones) and Ascendo's DataVault (currently only available for Windows and Blackberry's). There are others, and this isn't a review of password manager software, so feel free to search around (I will say that I've used both of these, and both are very good at what they do).
So, what is it that they do? In short, they provide a lightweight database that stores sensitive information in an encrypted format; not only passwords, but account numbers, PINs, SSNs, and so on--essentially any information that you need easy access to but don't want falling into the wrong hands. If you have a compatible PDA or smart phone, they will also allow you to sync between your computer and your PDA/smart phone, so you can carry your secure information with you wherever you go (also encrypted on your PDA/smart phone, so the information is safe if you loose the device). The two programs I mentioned, and presumably the others, also allow you to create categories (like Home, Business, etc.) and individual "classes" of information (like Bank Accounts, Credit Cards, Passport Info, etc.) that is searchable through the desktop or hand-held software, so you can quickly find what you're looking for. For example, you might create a credit card record under your home category for your personal Visa card and store in that record the bank name, card number, expiration date, on-line access URL, login, password, and maybe notes on your security questions or your credit line.
OK, so now I have a way to store sensitive information securely, how does that make me less prone to fraud or identity theft? In fact, by itself, it doesn't. The next step involves a bit of one-time legwork and a change in your behavior. What the password manager software does is make it easy to have different passwords (and even different logins, in some cases) for each of your accounts. What you have to do is actually take the time to set them up that way:
- Whenever possible, use a login or user name that is not your name or email address. Many on-line accounts won't allow this--they force you to use your email address or some variation of your name or account number. If that's the case, so be it, but when you have the option of choosing your own, do so. Make up something like "BlueVisa" or "SecureJohn".
- Create "random" passwords that don't relate to you or your family in any way. Some accounts have very specific rules that they password must conform to (such as only letters and numbers, or at least one letter and one symbol, etc.); that's usually not a problem, since you'll be making up a fresh one for every account. A format that works well and is generally considered secure is a random word, one or two random symbols, and a random number, such as "Prosper*382" (so long as your name isn't Prosper and you weren't born in March 1982, of course) or "@focus#4098". Many passwords are also case-sensitive, so "Focus", "focus", "FoCuS", and "FOCUS" are different, and this adds to the security of the password.
- Many of the password manager programs have the ability to generate "fully random" passwords, some even with various password rules (such as what kinds of elements they have to contain, how long they are, etc.) Such passwords are arguably even more secure than what I described above (they look like "3je*F2k+W"), especially because they are generated by the software and are therefore "more random" than anything you can make up. But frankly, I find these difficult to type in when you can't cut-and-paste them from your password manager, and I'm not convinced that they are that much more secure than the word/symbol/number approach. In any case, either of these approaches is far better than any of the "favorite passwords" you're using today.
Once you start keeping track of your sensitive data like this, you'll wonder how you lived without it. Not only does it increase the security of your password-protected accounts by several orders of magnitude (and in turn, protect you from fraud and identity theft), but it's also a much more convenient way to store and manage your sensitive data. And, combined with an automated on-line backup service, it's not only secure, it's also safe.
Comments