{"id":151,"date":"2014-08-07T12:52:23","date_gmt":"2014-08-07T16:52:23","guid":{"rendered":"http:\/\/altimac.com\/?p=151"},"modified":"2014-12-01T18:09:24","modified_gmt":"2014-12-01T23:09:24","slug":"of-russian-hacks-and-password-cracks","status":"publish","type":"post","link":"https:\/\/altimac.com\/2014\/08\/07\/of-russian-hacks-and-password-cracks\/","title":{"rendered":"Of Russian hacks and password cracks"},"content":{"rendered":"

ANOTHER DAY, another data breach<\/a> and this one appears to be one of the most significant in recent memory–over a billion usernames and passwords now in the possession of some Russian hackers. Although a very interesting take<\/a> on this exploit at The Verge calls into question whether said quantity of personal data was actually “hacked” or merely acquired from other criminals, the fact remains that the data is out there, and yeah, there’s probably a reasonable chance that your info is in there somewhere.<\/p>\n

What many of us find particularly frustrating about these escapades is that the names of the sites that were compromised are usually not released for days or even weeks after the hacks occur, in the event that a site remains vulnerable after the hack is disclosed. This was the case with the recent Heartbleed<\/a> bug, where many Web site operators were unconscionably slow to inform their users as to whether their sites needed patching, had or had not been patched, and exactly what information could been compromised.<\/p>\n

In the end, we’re all left thinking, “What can I do, or what should I do, to protect myself?” Well, there isn’t much we can do to prevent these kinds of exploits, but there are two things we can do to minimize the potential risk. One is to use “strong” passwords (“un9Ayg3I1oN8” as opposed to “password”) on the Web sites that we frequent, and the other is to use unique (and strong) passwords for each site. Using strong paswords alone wouldn’t have helped much with this specific exploit, but using unique passwords would.<\/p>\n

WHY? BECAUSE hackers know that most of us use the same 2-3 passwords for all the sites we visit. So if they capture just one, along with your email address, they may well have a way in to many of your other online accounts–some of which may contain a lot more personal information than just your name and email.<\/p>\n

Now there’s a very good reason why–in spite of all the warnings we get each time a Web hack is publicized–most of us use the same 2-3 passwords for everything, and that’s because in order to use<\/em> them, we must be able\u00a0to remember<\/em> them. Even working with only a few passwords can be challenging, and we’ve all had those moments wherein we type in what we think the password is, then what it might also be, then what we think it is but with an initial cap, etc. Were we all to employ strong passwords, even if they were not unique to each site, we would certainly fail at most of our login attempts.<\/p>\n

That’s where password managers come in. Some are programs that reside on your computer; some are Web sites that store the passwords for you. Some are bare-bones and some are amazingly full-featured. But the one invaluable service they all perform is they enable you to use strong, unique passwords by remembering them for you and regurgitating them on demand. You have only to remember one “master” password to unlock the rest.<\/p>\n

THE KEY WORD here is “enable.” It would be a truly marvelous thing were a password manager to vist all the sites you frequent, change your password on each one to something infinitely more robust like “Nim2ceWg8O9q,” and then repeat that action every three months. In the real world, of course, accomplishing that requires a little more “elbow grease,” if I may borrow\u00a0an idiom from my parents’ generation.<\/p>\n

Even with the assistance of a password manager, you must take the following steps to update your sites with a strong and unique password:<\/p>\n

    \n
  1. Log in to the site with your current (presumably weak) password.<\/li>\n
  2. Locate the area of the site where you can update your password.<\/li>\n
  3. Enter your current password in the “Current Password” or “Old Password” field.<\/li>\n
  4. Enter a much stronger one in the “New Password” field (most password managers will generate this for you).<\/li>\n
  5. Apply the password change using the “Save,” “Update, “Apply” or similarly-named button below the password fields.<\/li>\n
  6. Make sure the password manager updates its record for the new password (most do this automatically, or at least semi-automatically).<\/li>\n
  7. Repeat for the remainder of your sites.<\/li>\n<\/ol>\n

    DON’T GET ME wrong–I don’t mean to give the impression that password managers aren’t worth the trouble. I use a password manager, and I feel they are extremely useful and truly the only practical way to employ strong and unique passwords across multiple Web properties. But they still require an investment of time and thought to allow them to safely and effectively “manage” your passwords.<\/p>\n

    So if this latest exploit has you thinking that it might be time to stop using “password123” for the majority of your Web accounts, you would be well-advised to employ some form of password management. Just be prepared to spend a few hours or more working up a little elbow grease in the process.<\/p>\n","protected":false},"excerpt":{"rendered":"

    ANOTHER DAY, another data breach and this one appears to be one of the most significant in recent memory–over a billion usernames and passwords now in the possession of some Russian hackers. Although a very interesting take on this exploit at The Verge calls into question whether said quantity of personal data was actually “hacked” […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[4,6],"tags":[],"_links":{"self":[{"href":"https:\/\/altimac.com\/wp-json\/wp\/v2\/posts\/151"}],"collection":[{"href":"https:\/\/altimac.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/altimac.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/altimac.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/altimac.com\/wp-json\/wp\/v2\/comments?post=151"}],"version-history":[{"count":0,"href":"https:\/\/altimac.com\/wp-json\/wp\/v2\/posts\/151\/revisions"}],"wp:attachment":[{"href":"https:\/\/altimac.com\/wp-json\/wp\/v2\/media?parent=151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/altimac.com\/wp-json\/wp\/v2\/categories?post=151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/altimac.com\/wp-json\/wp\/v2\/tags?post=151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}