Some of my friends have asked me recently about computer security, passwords, scams and malware. One thought he had a virus infection on his computer, another had been reposting hoaxes about WhatsApp messages while yet another had received one of these “we’ve got all your details, we’ve videoed you with your own webcam doing embarrassing things; if you don’t pay us money we’ll send the footage to all your contacts” emails. The reason he was particularly concerned was the email included one of his own passwords.
Of course it was a scam; it turned out the scammers had probably got his email and password from the LinkedIn security breach. So I confirmed with him that this wasn’t his email password and then reassured him it was a scam. He changed his email password just to be on the safe side.
Keep your email secure
Before anything like this happens to you, the most important piece of advice I would offer is: make sure your email password is UNIQUE (i.e. you’ve not used it for any other account, anywhere else, ever) and strong (8 or more characters and a mix of at least uppercase letters, lowercase letters and numbers). If it’s not, then I suggest you change it as soon as you can.
It’s unwise to use your children’s names and dates of birth. Don’t use “password” “qwerty” or “1234567890” (which are some of the most commonly used passwords).
Why your email?
Because email is the way you reset every other password. If someone hacks into your email account they can change that password, then access every other account you have by going to the website and clicking the “I’ve forgotten my password” link. The site then emails them a reset link. Worse, they could log into your email and automatically forward your emails to themselves, so you don’t know anything’s wrong, but they receive a copy of any email sent to you.
So your email password is, perhaps after your bank, the most important password you use. And it doesn’t require your email provider to be hacked. If a major website is compromised (recent security breaches in the UK include Tesco.com and Carphone Warehouse) the first thing the hackers will do is try each password on the email account associated with it… and if you’ve used the same password for both, then the hackers have access to your email.
How to make a password strong but memorable
My preferred technique is to pick the title of a favourite book, album or song and use that as the key. Let’s consider, for example:
All I Want for Christmas is You by Mariah Carey.
(I don’t use this, nor should you, it’s just an example)
Take the initial letters capitalised as in a normal sentence:
AIwfCiy
Substitute some of the letters. For example you could change the “C” of Christmas to X for Xmas, “for” to 4 and “you” to u:
AIw4Xiu
It’s still too short, so add the initials of the artist – MC:
AIw4XiuMC
There you have a pretty strong, apparently random, 9-character password, but because you know the passphrase, you can remember it every time. No one will guess it, nor will it fall to a brute-force “dictionary” attack where hackers try every word in the dictionary.
Some sites require your password to include a special character, if that’s the case you can insert a %, & or @ between the song and the artist:
AIw4Xiu%MC
There you go, the almost perfect password.
Could I make it even more secure?
Yes, you could use what’s known as “Two Factor Authentication” or 2FA. Your online bank already uses this so you’re probably familiar with the concept. When you login you need to provide a second password, or a code texted to your phone. Maybe your bank’s sent you a special authentication device such as the Barclays PINsentry below, or you use an “Authenticator” app which generates a one-time random code. There are several authentication apps. Microsoft includes one in Office 365 (now Microsoft 365), Google has one, and Authy is one of the independent ones.
Sites including PayPal, Twitter and Amazon support the use of Authentication apps for 2FA. Many sites offer a 2FA capability and it’s a good idea to enable it if it’s available.
Barclays PINsentry for two-factor authentication
How to remember all those passwords
Ideally every password you use should be strong and unique, but that’s hard, especially as our memories fade with age. Writing them down, while not a great idea, is better than using the same password everywhere. Use a little notebook and keep it somewhere safe at home – that’s far more secure than re-using passwords. Someone would have to break into your house to get it, and if they do that they’re much more likely to steal the telly! Whatever you do don’t write your passwords on a sticky note on your computer!
Better still, use a Password Manager such as LastPass (there’s a free version for web, PC, Mac, iPhone and Android†) or 1Password (small annual fee) which can securely store all your passwords, generate new unique random ones and fill them in on your phone or computer as you need them. They have extensions for your favourite browser, and you can also access them securely from anywhere when you’re away from home (unlike the notebook under your bed). With a Password Manager you don’t need to remember, or even know, any password other than the master password for the app. Whatever you do, make that strong, unique and don’t forget it!
Should I change my passwords regularly?
It’s fair to say that the IT security industry is divided on this. Provided your password remains strong and unique then there’s benefit in doing so, and some systems require you to do so periodically. The problem is that many of us have lots of accounts, and trying to think of multiple memorable, unique, strong passwords regularly is hard. So many people, when forced to change their password, just use the same set over and over again, or they use the same password but include a number in it and increment the number each time. So being forced to change your password regularly may actually reduce rather than improve your security. Use a Password Manager and you can change your password regularly – in fact some of them will do it for you automatically!
What happens if the Password Manager site is breached?
Yeah, it has happened. Password Managers are, like antivirus software, a prime target for hackers. But it wasn’t a problem because the way Password Managers work is your passwords are securely encrypted with your master password as a key before being stored in the (yet further encrypted) Password Manager database, and are only ever decrypted, as you need them, on the device you’re using. Even the Password Manager doesn’t know your Master Password. So if the Password Manager site is compromised, all the hackers are likely to get is a list of encrypted records, none of which are any use to them.
They must know my password, how else do I log in?
When you first set up your password, the site does something called salting and hashing. Salting adds a string of characters (which may be very long and is usually unique to your user account) to your password before it’s hashed – a type of strong one-way encryption*. The resulting string can’t be reversed, so it’s impossible to work out your password from the salted & hashed string.
All this processing is done on your computer before the result is stored, so your password is never transmitted over the Internet. When you log in, your computer repeats the process and transmits the result which is compared with the stored version. If they match, you’ve entered the correct password and you’re allowed in. If they don’t, you’ve got it wrong. But at no point is your password known to, or stored by the system.
Even if a hacker managed to get hold of your unique salt and the hashing algorithms (as some are reported to have done in the LastPass breach) they’d still wouldn’t have your Master Password, so they’d have to guess it and try salting & hashing it to gain access to your passwords – which is why its still important to make sure your Master Password is strong and unique.
Clever eh? This salting and hashing system is used by many major Internet sites, not just Password Managers. It’s preferred because it doesn’t require the storage of any passwords in clear and it avoids transmitting passwords in clear over the internet. I suspect Tesco and Carphone Warehouse are using it now. If they’re not, they should be.
So keep your passwords, especially your email password, unique and strong, and use a Password Manager, then you can just ignore those scammers!
* For the purists, yes I know it’s not the same as encryption, but this isn’t the place to go into the details of the difference between encryption and hashing.
† Update: As of March 17th 2021, LastPass Free is available only on EITHER computer (PC, Mac and Laptop) OR on mobile (phone, tablet and watch) but not both. In order to get it on both you have to upgrade to one of the paid plans such as Premium, Families or Teams. Still good value IMHO.
Further update: in August 2022 LastPass suffered a major security breach. The company has been less than transparent about it, but it turns out that every level of security – other than each user’s master password, had been breached. Those with a secure, and long, master password are probably ok, but others may be subject to a “brute force” attack. I have switched to 1Password, and have changed all of the passwords for any critical sites. It’s taken all day, but I’m happy I’m largely secure. I can no longer, in all honesty, recommend LastPass.
Mike's Blog 