I did 5 times. How bad was it for you?

I was really interested in that question and started a random search with some email addresses of people I know. Friends. Clients. More than half had already somehow been affected. So don’t forget to whip out this website with some of your friends, or try your spouse’s email. It’s going to be fun!

I mean, honestly, this list of all the websites and services that had breaches is already way too long. I couldn’t even read it all. Just “fly” over it and you will be amazed to see all the familiar names on the list. ​Since this article is going to be diving in deeper about this topic we should check  out the content’s first.

The simplest of all break-in methods is automated: trying to guess your password. A list of the most used passwords is run automatically by a script.

Now add some “artificial intelligence” into the equation and a script can read your social profiles to find your dogs’ name and make it a variable in the break-in.

I hope this makes you realize, that you have a lot of control with the choice of your passwords.

The threat to their accounts is too abstract for most people. 

We have to make ourselves aware that the password is there to literally keep out a herd of hacking zombies!

Password bots are just like a herd of zombies coming towards your farm; they are programmed to come after you and can infect others. They will relentlessly keep trying to feast on you.   

So you better put a better lock on your door!

You are a target. Services you use are under attack every day.

Data is traded like a commodity on the “darknet.”

If your email showed up on any of those lists above it is very likely that it has been traded as well.
Even data that has been stolen years ago can become relevant today if hackers start to use it. Most “darknet” marketplaces have come to public attention with mostly drug-related news. However, they are also used to trade any kind of personal information:

● Credit Card data
● Social Security Numbers
● Email accounts
● Lists with the most used passwords
● Lists with stolen passwords

If it’s data, it might be of interest to somebody. Many hackers are specialized in just about any aspect of the crimes they commit. You know that from any good action movie; the team of bank robbers has to find a “specialist” to open the safe. Instead of trying to hack all 77 million users themselves, the hackers can split up the data and sell it off in bundles. And even petty data can be interesting. Credit card data, social security numbers and other information are a commodity and often go in bulk. So, relatively speaking, you are just a number in a spreadsheet. A fraudster, who orders on ebay with stolen credit card information doesn’t need the capabilities of hacking somebody. All they have to do is buy a good data set and use the card in accordance with the credit limit. If they act carefully, your credit card company might not notice anything until you wonder
about all those charges on your bill.

Should I change my password?

You have to change your password when you are currently using an easy to remember password. That is generally an indication of a weak password and should be changed to a stronger password.

You don’t have to change your password on a regular basis. 

If you think you have been hacked, even if you think something is not right, you should definitely change your passwords. Starting with your email password and including the password for the service you believe might be compromised. 

The best option would be to use a different device and a different internet connection to do so. That’s a good thing to do because at this point your own internet connection or network might be infected or compromised as well. 

The overwhelming majority of cyber crimes can be prevented by a few easy rules of conduct.

Now you are asking the right questions. With all the data of stolen passwords you might have asked yourself: Why bother with a strong password when my password can get stolen, too?

And that’s right. Strong passwords alone can only offer a certain level of protection. 

It’s like with all things in life: If you want it to be secure you should use multiple layers.

And voilà: Two Factor or “2-Factor” Authentication adds another step to the regular password login process.

Each second factor has some distinct advantages and disadvantages

Text messages with verification codes have proven to be an easy way to add your extra level of security. However, with all things being connected, some hackers have successfully gotten access to a user’s smartphone and computer and were able to read the text messages as well. It is not foolproof, but it is much harder to hack both your phone and computer, which makes this method a lot safer than single factor authentication. 

The same goes for verification codes to your email inbox. Once the hacker get access to your inbox: game over.

A better way to add your second factor is a physical device. Usually a small usb key is used, which makes it impossible for hackers to steal your data without also breaking into your home or office. That locks out most of all hackers because they usually don’t reside anywhere near your location. And you don’t have to worry if you lose the key or in case of theft: without your password it is useless. That makes it currently (2019) a very safe way to protect your access. The downside is that currently not all platforms support this second level authentication. 

But wait. Isn’t there an app for that? The answer is: YES! It’s called an “authenticator” app and there are various out there. Google has one, so does microsoft and most password vault providers. The authenticator app works even if you are not currently on a network (no cellphone reception = text messages). It issues time-bases one time passwords.

In order for the app to work you first have to sync the app with the login you are trying to protect. It’s very easy and usually done by scanning a code with your mobile device. After you have scanned the code you can see a number and a countdown. The number is only valid for about 20-30 seconds and is automatically updated. That’s the temporary part of the password, which makes it very safe.

So how does the platform know which number is on your device, when they are not connected? When you scanned the code, the app and the platform you are adding the second factor to, have exchanged a secret key and synced their time. Now the app and the platform are independently able to generate the number. That’s also why it is called time-based one time password.

Lastly, the secret key offers a strong method of adding extra security to your password. It exponentially increases the strength of your password which makes it a good way to add a second factor. However, it can also be pretty long and requiring you to type 128 characters off your secret key card.

How many email accounts should I have?

Ideally you will set up one account for your emails and another one for your accounts throughout the web. If you want to make it extra secure use a different email address for each service. If you can’t handle that consider at least a different email for your social media, for your bank account, credit card and other financial services.

A password vault encrypts your passwords and leaves you with only one single password to remember. You will use one very strong password and additionally a second factor authentication. This makes your vault safe against most common attacks.

Vaults vary in their set-up and encryption methods. Some store your data locally and others in the cloud. 

Currently the most secure method is local encryption.

While a vault is a safe place it can also become a target just by its nature. 

A password vault is the way to go if you want to balance your convenience and workflow with a maximum level of security. 

Quick reminder: Two factor authentication for your vault is a must.

How to use the password card

Each password card needs to contain at least 10 columns. Ideally 26 for the alphabet or whatever labeling might help you remember a starting point. Add lines and fill each cell with a letter, number or character

The general idea on how to easily memorize your starting point would be to look at the name of service or login you are trying to create. You choose a letter of the name and look for the corresponding column on your table. Now you have to modify your algorithm so you can also memorize the line. For a service with 7 letters you could choose the 7th line and the 1st letter of the name. But that starting point might be too obvious. So instead of using the first letter you could use the second, third or whichever you like. And the amount of letters can be modified by adding or subtracting. (G o o g l e = 6)  + 3 = 9

With this simple pattern you will have an easy way to memorize your starting point. 

By reading from right to left, upwards, diagonal or in a pattern shape you can now further modify your password.

The password card is an analog tool and doesn’t offer the convenience of “autofill” like a password vault does. It might seem annoying but let me refer back to the top: An easy password is bad password.

Another way to create safe and memorable passwords is to create your own algorithm that you can execute in your head. 

Instead of relying on a matrix of random characters printed on paper, you will have to “compute” the password yourself.

The personal algorithm password is assembled from a sequence that is easily memorable to you and added parts that are again calculated out of the name of the service.

Example: How to use the personal password algorithm to log in to Linkedin

3 first letters “Lin” + “HorsePizzaFirehose” + last 3 letters, read backwards “nid” = “LinHorsePizzaFirehosenid” 

Now let’s spice it up with some numbers!

Linkedin = 8 letters

Add a “standard” multiplier to get more characters: x 100 = 800

Now put it all together: “800LiHorsePizzaFirehosenid” 

This kind of password does look familiar to your eye and is as strong as any random password. 

Here are some more sophisticated personal password algorithms:

• Algorithm 1
  
• Algorithm 2
• Algorithm 3

Diversify your email accounts

The email address is currently the standard way to create a new account. If you use multiple different email addresses it will be more difficult to take over all of your associated accounts.

Question: Why should I use separate email accounts?

Answer: When you are only using your personal gmail account to register all your accounts, you are making it easy for hackers to take over all of your accounts.

Usually a hacker will find, buy or steal one of your email addresses, but not multiple addresses at the same time. 

Using multiple email addresses can limit the theft of accounts through a websites “account recovery” tool to a smaller number.

Just like the GDPR (Data privacy .. )  another legislative act out of Europe is going to bring some movement into the slow shift of better data security and access protection. 

The Payment Service Directive 2 is going to force banks and other online merchants to use two factor authentication starting this fall 2019. This will raise awareness to the method and hopefully make its use the new standard for every user on any platform. I am pretty certain it will, because it already has been in the news, but mainly because hackers have already started to exploit the confusion during the mandatory change process. 

Each provider had to inform their customers about the increased security for the login. Soon thereafter hackers started sending out spoofed (fake sender address) phishing (using a bait to collect data) emails. 

That raises a good question: Why isn’t there a law that forces better data protection? 

The “password123”-problem long exists and it feels like the government is rather relying on private businesses to solve the problem.

But digital marketing is rather about taking hurdles out of a customer’s way to an action or purchase. It’s not about adding a second level of security by entering 128 characters.

Look, after the introduction of the seat belt law in 1968, studies in 1974 found that a driver had a 73% lower fatality rate and 53% lower serious injury rate when wearing a seat belt. (Source)

It is restraining to wear a seat belt, but you and I would probably agree that it is a good feature.

I think it’s time for a law that favors the user. Not a burdensome piece of regulation. We need a straightforward directive that levels the playing field. 

Imagine if every user invested about an hour of their precious time to change their passwords to a strong password with two-factor authentication, we would immediately render all those password lists useless! 

Entire cyber crime business branches would become obsolete overnight. 

Everyone would benefit but the hackers.

It’s going to be winter soon. Perfect time to set your digital life straight.

We need a “strong password day”! 

Talk Show hosts wearing random password sweaters and making awkward jokes about how to come up with the best memorable random password on every channel.

Interviewing people that haven’t been compromised, celebrating all the break-ins that never happened. 

And you should demand a mandatory drill in your office to change to a strong password!

Summary

• You are a target of cyber crime, every day & night.
• Hackers will break in; it’s just a matter of time.
• You have to use strong passwords and use different passwords for each account.
• Using strong passwords is the single most effective thing you can do to protect your business and your personal life from hackers.
• Strong passwords are hard to remember and impractical for everyday use.
• Make it convenient by using a password vault or password card.
• Use 2-factor authentication for your email inbox and all other accounts that offer it.