Online Security – Password Mis-management
Today I wish to shed some light on the everyday requirement to “remember” passwords. Again, this is aimed at the general layman that is “forced” into having to remember passwords for every system that they need to get access to. In this article you will learn that that password mismanagement has led to wide scale technology abuse and the general lack of understanding, by the public, is leading to ever increasing problems. Finally, I will finish off with a strategy that you can deploy in your own life in 2024, to tackle the problem head-on.
History
Before the Internet, there were passwords. Identifying yourself to a computer system allowed your employer to divide their resources by “user” and user groups. This is how companies were able to allocate cost and computer resource allocations (computer time). Each user had to remember a secret word (PASSWORD), that was provided as a challenge when they specified who they were allegedly trying the access the system as (USERID). This was the birth of the USERID and the PASSWORD combination that we are now all familiar with.
Unfortunately, we do not live an a world of honest people and people soon worked out that the best way to get something for nothing, was to pretend to be another person. All you had to do was look a person on the published list of USERIDs and just start guessing what their password was. In the early day, people felt that passwords were just an inconvenient step in their work life, so they just didn’t set a password or used passwords they could easily remember such as “1234” or “password”. The impostors had an easy job!
Fast Forward To 2023
It might come as surprise that nothing has changed in the last 50 years of computing. Unfortunately, the number of dishonest people have increased exponentially and most people have a reluctance to supply a password to get on with the job.
Recent studies have still found that the “123456” and “password” are still used by millions of people worldwide to lock up their valuable digital information.
Now we end up with two conflicting requirements:
- People tend to be reluctant to do more than they absolutely have to, on a day-to-day basis. Some may affectionately call this laziness, but it can be just a result of taking on so much work, that every little additional step is a nuisance. To meet this requirement, we need more convenience.
- Criminals have a lot more to gain, financially, from “pretending” to be you. As a result, the methodology to attempt to get into your systems is getting better by the day. To meet this requirement, we need more security.
Today we have millions of different computer systems, including personal gadgets, personal PCs, phones, online shopping, government access and company computers. Each of these systems contain billions of lines of computer code and are designed by different organisations which have a different focus and understanding of either convenience or security.
In short, this global problem will never be solved and is guaranteed to get worse every day.
System Risk Profile
Books have been written on this subject, but I intend to give you a snapshot of where we are today, in a single table, below.
| System | Relative Security | Weakest Link |
|---|---|---|
| Online shopping systems | Poor | There are thousands of online retailers. Only the richest ones ever give security a consideration in their shopping software. 1. Password complexity enforcement 2. User data storage (company software infrastructure) |
| Online government systems | Medium | 1. Massive custom-built software systems. 2. Too much data collection 3. Too many interlinked systems 4. Too many people with access to system data 5. Subcontractors with inappropriate experience to build these custom systems. |
| Utilities and Banking | Medium | 1. Massive custom-built software systems. 2. Too much data collection 3. Too many people with access to system data 4. Subcontractors with inappropriate experience to build these custom systems. 5. Reliance on other corporations for data storage and security. |
| Smartphones | Medium | 1. Internet Browser 2. SMS messages with links 3. PDF documents with links 4. Email messages with links |
| Home PCs | High | 1. Internet Browser 2. Email program 3. User authority level 4. Operating system |
| Personal and Home gadgets | Medium to High | 1. Online access 2. Connection to local area network |
Consequences of Cybercrime
To tackle this issue on a personal level, you need to imagine how you would deal with a security breach from each of the systems shown in the table above. Remember that the consequences of a cyberattack on any one of these systems could potentially end up with similar outcomes. In the list below, your “identity” is simply “enough information to allow a person to masquerade as you, digitally”.
- Unable to access a system to get the “service” you need at the time that you need it.
- Unable to access a system permanently
- Your “identity” is used to make purchases, using your money on retailers you normally use.
- Your “identity” is used to open new accounts on other online retailers or services.
- Your “identity” is used to get loans or make legal commitments, without your consent
- Your “identity” is used to withdraw any or all of your money from any or all of your bank acounts
- Your “identity” is permanently available for another person to use for any purpose, good or bad.
- Your activities are monitored (visually, audibly or digitally) for the purpose of committing a physical crime on your premises, or business. (or by your government, if you live in Australia)
Take Back Control
Contrary to popular belief, you do have the ability to control your exposure to all of digital crimes as detailed above. It just requires an increased awareness that there is a problem and requires a change in attitude and a shift in the way you live your daily life. The table below gives you an action plan for 2024.
| System | Action |
|---|---|
| Online shopping systems | 1. Register for any new online retailer with a different email address. 2. Change your password for your existing online retailer to one which is fits the 2024 security requirements for a “good” password. (12 characters, no “words”, mixed case, symbols) 3. Never use the same password in any two “systems”. 4. Pick another retailer if you are not able to set a secure password on their website. 5. Rather than purchasing online, consider shopping from local brick and mortar retailers and use cash. |
| Online government systems | 1. Use “manual” options, where they are offered. Fill out a form, print it and send it by surface mail. 2. Become an active citizen and stop the expansion of digitally interconnected systems. This can be done by seeking out groups that are working hard to fight this basic ignorant, uncontrolled, expansion of “digital” technology, such as “Digital IDs” or “Digital Currencies”. 3. Use cash to pay for all government services. |
| Utilities and Banking | 1. Similar to “Online shopping systems” 2. Use cash wherever possible. |
| Smartphones | I have provided a detailed strategy in this article. They key points are: 1. Do not install retailer, or government apps. 2. Never click on links in SMS messages, downloaded PDFs or emails from suspicious senders. 3. Do not install Facebook or Google apps. 4. Turn off “location services” on all apps that logically do not require the knowledge of where the device it. 5. Never connect to a “public” WiFi system without a good VPN service. 6. When using your phone Internet browser, follow all of the guidelines for browser use on home computer, with regard to password management and “download” links on websites. |
| Home PCs | 1. Start afresh with Linux, a secure browser (eg. Brave) and use a password manager (e.g KeePassXC) There are guides on this website showing you step-by-step, how to do this. 2. Strictly adhere to the isolating your role as a “user” and that of “superuser”. 3. Do not have “autologin” enabled. Your password to use your PC should be considered “master password” quality. It is your first and strongest line of defense and should be easy for you to remember but have at least 30 to 40 characters (This sounds intimidating but is actually easy to do. Close your eyes and type a sentence. Do this over and over again until you feel that you can remember it and type it with ease.) |
| Personal and Home gadgets | I have provided a detailed stategy in this article. The key points in relation to passwords/security include: 1. Consider carefully, whether your life is improved by using them in the first place. Can you live without it? 2. Never install one which requires an online account to setup or operate. 3. If the gadget provides online services, only buy from a manufacturer you can trust and then keep the gadget’s firmware up-to-date. 4. If the gadget has a USERID and PASSWORD to set it up or adjust the settings and it is connected to any local or online system network system, make the PASSWORD “strong” as described above. |
Password Manager – No Longer Optional
Using strong passwords and changing them frequently on all of your online systems is a key requirement to managing your risk. In 2023, you should not be relying on memory, or notes of paper, or the simple password systems built into browsers. A password manager should be the first thing you set up an consider when considering using any online service. I will write another article on the relative merits of various password management systems in the future. In the meantime, any system, commercial, or non-commercial, is better than having none.
I personally use KeePass (for Windows), KeePassXC (for Linux) and Strongbox (for iPhone), as they all use the same open standard, very secure, database format and they are all very well supported in the software community and thousands of people use them daily.
Peer Pressure Is Your Enemy
Nobody is going to help you achieve your goal. You will be considered paranoid by your peers. The action list shown above, requires work and commitment and this will force you to go against the crowd herd mentality.
The statistics are real and the threat is very real. Unfortunately, to tackle the problem, you will need to drop many of your current convenient habits to implement real change.
Government Actions – Feeding The Problem, Not the Solution
No government, or corporation is going to help you. Just look at the 3 Billion dollars lost due to cybercrime in Australia in 2022 alone. The amount of crime is on the increase and the security experts all suggest that it is “when” and not “if” your online system is going to be hacked in the forthcoming years, regardless of business size.
The push by both governments and banks is to push security in the wrong direction.
Consider this summary:
| Current Security Experts Advice | Current Government and Banks Proposals |
|---|---|
| You should never use the same password for more than one service. | Implement systems and policies that puts all of your unique identity information in a single block of digital information (your Digital ID). As described above, this is effectively just your “password” when attempting to access their systems. The problem is that this single password will be the only way to access all systems, government, banking and commercial! |
| Distribute your critical assets virtually and physically. | Centralise everything. The proposed Central Bank Digital Currency (CBDC) and Digital ID systems are examples of centralised data collection and control. |
| Only link systems if there is a business critical requirement for functional inter-operation. Each additional link adds further risk and offers greater yields for single cyberattacks. | Link all systems. |
As indicated above, to manage your personal risk, you will need a heightened awareness of the problem and then an attitude change to push back against organisations such as government and banks, that insist on exacerbating the problems by making everything linked, digital and centralised.
Biometric Identification – Wrong Solution with No Turning Back
There is a push by governments and corporations to introduce biometric detection such as facial recognition, fingerprint, retina scan and even DNA detection to tackle this problem. People jump for joy when these systems are proposed as they are convinced that it will solve the problem. Furthermore, technically these systems are easy to implement with current digital cameras and scanners, so why worry? It’s also extremely convenient!
For security, the exact opposite it true. While it is true that you are more accurately described digitally if your body biometrics are scanned, you have to remember that it is a permanent digital record. It a block of data, just like an encrypted password, that has to be stored on an online system. All online systems are vulnerable to cyberattack and will be attacked at some time in the future, if they have not already. Once your “digital” biometric data is distributed amongst the cyber hacker community, your “identity” will be permanently compromised and there is no recovery possible, since there is only one match between the digital data block and the real you.
It should be your number one priority that this is never allowed to happen in any country.
Distributed Systems and Decentralised Assets Minimise Risk
The actions proposed in this article will help to distribute your identity. The goal is to aim to have a “muddy” digital footprint for improved security. This minimises the extent of harm from theft, as a result of any single cyberattack.
So, if for example, your Amazon credentials are stolen, the criminals should never be able get access to your bank. If your government credentials are stolen, the criminals should never have access to your legal documents stored on your PC. If you bank credentials are stolen, then you should be able to continue to purchase goods in another way.
Your Reward
The more action you take to manage the risks detailed above, the harder you will make it for criminals to take advantage of you. Then when you finally end up being attacked, directly or indirectly, you will still be able walk away with minimal damage to your identity, or your wealth.