Bella Vista Computer Services

PASSWORD SECURITY

As an IT professional, one thing I deal with every day is passwords. When I'm helping a customer setup a new computer or a new account for e-mail, Facebook, or the like, I notice that people tend to underplay the importance of setting an effective password. I often even get questions like "Do I have to set a password?" or "Can't you set that to login automatically". Also, they often choose a password that only meets the minimum requirements.

Unfortunately, I also see the impact weak passwords. Often clients only realize the significance, when suddenly they can no longer access, sometimes permanently, their e-mail or Facebook accounts. When their friends and family receive virus-ridden e-mails from them, or they discover someone has accessed bank account or personal information.

All the major e-mail providers and social networking sites are constantly under attack from people who wish to exploit your personal information. In addition, the rapid increase in processing power in today's computers has made it much easier for the nefarious to attack your password. In years past, it was less feasible for an attacker without personal information about his target to attempt to break a password, or at least an attacker was limited to a list of a few thousand common passwords to try. Now, it is not unusual for computers to be capable of guessing several million (or even billion) combinations per hour. This allows an attacker to try every combination of characters for short passwords.

In years past security experts recommended that you do things like add capital letters or symbols to your passwords thus increasing the number of characters a computer would have to try. This led to passwords that looked like, alpha#12 or Aze344Sdi. Unfortunately, this made it incredibly difficult for people to remember their passwords and ultimately makes little difference to a computer, trying to guess your password.

In today's world, the best protection against a computer obtaining your password is to lengthen it, beyond the typical 8-12 digits commonly used. There are a few techniques that can be used to help remember long passwords. One easy way is to use a "passphrase" instead of a "password". An example of a "passphrase" that I actually used in years past is BlueBirdsEatBlackSeeds. As you can guess, I created this password while watching a fat blue bird eating from a birdfeeder. Since the sentence is fairly literal it becomes easy to remember, and the memory of the moment in which it came to me also helps me remember.

Another password creation technique is to string a few reasonably long words together like, PrimateCommandoConcussionHeaven, then associate those words with a mental picture that describes them to you. In this case I visualize a Primate and a Commando locked in an epic battle, one ends up with a concussion, and the other ends up in heaven. Making that mental image helps you remember, and it definitely works.

This all sounds great, but how are you supposed to remember 20 different phrases or word strings? Well to be honest you're not, if you have too many passwords to remember, I suggest getting a password manager. A password manager will store all your usernames and passwords inside an encrypted database. That is locked by one master password; then you only have to remember your master password.

Links:

Bad password examples:

Good password examples:

Works Cited

MANY EXPERIENCE TECH SUPPORT SCAM

It's Sunday afternoon, and maybe you're watching TV, or doing housework, when the phone rings. It's a well-mannered caller with urgency in his voice as he explains that he is from Microsoft, and that his team has detected the presence of a dangerous virus on your computer. He continues telling you not to be alarmed he can definitely remove this virus if you follow his instructions.

Regardless of what this person tells you there is most likely nothing wrong with your computer. This is a recent type of scam affecting computer users nationwide. There are several known companies, typically in countries like India or Russia that perpetrate this scam and others like it. They use scare tactics and misinformation to convince people to allow them remote access to their computer. Then after performing some unneeded and likely useless actions they will request your bank account or credit card information for payment. Usually this payment significantly exceeds a typical service charge for this type of repair.

So what are the dangers? The main danger comes from the fact that you receive no confirmation of identity from the person on the phone. They say they are from Microsoft or some other reputable company, but they initiated the call, and could be anyone, anywhere. Once you allow them into your computer, they have full control of it and can change security settings making you vulnerable, copy personal files and information, or even install malicious software that could allow them to monitor or connect to your computer at a later time. In addition if you give them financial information there is nothing to prevent them from billing your accounts for whatever they desire. Then, because you don't really know who or where they are, you have little, if any, recourse.

So what should you do? If you have fallen victim to a scam like this, take your computer to a local, computer professional and have them check it for malware, and viruses. Then monitor your bank account and credit cards for unusual or unauthorized charges. If you still can, have your credit card company or bank dispute the charges, even the original services charges. If you receive one of these calls, report it to the company they were claiming to be, and to law enforcement. You may not see any results directly, but if you report, it is more likely that these scams will be stopped. Finally, never allow someone you do not know to connect remotely to your computer. There are many reputable companies who use remote administration to help customers, but a reputable company will never call you unsolicited, and they will always have a physical location where you can go in case of a problem. In short, make sure you are confident that the person you are speaking with is the person they are claiming to be.