Security Breaches and My Password Thoughts

Facebook security breaches have been in the news every day lately.  Are you concerned?  No, because you think you're a smarty pants and have changed your Facebook password, so there!  Well, that might not be enough.  Have you ever went to a new website and they asked you to sign up and offered you the convenience of using your Facebook, LinkedIn, Twitter or Google account?  If you elected for convenience then you opened yourself up to the Facebook breach.  Never choose Facebook or Google as a login for accounts, always use your email address.  There is always another choice although often it is a little harder to find.  

What is the Facebook or Google or LinkedIn convenience login called?  In the tech industry we call this the "you as" login or officially OpenID.  We'll log you in as.....your xxxxx account.  

How does it work?  How do it know?  When you click the button for the app to log in as, that website goes out and queries the app (Facebook, Linkedin, Google, whoever) and asks for a token.  The website then stores that token forever for when you come back and login.  That token contains your password from the app.  

What does the Facebook security breach have to do with that token?  If your account info and/or password was stolen from Facebook then the bad guys have access to any site you used the "You as" login on.  That means you've spread your vulnerability across multiple entities.  

Do you believe that the Facebook breach only affected 50,000,000 users?  Of course not silly! Facebook has 2.23 billion user accounts.  

What are the best practices i should follow?

Never use the "You as" feature for new sign ups to 3rd party apps
• If you’re using an easy to see pattern for customizing your passwords for each site or service, then change that pattern (and all of those passwords) 
• always a good idea to have different passwords for accounts involving money, those passwords should be complex.  Pet + a number is NOT complex.  A password CAN be complex but easy to remember.  Here's an example --  a sentence -- Dawn is the best person I know and funny too.   Take that sentence and convert it ---  DitbpIk&f2      That's a complex password but easy to remember for you.  It's the first letter of each word and convert things like and to a symbol and the too to a 2.  Complex passwords should have lower case, upper case, special symbols/characters, and number(s)
• Implement 2 factor authentication on your important accounts, like brokerage, banks, credit cards, etc.  Also called MFA or 2FA (Multi Factor authentication) - basically, it texts you a code that you put in after your password.  Here is an excellent short video explaining 2FA
• Change your birth year on Facebook.  If you put all your personal information on Facebook and someone hacks your Facebook could they use that to get in to other accounts?  Your pet is Fido.  You were born in 1980, your dog was born in 2016, the hacker knows that because you put his birthday party on Facebook.  So chances are really good that some of your passwords are Fido1980 or Fido2016.  Change them!
• Personally, I go as far as putting an incorrect day, month and year as my birthday on Facebook.  My friends know it's my birthday when it's my real  birthday.  I don't care about anyone else....

Trouble remembering all your passwords?  There are many alternatives.  One is the free version of lastpass.com which I use, to store and populate passwords online.  It's free for personal version, costs $$ for companies.  There are other password 

Low tech?  This works great!   https://www.amazon.com/ Password-Keeper-Galison/dp/ 0735344620/ref=sr_1_13?ie= UTF8&qid=1514996876&sr=8-13& keywords=password+book

That book is small enough to hide.  Has tabs with alphabet to quickly find things.  oh and let me state the obvious, if you write them down, don't take the book with you, ANYWHERE

Want more information? Here are some links

Facebook breach and 3rd party apps using Facebook Connect 

What is this "You as" feature?  here

These opinions are my own.  You are responsible for your own account security.  

Android vs. Apple....

Everyone loves a winner until the winner gets a little too big. You can take your pick between Apple's fluctuating stock price, antenna gate on the new Apple iPhone 4G or the bitching and moaning about iTunes being too restrictive and totalitarian but the result is the same; let's pick on Apple.

People whine that they "have" to download their apps from iTunes and developers whine that all the apps are subjected to a rigorous certification test from Apple. The blogosphere is whining because Apple's new iPhone 4G can get poor antenna reception if you death grip the phone. Bag on Apple because they have become the new Microsoft of the 80's. They are the innovators where Microsoft once was, they are becoming the behemoth that everyone hates just like Microsoft has become. I suppose there is one difference, Apple customers are rabid. So rabid in fact that they can be referred to as fanboys.

So where does that leave us? It left an opening for Google to come in and introduce the open source free for all called the Android platform. In the Android's case applications are distributed either through the Android Marketplace (an icon on the phone's home page) or through the developer's website (scary). This link is from Phone scoop and it talks about a Chinese owned domain stealing personal information from people downloading their wallpaper Android app. Imagine that....No controls on the apps at all, unlike iTunes, so thieves go about unchecked. Give me Apple and it's controls anytime!

Here is a poignant snapshot of the Android Marketplace article:

In June 2010, a study performed on 48,000 Android market applications by SMobile Systems Inc., revealed that 20 percent of applications asked users permission for access to private or sensitive information that an attacker could use for malicious purposes, such as identity theft or mobile banking fraud. 5 percent of applications have the ability to place a call to any number, without requiring user intervention.[15][16][17]
However, while installing applications, Android displays all required permissions, so the user can decide whether to install an application whose permission requirements seem excessive or unnecessary (e.g. a game is likely to enable vibration, but unlikely to read messages or phonebook). This effectively makes the process more secure than other systems that do not ask for any permissions and instead receive full complete access.

Which phone will you buy? Who do you trust? Only you can decide but you shouldn't decide based on the phone's good looks. You should decide on many factors and being well informed is vital!

Anonymity

There's something to be said for Anonymity. Only last year if you googled my name you got millions of hits with none of them pointing to me. You see Dawn Armstrong is a fairly common name. There are literally 1000's of us out there. Today after reading an article regarding Social networking personal brand suicide I figured I'd better google myself again. I was shocked that this blog is the #2 hit. I didn't realize how much I missed that anonymity....

For awhile I was thrilled that when you googled "direct buy scam" my blog was the first hit. I was proud that I had become searchable. I've had this blog for about 6 or 7 years now and it had never been searchable until that fateful blog post in late 2008. It took about 4 months for it to climb to the top of the page rankings but it did. Today using that search term gets me at 3rd place. I'm happy now to have dropped. I don't want to be first and I don't want to be so out there on the internet.

Over the past two years I've become very cognizant of the fact that what I post will be read by too many people and some day it may be used against me. It enters my mind each time I write a blog. I have to temper feelings, delete blog posts and be careful what I write so as not to offend anyone too much or damage any career opportunities.

Have you googled yourself lately?