Search

Placeholder Content Image

Use these 10 passwords at your own peril

<p dir="ltr">With cyberattacks increasing by the month, it’s crucial to have a strong grasp or what is - or isn’t - a strong enough password to hopefully deter hackers.</p> <p dir="ltr">And with the cybercriminals capable of unveiling 921 passwords each second, people all over have become easy targets with their choices - whether that’s from including easy-to-guess terms like the word “password” itself or common sequences like “123456” and “qwerty” - as reported by <em>9News</em>.</p> <p dir="ltr">And as analysis by <em>CyberNews</em> has revealed, just 13 per cent of leaked passwords - from a review of almost 15 billion - were actually unique. </p> <p dir="ltr">According to them, two of the most popular names to appear in the selection were “Eva” and “Alex”, with a total of seven million respective uses. “Food” and “pie” were regulars, as well as the season “summer”.</p> <p dir="ltr">While these might be easy for users to remember, and appealing for that, My Business general manager Phil Parisis had a clear warning in store when he explained that “if it’s easy for you to remember, chances are it’s also easy for cybercriminals to guess.</p> <p dir="ltr">“That's not only putting you at risk but also exposing the businesses and corporations that you work for.</p> <p dir="ltr">"Another common inclusion is a year - often their birth year or another significant year in their life."</p> <p dir="ltr">Having the right information and advice at your disposal is crucial when it comes to protecting yourself, so with all of this in mind, the 10 passwords that you should avoid at all costs the next time you’re asked to come to up with one are the following: </p> <ul> <li dir="ltr" aria-level="1"> <p dir="ltr" role="presentation">123456</p> </li> <li dir="ltr" aria-level="1"> <p dir="ltr" role="presentation">123456789</p> </li> <li dir="ltr" aria-level="1"> <p dir="ltr" role="presentation">qwerty</p> </li> <li dir="ltr" aria-level="1"> <p dir="ltr" role="presentation">password</p> </li> <li dir="ltr" aria-level="1"> <p dir="ltr" role="presentation">12345</p> </li> <li dir="ltr" aria-level="1"> <p dir="ltr" role="presentation">qwerty123</p> </li> <li dir="ltr" aria-level="1"> <p dir="ltr" role="presentation">1q2w3e</p> </li> <li dir="ltr" aria-level="1"> <p dir="ltr" role="presentation">12345678</p> </li> <li dir="ltr" aria-level="1"> <p dir="ltr" role="presentation">111111</p> </li> <li dir="ltr" aria-level="1"> <p dir="ltr" role="presentation">1234567890</p> </li> </ul> <p dir="ltr">To further protect yourself, it can be of great benefit to mix your upper and lowercase letters in your passwords, as well as throwing in a range of symbols and numbers to further disguise your intended terms. </p> <p dir="ltr">For example, and as <em>9News</em> noted, the likes of “password123” is considered a weak password, while something like “MySecurePa$$word785!” is considered much stronger, and much more protected.</p> <p dir="ltr">And the Australian Cyber Security Centre have further suggested that internet users consider using passphrases - a number of random words put together in a string -, as they’re “harder to guess but easier to remember” than common passwords. But most of all, they recommend avoiding obvious, significant, and easy-to-guess words, like the names of children and beloved family pets. </p> <p dir="ltr"><em>Images: 9News </em></p>

Technology

Placeholder Content Image

This New Year, why not resolve to ditch your dodgy old passwords?

<p>Most of the classic New Year resolutions revolve around improving your health and lifestyle. But this year, why not consider cleaning up your passwords too?</p> <p>We all know the habits to avoid, yet so many of us do them anyway: using predictable passwords, never changing them, or writing them on sticky notes on our monitor. We routinely ignore the <a href="https://theconversation.com/choose-better-passwords-with-the-help-of-science-82361">recommendations for good passwords</a> in the name of convenience.</p> <p>Choosing short passwords containing common names or words is likely to lead to trouble. Hackers can often guess a person’s passwords simply by using a computer to work through a long list of commonly used words.</p> <p>The <a href="https://nordpass.com/most-common-passwords-list/">most popular choices</a> have changed very little over time, and include numerical combinations such as “123456” (the most common password for five years in a row), “love”, keyboard patterns such as “qwerty” and, perhaps most ludicrously, “password” (or its Portuguese translation, “senha”).</p> <p><span>Experts have long advised against using words, places or names in passwords, although you can strengthen this type of password by jumbling the components into sequences with a mixture of upper- and lowercase characters, as long as you do it thoroughly.</span></p> <p>Complex rules often lead users to choose a word or phrase and then substitute letters with numbers and symbols (such as “Pa33w9rd!”), or add digits to a familiar password (“password12”). But so many people do this that these techniques don’t actually make passwords stronger.</p> <p>It’s better to start with a word or two that isn’t so common, and make sure you mix things up with symbols and special characters in the middle. For example, “wincing giraffe” could be adapted to “W1nc1ng_!G1raff3”</p> <p><span>These secure passwords can be harder to remember, to the extent you might end up having to write them down. That’s OK, as long as you keep the note somewhere secure (and definitely not stuck to your monitor).</span></p> <p>Reusing passwords is another common error – and one of the biggest. Past data leaks, such as that suffered by <a href="https://www.ncsc.gov.uk/blog-post/linkedin-2012-hack-what-you-need-know">LinkedIn in 2012</a>, mean billions of old passwords are now circulating among cyber criminals.</p> <p>This has given rise to a practice called “<a href="https://www.wired.com/story/what-is-credential-stuffing/">credential stuffing</a>” – taking a leaked password from one source and trying it on other sites. If you’re still using the same old password for multiple email, social media or financial accounts, you’re at risk of being compromised.</p> <h2>Pro tip: use a password manager</h2> <p>The simplest and most effective route to good password hygiene is to use a <a href="https://www.choice.com.au/electronics-and-technology/internet/internet-privacy-and-safety/buying-guides/password-managers">password manager</a>. This lets you use unique strong passwords for all your various logins, without having to remember them yourself.</p> <p>Password managers allow you to store all of your passwords in one place and to “lock” them away with a strong level of protection. This can be a single (strong) password, but can also include face or fingerprint recognition, depending on the device you are using. Although there is some risk associated with storing your passwords in one place, experts consider this much less risky than using the same password for multiple accounts.</p> <p>The password manager can automatically create strong, randomised passwords for each different service you use. This means your LinkedIn, Gmail and eBay accounts can no longer be accessed by someone who happens to guess the name of your childhood pet dog.</p> <p>If one password is leaked, you only have to change that one – none of the others are compromised.</p> <p>There are <a href="https://en.wikipedia.org/wiki/List_of_password_managers">many password managers</a> to choose from. Some are free (such as Keepass) or “freemium” (offering the option to upgrade for more functionality like Nordpass), while others charge a one-off fee or recurring subscription (such as 1Password). Most allow you to securely sync your passwords across all your devices, and some let you safely share passwords between family members or work groups.</p> <p>You can also use the password managers built into most web browsers or operating systems (with many phones offering this functionality in the browser or natively). These tend to have fewer features and may pose compatibility issues if you want to access your password from different browsers or platforms.</p> <p>Password managers take a bit of getting used to, but don’t be too daunted. When creating a new account on a website, you let the password manager create a unique (complex) password and store it straight away – there’s no need to think of one yourself!</p> <p>Later, when you want to access that account again, the password manager fills it in automatically. This is either through direct integration with the browser (typically on computers) or through a separate application on your mobile device. Most password managers will automatically “lock” after a period of time, prompting for the master password (or face/finger verification) before allowing access again.</p> <h2>Protect your most important passwords</h2> <p>If you don’t like the sound of a password manager, at the very least change your “critical” account passwords so each one is strong and unique. Financial services, email accounts, government services, and work systems should each have a separate, strong password.</p> <p>Even if you write them down in a book (kept safely locked away) you will significantly reduce your risk in the event of a data breach on any of those platforms.</p> <p>Remember, however, that some sites provide delegated access to others. Many e-commerce websites, for example, give you the option of logging in with your Facebook, Google or Apple account. This doesn’t expose your password to greater risk, because the password itself is not shared. But if the password is compromised, using it would grant access to those delegated sites. It is usually best to create unique accounts - and use your password manager to keep them safe.</p> <p><span>Adopting a better approach to passwords is a simple way to reduce your cyber-security risks. Ideally that means using a password manager, but if you’re not quite ready for that yet, at least make 2022 the year you ditch the sticky notes and pets’ names.</span></p> <p><em>Image credits: Getty Images</em></p> <p><span><em>This article first appeared on <a rel="noopener" href="https://theconversation.com/this-new-year-why-not-resolve-to-ditch-your-dodgy-old-passwords-172598" target="_blank">The Conversation</a></em>.</span></p>

Technology

Placeholder Content Image

A computer can guess more than 100,000,000,000 passwords per second. Still think yours is secure?

<p>Passwords have been used for thousands of years as a means of identifying ourselves to others and in more recent times, to computers. It’s a simple concept – a shared piece of information, kept secret between individuals and used to “prove” identity.</p> <p>Passwords in an IT context <a href="https://www.wired.com/2012/01/computer-password/">emerged in the 1960s</a> with <a href="https://www.techopedia.com/definition/24356/mainframe">mainframe</a> computers – large centrally operated computers with remote “terminals” for user access. They’re now used for everything from the PIN we enter at an ATM, to logging in to our computers and various websites.</p> <p>But why do we need to “prove” our identity to the systems we access? And why are passwords so hard to get right?</p> <p><strong>What makes a good password?</strong></p> <p>Until relatively recently, a good password might have been a word or phrase of as little as six to eight characters. But we now have minimum length guidelines. This is because of “entropy”.</p> <p>When talking about passwords, entropy is the <a href="https://www.itdojo.com/a-somewhat-brief-explanation-of-password-entropy/">measure of predictability</a>. The maths behind this isn’t complex, but let’s examine it with an even simpler measure: the number of possible passwords, sometimes referred to as the “password space”.</p> <p>If a one-character password only contains one lowercase letter, there are only 26 possible passwords (“a” to “z”). By including uppercase letters, we increase our password space to 52 potential passwords.</p> <p>The password space continues to expand as the length is increased and other character types are added.</p> <p>However, the problem with depending on password complexity is that computers are highly efficient at repeating tasks – including guessing passwords.</p> <p>Last year, a <a href="https://www.cbronline.com/news/stolen-user-credentials">record was set</a> for a computer trying to generate every conceivable password. It achieved a rate faster than 100,000,000,000 guesses per second.</p> <p>By leveraging this computing power, cyber criminals can hack into systems by bombarding them with as many password combinations as possible, in a process called <a href="https://www.kaspersky.com/resource-center/definitions/brute-force-attack">brute force attacks</a>.</p> <p>And with cloud-based technology, guessing an eight-character password can be achieved in as little as 12 minutes and cost as little as US$25.</p> <p>Also, because passwords are almost always used to give access to sensitive data or important systems, this motivates cyber criminals to actively seek them out. It also drives a lucrative online market selling passwords, some of which come with email addresses and/or usernames.</p> <p><strong>How are passwords stored on websites?</strong></p> <p>Website passwords are usually stored in a protected manner using a mathematical algorithm called <a href="https://www.wired.com/2016/06/hacker-lexicon-password-hashing/">hashing</a>. A hashed password is unrecognisable and can’t be turned back into the password (an irreversible process).</p> <p>When you try to login, the password you enter is hashed using the same process and compared to the version stored on the site. This process is repeated each time you login.</p> <p>For example, the password “Pa$$w0rd” is given the value “02726d40f378e716981c4321d60ba3a325ed6a4c” when calculated using the SHA1 hashing algorithm. Try it <a href="https://passwordsgenerator.net/sha1-hash-generator/">yourself</a>.</p> <p>When faced with a file full of hashed passwords, a brute force attack can be used, trying every combination of characters for a range of password lengths. This has become such common practice that there are websites that list common passwords alongside their (calculated) hashed value. You can simply search for the hash to reveal the corresponding password.</p> <p>The theft and selling of passwords lists is now so common, a <a href="https://haveibeenpwned.com/">dedicated website</a> — haveibeenpwned.com — is available to help users check if their accounts are “in the wild”. This has grown to include more than 10 billion account details.</p> <p>If your email address is listed on this site you should definitely change the detected password, as well as on any other sites for which you use the same credentials.</p> <p><strong>Is more complexity the solution?</strong></p> <p>You would think with so many password breaches occurring daily, we would have improved our password selection practices. Unfortunately, last year’s annual <a href="https://www.securitymagazine.com/articles/91461-the-worst-passwords-of-2019">SplashData password survey</a> has shown little change over five years.</p> <p>As computing capabilities increase, the solution would appear to be increased complexity. But as humans, we are not skilled at (nor motivated to) remember highly complex passwords.</p> <p>We’ve also passed the point where we use only two or three systems needing a password. It’s now common to access numerous sites, with each requiring a password (often of varying length and complexity). A recent survey suggests there are, on average, <a href="https://www.newswire.com/news/new-research-most-people-have-70-80-passwords-21103705">70-80 passwords per person</a>.</p> <p>The good news is there are tools to address these issues. Most computers now support password storage in either the operating system or the web browser, usually with the option to share stored information across multiple devices.</p> <p>Examples include Apple’s <a href="https://www.computerworld.com/article/3254183/how-to-use-icloud-keychain-the-guide.html">iCloud Keychain</a> and the ability to save passwords in Internet Explorer, Chrome and Firefox (although <a href="https://www.howtogeek.com/447345/why-you-shouldnt-use-your-web-browsers-password-manager/">less reliable</a>).</p> <p><a href="https://tech.co/password-managers/what-is-a-password-manager">Password managers</a> such as KeePassXC can help users generate long, complex passwords and store them in a secure location for when they’re needed.</p> <p>While this location still needs to be protected (usually with a long “master password”), using a password manager lets you have a unique, complex password for every website you visit.</p> <p>This won’t prevent a password from being stolen from a vulnerable website. But if it is stolen, you won’t have to worry about changing the same password on all your other sites.</p> <p>There are of course vulnerabilities in these solutions too, but perhaps that’s a story for another day.</p> <p><em>Written by Paul Haskell-Dowland and Brianna O’Shea. Republished with permission of <a href="https://theconversation.com/a-computer-can-guess-more-than-100-000-000-000-passwords-per-second-still-think-yours-is-secure-144418">The Conversation.</a> </em></p>

Legal

Placeholder Content Image

Netflix promises to crack down on users who share passwords

<p><span style="font-weight: 400;">Netflix have promised to crack down on users that share their passwords with friends or family members.</span></p> <p><span style="font-weight: 400;">This means that if you borrow someone’s login, you might have to start paying for your own account in full.</span></p> <p><span style="font-weight: 400;">Netflix offers account-sharing features, but they’re designed to let people in a single-household use one login.</span></p> <p><span style="font-weight: 400;">The streaming giant is worried that users are sharing their logins among different households.</span></p> <p><span style="font-weight: 400;">Netflix product chief Greg Peters spoke at Netflix’s Q3 2019 earnings and said that the company wants to address the issue of password sharing without “alienating a certain portion of the user base”.</span></p> <p><span style="font-weight: 400;">“We continue to monitor it so we’re looking at the situation,” he said, according to </span><a href="https://www.news.com.au/technology/home-entertainment/tv/netflix-vows-crackdown-on-users-who-share-logins-with-pals-or-family-and-could-make-you-pay-extra/news-story/09630a28861854c2aa32201a4dae3e25"><span style="font-weight: 400;">news.com.au</span></a><span style="font-weight: 400;">.</span></p> <p><span style="font-weight: 400;">“We’ll see those consumer-friendly ways to push on the edges of that.”</span></p> <p><span style="font-weight: 400;">Experts have said that users are already seeing signs of a crackdown.</span></p> <p><span style="font-weight: 400;">“They are policing this (already) by blocking the third concurrent screen if two screens are in use at the same time,” said Michael Pachter, a top analyst at Wedbush Securities, speaking to </span><a href="https://www.thesun.co.uk/tech/10180393/netflix-account-sharing-price-family-pay-extra/"><span style="font-weight: 400;">The Sun</span></a><span style="font-weight: 400;">.</span></p> <p><span style="font-weight: 400;">“That doesn’t help if the users are in different time zones, as many households with kids in college are.</span></p> <p><span style="font-weight: 400;">“However, it definitely cracks down on widespread password sharing.”</span></p> <p><span style="font-weight: 400;">He added: “They also have a way to track device usage and can require two-factor authentication, although they’ve haven’t rolled that out yet.”</span></p> <p><span style="font-weight: 400;">The news follows an announcement by tech firm Synamedia about a new AI system that cracks down on account sharing by using machine learning technology to track shared passwords on streaming services.</span></p> <p><span style="font-weight: 400;">“Casual credentials sharing is becoming too expensive to ignore,” said product chief Jean Marc Racine, speaking at the CES event in Las Vegas this year.</span></p> <p><span style="font-weight: 400;">“Our new solution gives operators the ability to take action.</span></p> <p><span style="font-weight: 400;">“Many casual users will be happy to pay an additional fee for a premium, shared service.</span></p> <p><span style="font-weight: 400;">“It’s a great way to keep honest people honest while benefiting from an incremental revenue stream.”</span></p> <p><span style="font-weight: 400;">The technology, once it has located shared passwords across streaming services, could be used to force users to upgrade to a premium service or even shut down their account.</span></p>

Technology

Placeholder Content Image

Google Chrome security breach: Why your private passwords are at risk

<p><span style="font-weight: 400;">A new hack has alarmed people who use the internet browser Google Chrome as it has been revealed that anyone can gain access to your online passwords with a few simple clicks. </span></p> <p><span style="font-weight: 400;">All a hacker needs to do is just click in the right spots to gain access to your passwords.</span></p> <p><strong>How to unlock every password on Google Chrome</strong></p> <ul> <li style="font-weight: 400;"><span style="font-weight: 400;">Open Google Chrome</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Click on the Menu (three dots icon in the top right corner of the browser window)</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Click Settings</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Under Autofill, click on Passwords.</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">When asterisked passwords pop up, click on the eye symbol</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">In the Username and Password bar, enter the computer login</span></li> </ul> <p><span style="font-weight: 400;">It’s really that simple. </span></p> <p><strong>However, there are a few ways that you can protect yourself</strong></p> <ul> <li style="font-weight: 400;"><span style="font-weight: 400;">Ensure no one knows your computer password</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Regularly change your password</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Avoid using password auto save or auto fill</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Ensure your computer locks after inactivity</span></li> </ul>

Technology

Placeholder Content Image

The scary new way hackers can find out your passwords

<p><span style="font-weight: 400;">New research from the University of Cambridge in England as well as Sweden’s Linköping University has explained that malware is now capable of accurately guessing your passwords by listening to the sound of your fingers tapping the screen.</span></p> <p><span style="font-weight: 400;">The hackers use the malware to listen via the microphone of your smartphone and use technology that can accurately guess where you’re touching the screen to get every password you use on the smartphone device. </span></p> <p><span style="font-weight: 400;">“We showed that the attack can successfully recover PIN codes, individual letters and whole words,” researchers wrote in the paper, according to </span><a href="https://www.9news.com.au/technology/iphone-android-hackers-can-find-out-your-passwords-by-hearing-how-you-type/bf7c66ce-0d49-4c26-8be2-1dd5c6196d30"><span style="font-weight: 400;">9News</span></a><span style="font-weight: 400;">.</span></p> <p><span style="font-weight: 400;">“We have shown a new acoustic side-channel attack on smartphones and tablets.”</span></p> <p><span style="font-weight: 400;">Research showed that during testing, the machine learning software correctly guessed a four-digit passcode 73 per cent of the time after ten tries.</span></p> <p><span style="font-weight: 400;">The software was also able to identify 30 per cent of passwords that ranged from seven to 13 characters in length after 20 tries.</span></p> <p><span style="font-weight: 400;">The malware is reliant on machine learning to predict which key a user has tapped by tracking which sound the microphone heard first. This is a detail that is picked up in a matter of seconds.</span></p>

Technology

Placeholder Content Image

World's most hackable passwords: Is yours on the list?

<p><span style="font-weight: 400;">Many people still stick to “easy” passwords to secure sensitive accounts, a study has suggested.</span></p> <p><span style="font-weight: 400;">The UK National Cyber Security Centre has released the top 100,000 passwords that have been exposed in data breaches around the world. Using the data from Troy Hunt’s </span><em><a href="https://haveibeenpwned.com/"><span style="font-weight: 400;">Have I Been Pwned</span></a></em> <span style="font-weight: 400;">site, the study aimed to identify the gaps in cyber-security knowledge and help reduce the occurrence of account breaches and exploitation.</span></p> <p><span style="font-weight: 400;">The most popular password on the list was 123456, which was used by more than 23 million breached accounts. On the second place was 123456789, followed by “qwerty”, “password” and 111111.</span></p> <p><span style="font-weight: 400;">The most common name to be used as a password was “ashley” with more than 430,000 appearances. Other top names included “michael”, “daniel”, “jessica” and “charlie”.</span></p> <p><span style="font-weight: 400;">Dan U, senior security researcher at the NCSC said blocking these common passwords would help users protect their accounts. “Security works when people act as a community, whether that's allowing people to realise how common their password is, or just giving them confidence that the password they've picked at work or home is more sensible,” he wrote in </span><a href="https://www.ncsc.gov.uk/blog-post/passwords-passwords-everywhere"><span style="font-weight: 400;">a statement</span></a><span style="font-weight: 400;">.</span></p> <p><span style="font-weight: 400;">More websites and Internet services have been hit with security breaches in recent years, including Facebook, Microsoft, </span><a href="https://money.cnn.com/2017/10/03/technology/business/yahoo-breach-3-billion-accounts/index.html"><span style="font-weight: 400;">Yahoo</span></a><span style="font-weight: 400;"> and more.</span></p> <p><span style="font-weight: 400;">The NCSC recommended choosing three random yet memorable words to create a strong password, such as “walltinshirt” or “coffeetrainfish”, and avoiding credential reuse. </span></p> <p><strong>Top 20 most popular passwords:</strong></p> <ol> <li style="font-weight: 400;"><span style="font-weight: 400;">123456</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">123456789</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">qwerty</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">password</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">111111</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">12345678</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">abc123</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">1234567</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">password1</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">12345</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">1234567890</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">123123</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">000000</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">iloveyou</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">1234</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">1q2w3e4r5t</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">qwertyuiop</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">123</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">monkey</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">dragon</span></li> </ol>

Books

Placeholder Content Image

How to change your iPad password with ease

<p><span style="font-weight: 400;">Whether you keep forgetting your code or found an old iPad that you want to start using again, changing the password is easier than you think.</span></p> <p><strong>If you know the password to your iPad but want to change it</strong></p> <p><span style="font-weight: 400;">If you already know your password but want to change it, that’s simple to do once you know the steps.</span></p> <ol> <li style="font-weight: 400;"><span style="font-weight: 400;">Log into your iPad with the current password</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Go to the “Settings” app which looks like grey gears</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Scroll down until you find “Passcode”. This can be called “Touch ID &amp; Passcode” on newer devices</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Enter in your current passcode and scroll down to “Change Passcode”. You will enter in your current passcode again (they’re very secure).</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">You can now enter in your new code. Your code can be 6-digit numbers, a custom alphanumeric code, a custom numeric code or the standard 4-digit numeric code.</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Enter in your new password twice and you have successfully changed your passcode.</span></li> </ol> <p><strong>If you don’t know the passcode and forgotten it</strong></p> <p><span style="font-weight: 400;">The only way to fix this is to restore your iPad to factory settings. Make sure you’ve backed it up before you’ve done this, otherwise you will lose all of your data.</span></p> <p><span style="font-weight: 400;">However, if you’re definitely unable to remember the code, say goodbye to your data on the iPad.</span></p> <p><span style="font-weight: 400;">There are two ways to reset your iPad. One is via iTunes and the other is via your iCloud account online.</span></p> <p><strong>Method one: via iTunes</strong></p> <ol> <li style="font-weight: 400;"><span style="font-weight: 400;">Plug in your iPad and load up iTunes.</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Open the device in iTunes by clicking on the little icon underneath the sound bar.</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Once you have opened the device, click on “Restore iPad”.</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">iTunes will warn you that you will lose all of your data by doing this. Click on the “restore” button anyway.</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Your iPad will start up as a brand-new device, which you can access from iTunes</span></li> </ol> <p><strong>Method two: via iCloud account online</strong></p> <p><span style="font-weight: 400;">You are able to remotely erase the data on your iPad thanks to iCloud.com. This method is usually used if the device has been stolen or is lost but can also be used to erase data off your iPad.</span></p> <ol> <li style="font-weight: 400;"><span style="font-weight: 400;">Go to iCloud.com and log into your iCloud account. This is the same as your Apple ID.</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Click on “Find my iPhone”, which is located at the top of the screen. Click “All devices” and select your iPad’s name.</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Click on “Erase iPad”.</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">You will be warned that your data will be lost, and you will be unable to track your device anymore. Click on “erase”.</span></li> <li style="font-weight: 400;"><span style="font-weight: 400;">Your device is now restored to factory settings.</span></li> </ol> <p><span style="font-weight: 400;">Did you know of the iCloud method for restoring your iPad? Let us know in the comments.</span></p>

Technology

Placeholder Content Image

The top 10 worst passwords for 2018

<p>Coming up with (and remembering!) a hard password can be difficult. Most of us tend to stick to easy to remember patterns or words that we use in our everyday lives. However, this makes your accounts easier to hack into.</p> <p>SplashData, who are a password management and security system organisation, took the time to evaluate over 5 million passwords that had been leaked on the internet. This was to evaluate what trends and habits users continued to fall into. It appears that none of us have learned to make more secure passwords, especially with five of the passwords in a row being numbers.</p> <p>Without further ado, the worst passwords for 2018 are:</p> <ol> <li>123456</li> <li>password</li> <li>123456789</li> <li>12345678</li> <li>12345</li> <li>111111</li> <li>1234567</li> <li>sunshine</li> <li>qwerty</li> <li>iloveyou</li> </ol> <p>The CEO of SplashData, Morgain Slain, explained why you should stay away from pop culture or movie references in your passwords as well.</p> <p>“Hackers have great success using celebrity names, terms from pop culture and sports, and simple keyboard patterns to break into accounts online because they know so many people are using those easy-to- remember combinations,” he said.</p> <p>It’s with these tips and tricks that hackers can gain access to your accounts. However, Slain states that the reason they publish the worst passwords is to raise awareness.</p> <p>“Our hope by publishing this list each year is to convince people to take steps to protect themselves online,” says Slain. “It’s a real head-scratcher that with all the risks known, people continue putting themselves at such risk year-after-year.”</p> <p>If you see your password in the top 10, maybe take this as a sign that it’s not as secure as once thought. Check out the full <a rel="noopener" href="https://www.teamsid.com/100-worst-passwords/" target="_blank">list here</a>.</p>

Technology

Placeholder Content Image

How to find the right online password

<p><em><strong>Alastair MacGibbon, Director at the Centre for Internet Safety, University of Canberra, explains how to find the right online password.</strong></em></p> <p>In 2004 Bill Gates pronounced <span style="text-decoration: underline;"><strong><a href="http://news.cnet.com/2100-1029-5164733.html" target="_blank">usernames and passwords dead</a></strong></span>. Gates, a man consistently thinking ahead of the crowd, was right. Most of us – including our employers and the online services we rely on – just haven’t caught up yet.</p> <p>Gates’ statement came at a time when the devastatingly simple consumer-focussed attack of <span style="text-decoration: underline;"><strong><a href="http://www.pcmag.com/encyclopedia/term/49176/phishing" target="_blank">phishing</a></strong></span> started. Designed to trick users out of their usernames and passwords, this was a turning point in cybercrime. Criminals showed an understanding that the end user – whether in a work or home environment – was a profitable target, and a softer one than central computer systems.</p> <p>Malicious software designed to steal usernames and passwords has augmented phishing. If the end user could be compromised, entry through the protected gates of corporate and government systems would be easier, sometimes guaranteed.</p> <p>Layered onto this security problem has been the increasing number of services we use that require passwords. As we all know, even after Gates’ prediction, the number of passwords we need to remember has gone up, not down.</p> <p><strong>How many passwords?</strong></p> <p>Usernames and passwords are still the key to protect most of what we do at home and work, despite the sheer number of massive breaches disclosed such as the <span style="text-decoration: underline;"><strong><a href="http://www.bloomberg.com/news/2014-10-02/jpmorgan-says-data-breach-affected-76-million-households.html" target="_blank">recent hacking</a></strong></span> of US bank JPMorgan.</p> <p>There is also the untold number that are brushed under the carpet and those that have gone unnoticed by the victim companies, in addition to all of the end users such as you and I who have unwittingly handed over our credentials via phishing.</p> <p>It would be fair to conclude that hundreds of millions of usernames and passwords have been exposed over the past few years with websites tracking the <span style="text-decoration: underline;"><strong><a href="http://www.privacyrights.org/data-breach/" target="_blank">data breaches in the US</a></strong></span> and <span style="text-decoration: underline;"><strong><a href="http://www.breachlevelindex.com/#sthash.fgWcE9Oh.BkvSSzva.dpbs" target="_blank">records lost</a></strong></span>. The numbers are so big accuracy is unimportant. We should just agree that there are a lot of them.</p> <p>So how do we go when it comes to our password discipline? Do we use complex, hard to guess passwords that combine letters, numbers and symbols? A different one for each account? Changed regularly?</p> <p>No, no and no.</p> <p>We know from the hackers who dump unencrypted passwords onto sites such as pastebin what the <span style="text-decoration: underline;"><strong><a href="http://www.news.com.au/technology/online/password-the-most-popular-passwords-of-2013/story-fnjwnfzw-1226807251451" target="_blank">most popular passwords are</a></strong></span> and they make you shudder:</p> <ol start="1"> <li>123456</li> <li>password</li> <li>12345678</li> <li>qwerty</li> <li>abc123</li> </ol> <p>We know from surveys that <span style="text-decoration: underline;"><strong><a href="http://www.zdnet.com/blog/security/survey-60-percent-of-users-use-the-same-password-across-more-than-one-of-their-online-accounts/9489" target="_blank">nearly two thirds</a></strong></span> (60%) of Australians use the same password across more than one of their online accounts. This means we are recycling our passwords. This isn’t a naming and shaming exercise, but we know who we are.</p> <p><strong>Are websites serious about security?</strong></p> <p>But it gets worse. Websites who use usernames and passwords are worried about one thing other than accounts being taken over, and that is a legitimate user not having access to their account.</p> <p>So the user forgets their password. No problem – click on the link and websites will generally do one of two things: email a password to your registered address, or ask you answers to what is known in the industry as “shared secrets”.</p> <p>They’re things such as your birth date, your mother’s maiden name, your dog’s name, your old school – questions you were asked at the time of registering the account.</p> <p>Now, emailing you a link to your email address seems fine, except it may be that the criminal also controls that email address (because they tricked you out of the password, or guessed it because you’ve given them the password for a different account, which has the same password).</p> <p>Now the criminal merely clicks on the link and resets the passwords. At this point the criminal might change the account details to make sure all future notifications go to them. Or they merely delete the “you have changed your password email” from your email account.</p> <p><strong>Not so secret secrets</strong></p> <p>So what about the “shared secret” process? If the criminal already controls another of your accounts, they may be able to simply look up the answers you gave to that account. More likely, they will just research you on the internet.</p> <p>You see, the problem with shared secrets is that we’ve started to share them a little too widely to still call them secrets.</p> <p>LinkedIn, Facebook, Twitter, electronic newsletters, blogs and so on all tend contain useful information that can be seen by others. The age of social media and the phenomenon of over-sharing came after the shared secret lock became the default for account security.</p> <p>Further still, if our password isn’t strong, and the web service hasn’t implemented the right controls, criminals can use what are called “brute force” attacks against accounts to try to force their way in.</p> <p>They do this by running a password “dictionary” against a site. It’s like trying hundreds of thousands of combinations against a combination lock. If a password isn’t complex, the criminal is in. See how long it would take a password similar to yours to be hacked with security firm Kaspersky’s <span style="text-decoration: underline;"><strong><a href="http://blog.kaspersky.com/password-check/" target="_blank">password check</a></strong></span> (don’t use your real password).</p> <p><strong>Passwords and underwear</strong></p> <p>They say passwords are like underwear: change them often. I agree, we should. But we know we don’t (change passwords, that is). So let’s try doing it twice a year to start with.</p> <p>Regularly changing passwords means that even if criminals trick you out of them via phishing, or steal them by compromising your computer or the organisation holding your data, the password they have simply won’t work.</p> <p><span style="text-decoration: underline;"><strong><a href="http://www.nytimes.com/2014/08/06/technology/russian-gang-said-to-amass-more-than-a-billion-stolen-internet-credentials.html" target="_blank">Criminals compile lists</a></strong></span> of usernames and passwords and trade them on the internet black market. Lists with old passwords have less value.</p> <p>The next step is coming up with stronger passwords, and having a unique one for each account. We can do this by using a pass-phrase system.</p> <p><strong>Your pA$$woRd!</strong></p> <p>Start with a phrase from a song or movie you like, or something similar. I’m going to use the phrase “the quick brown fox jumped over the lazy dog”.</p> <p><strong>Take the first letter from each word:</strong></p> <p><em>tqbfjotld</em></p> <p>Capitalise the first or any letter and add some punctuation:</p> <p><em>Tqbfjotld!</em></p> <p>It’s starting to look complex.</p> <p>Now do some number substitution using a system you devise. Maybe you look at your computer’s keyboard and decide to substitute any letters in your phrase which are below a number on the keyboard.</p> <p>So in this case our “q” becomes “1” and our “o” becomes “9”:</p> <p>T1bfj9tld!</p> <p>Now you have a password that is random letters, uses a capital and has numbers and symbols.</p> <p>But how do you make it unique for each and every website? Perhaps you do something like the name of the website in front, using the same number substitution as above.</p> <p>So, if this was my eBay account, I would add 3Bay to the password which now becomes:</p> <p>3BayT1bfj9tld!</p> <p>Take the next step</p> <p>Many websites now offer optional two-step authentication, such as an SMS code sent to your phone to gain access to the account, or if changes are made to the account.</p> <p>Always, always, always use these options if available.</p> <p>Of course, none of this is foolproof. Criminals have been known to take control of a victim’s mobile phone service so that they can intercept the authentication SMS and there are “man in the middle” attacks where hackers intercept passwords and codes to open another parallel session.</p> <p>But the two-step security is way better than just a user name and password.</p> <p>At a consumer level more robust biometric security on devices (such as fingerprint readers) is increasingly ubiquitous. Some companies providing services over the phone have started to explore voice biometrics.</p> <p>There are no silver bullet biometrics to full-proof account security. No doubt criminals will innovate and find cracks to exploit, but online crime is a volume game and our responsibility is to drive that volume down.</p> <p>Was Bill Gates right about passwords? Yes, but not for a while yet. Until that password-free world arrives, none of us can afford to let our guard down.</p> <p>Do you think you’ll try these tips?</p> <p><em>Written by Alastair MacGibbon. Republished with permission of <a href="http://www.theconversation.com" target="_blank"><strong><span style="text-decoration: underline;">The Conversation</span></strong></a>.</em><img width="1" height="1" src="https://counter.theconversation.com/content/31954/count.gif?distributor=republish-lightbox-advanced" alt="The Conversation"/></p>

Technology

Placeholder Content Image

Why password sharing is becoming more common

<p>You'd forgive me for being perturbed when I recently noticed someone accessing their partner's smartphone using their fingerprint.</p> <p>Knowing your loved one's passcode for reasons of occasional access to their phone – say, when they are driving – is one thing. Having your fingerprint pre-loaded on their phone so it can be scanned for instant access? That tells me you're either way too close, or don't have enough trust in each other.</p> <p>Yet the sharing of passwords is common in most households. A Pew Research study found that 67 per cent of couples in committed relationships have shared passwords.</p> <p>Sharing passwords and other login details on everything from social media to streaming services makes sense for a lot of couples. It's probably out of convenience: sometimes your partner will ask you to log on to their computer and find an email, others you might want to buy and stream a movie on Google Play and you only have one account between you.</p> <p>The reality of password sharing is that 95 per cent of us share up to six passwords with others, according to password management service LastPass.</p> <p>The most commonly shared passwords are for wi-fi networks (58 per cent), followed closely by TV/film streaming accounts (48 per cent), financial accounts like online banking (43 per cent), and e-mail addresses (39 per cent).</p> <p>Who's doing this password sharing? Time magazine data says it matters little what age you are. Sixty-four percent of 18-29-year-olds share passwords, compared with 70 per cent of 30-49-year-olds, 66 per cent of 50-64-year-olds, and 69 per cent of people 65-plus.</p> <p>From an interpersonal point of view, the sharing of passwords likely means you have nothing to hide, and that's usually a good thing. From a privacy and security perspective, it also means you're ignoring a lot of risks.</p> <p>While 74 per cent of passwords are shared verbally, 15 per cent are shared by pen and paper, 5.8 per cent by text, and 4.4 per cent by e-mail. Only two per cent are shared using secure password sharing services.</p> <p>What's more, although 73 per cent of people agree that password sharing is risky, that same 73 per cent are unlikely to change a password after sharing it with someone.</p> <p>That's extremely problematic when it comes to the kind of data that is available over one's wi-fi network or financial accounts, and even more so because 59 per cent of people re-use their passwords across different online accounts.</p> <p>That means, giving somebody your Netflix password could likely mean you've given them your Twitter login and iTunes password, too.</p> <p>When it comes to sharing passwords amongst people who don't live in the same households, Reuters/Ipsos research suggests not many of us do it, but it does happen.</p> <p>Just 12 per cent of adults overall password-share for TV/film streaming services in this way, although 24 per cent of young people 18-24 do it.</p> <p>In the fine print of most tech companies' terms and conditions, there's often a stipulation that you're agreeing that only you will use that account. But this is something there's no policing on, and many services allow multiple access from different locations at one time without issues.</p> <p>From a personal perspective, there's only one area in my life where I share passwords - paywalled news sites.</p> <p>I have a group of about five friends and all of us subscribe to a different international outlet (they're usually around $10-15 a month), so we're all getting a "pay for one, get access to five" ad-hoc deal.</p> <p>Rationally, none of us would subscribe to all services and pay over $50 a month for our online news. At least we're paying something for quality journalism, we argue, and we are still being served up advertising on paywalled sites and aren't getting a completely free ride.</p> <p>The method we do this is theoretically the safest way to share passwords, if there is such a thing, and – if you're going to share any kind of them – how I'd advise you do proceed.</p> <p>We create a unique password for every service that does not feature elsewhere in anybody's digital lives. It's for that service, and that one only. Passwords are shared only in person, not via digital communication, and changed regularly.</p> <p>If we were to really take security seriously, though, we all acknowledge that what we're doing still counts as unsafe online behaviour and we shouldn't be doing it at all.</p> <p>Do you share passwords with your loved ones?</p> <p><em>Written by Lee Suckling. First appeared on <a href="http://Stuff.co.nz" target="_blank"><strong><span style="text-decoration: underline;">Stuff.co.nz</span></strong></a>.</em></p>

Technology

Placeholder Content Image

The top 25 most common online passwords have been revealed

<p>Everyone seems to have multiple email addresses and social media accounts these days, so it’s no surprise that when it comes time to make a new password for one of these many of us remain stumped and go with something generic.</p> <p>But there’s a reason you should be striving for a password that’s as unique as possible.</p> <p><a href="http://www.splashdata.com/" target="_blank"><span style="text-decoration: underline;"><em><strong>SplashData</strong></em></span></a>has come up with a list of the most-popular passwords in the world, based on a survey of over five million passwords sourced from global data leaks.</p> <p>And some of them are absolute shockers.</p> <p>To see the top 25 most common online passwords,<strong> scroll through the gallery above</strong>. And it goes without saying, if your password is on the list, change it immediately.</p> <p>Have you ever had privacy issues online?</p>

Technology

Placeholder Content Image

New online tool lets you find out if your password has been hacked

<p>A new online tool lets you find out if your password has been hacked and published online, as well as the steps to take if you have been caught out.</p> <p>Digital security expert Troy Hunt, founder of Have I Been Pwned, said users enter their details into a search box on his website, which is then cross-referenced with a database of leaked passwords online.</p> <p>The website will tell if your account details have been hacked and how to protect yourself.</p> <p>“Pwned Passwords are hundreds of millions of real world passwords exposed in data breaches. This exposure makes them unsuitable for ongoing use as they're at much greater risk of being used to take over other accounts. They're searchable online below as well as being downloadable for use in other online system. Do not send any password you actively use to a third-party service - even this one!” the website reads.</p> <p>Mr Hunt wrote on his blog, “If the password alone comes back with a hit on this service, that’s a very good reason to no longer use it regardless of whose account it originally appeared against.</p> <p>“As well as people checking passwords they themselves may have used, I’m envisaging more tech-savvy people using this service to demonstrate a point to friends, relatives and co-workers: ‘you see, this password has been breached before, don’t use it’.”</p> <p>While the service is doing a public good, Mr Hunt warns against sharing your current passwords on any third-party website.</p> <p> “It goes without saying (although I say it anyway on that page), but don’t enter a password you currently use into any third-party service like this!</p> <p>“I don’t explicitly log them and I’m a trustworthy guy but yeah, don’t.</p> <p>“The point of the web-based service is so that people who have been guilty of using sloppy passwords have a means of independent verification that it’s not one they should be using any more.</p> <p>“Mind you, someone could actually have an exceptionally good password but if the website stored it in plain text then leaked it, that password has still been ‘burned’.”</p> <p><strong><em>To test old passwords, visit <span style="text-decoration: underline;"><a href="https://haveibeenpwned.com/Passwords">Have I Been Pwned.</a> </span></em></strong></p>

Technology

Placeholder Content Image

Foreigners visiting the US may have to give up phones and passwords

<p>The Trump administration may require foreigners visiting the US to give up their contacts on their mobile phones and social media passwords as part of the president’s promise of extreme vetting.</p> <p>The <span style="text-decoration: underline;"><strong><a href="https://www.wsj.com/articles/trump-administration-considers-far-reaching-steps-for-extreme-vetting-1491303602" target="_blank">Wall Street Journal</a></strong></span> reports that visitors to the US, even on short trips, could be forced to disclose contacts, social media passwords, financial records, and answer more security questions, including question on ideology.</p> <p>The procedure would include foreigners entering the US from close allies such as Australia, Britain, Germany and France.</p> <p>Gene Hamilton, senior counsellor to ​Department of ​Homeland Security Secretary John Kelly​, told the publication​: “If there is any doubt about a person’s intentions coming to the United States, they should have to overcome​ – ​really and truly prove to our satisfaction​ – ​that they are coming for legitimate reasons.”</p> <p>He added, the aim it to "figure out who you are communicating with. What you can get on the average person's phone can be invaluable."</p>

News

Placeholder Content Image

How hackers can get into your accounts without the password

<p>On Wednesday morning, high-profile Twitter accounts were hacked and then flooded with swastika-laden propaganda.</p> <p>Twitter accounts such as Duke University, Forbes and Amnesty International were victims of this latest online scandal.</p> <p>These accounts are most likely protected by high security measures including two-factor authentication and strong protections. Although these measures are important, hackers have found a way to bypass them.</p> <p>Hackers are now using app permissions to infiltrate online accounts. App permissions involve logging into an app or service by using one of your key social accounts such as your Google, Facebook or Twitter account. This feature allows you to worry about fewer passwords and sometimes is necessary for apps to work with other accounts, but it also presents security issues.</p> <p>This recent hack was caused by an app called “Twitter Counter”. This app provides analytics of Twitter accounts and the app not only requests permission to see your data, but to also Tweet. This feature could prove helpful if you want to send out tweets inside the app but this is how these high-profile accounts were compromised.</p> <p>Apps that have permissions are generally limited in the access they have over your account. In most cases, they don’t have the ability to change your password and they also never get your real password. Your main account just gives them a generated one once you use that account to sign up. Although you can still have control over your password and regain your account back, once an account has been infiltrated, the world has already seen the information the hacker has posted on your profile.</p> <p><strong>The solution</strong></p> <p>Take a look at what apps have access to the accounts you use online. Revoke as many permissions as you can and create a practice of checking it regularly.</p> <p>On Twitter, click on your avatar on the top right next to the “Tweet button” and then press <strong>Settings and privacy</strong>. Look at the list on the left side and then select <strong>Apps</strong> and you can scroll through and revoke access to any apps that don’t need to be linked to your Twitter account.</p> <p>On your Google account, conduct a <a href="https://myaccount.google.com/secureaccount" target="_blank"><strong><span style="text-decoration: underline;">Security Check-up</span></strong></a> which will automatically run through your app permissions. Then revoke the apps that have permission to use your account.</p> <p>On your Facebook account, click on the question mark menu on the left side of your notifications icon and select <strong>Privacy</strong>. On the left-hand side select <strong>Apps</strong> and then press <strong>Show All</strong> at the bottom of the box that is marked with <strong>Logged in with Facebook</strong>. Get rid of any apps that you don’t need on the list. </p>

Technology

Placeholder Content Image

Clever map shows Wi-Fi passwords from airports around the world

<p>A travel blogger has come up with a solution to one of the most common travel problems – hundreds of Wi-Fi hotspots and no password. Computer security engineer Anil Polat has devised an interactive map to put an end to outrageous airport Wi-Fi fees once and for all.</p> <p>Polat regularly updates the map, which currently has passwords from dozens of airports around the world and offers users full instructions on how to log in to the network and where to get the best connection.</p> <p><iframe src="https://www.google.com/maps/d/embed?mid=1Z1dI8hoBZSJNWFx2xr_MMxSxSxY&amp;hl=en_US" width="640" height="480"></iframe></p> <p>So forget those pricey roaming charges, just use this map the next time you take off and you’ll have full internet access during those pesky stopovers.</p> <p><strong>Related links:</strong></p> <p><a href="/travel/international/2016/10/best-or-worst-time-to-visit-europe/"><span style="text-decoration: underline;"><em><strong>How safe it is to travel to Europe</strong></em></span></a></p> <p><a href="/travel/international/2016/10/why-i-will-never-use-a-money-belt-again/"><span style="text-decoration: underline;"><em><strong>Why I’ll never use a money belt again</strong></em></span></a></p> <p><a href="/travel/international/2016/10/10-foods-every-traveller-has-to-try/"><em><span style="text-decoration: underline;"><strong>10 foods every traveller has to try (at least once)</strong></span></em></a></p>

International Travel

Placeholder Content Image

Trick for a password that’s easy to remember but hard to crack

<p>Computer experts and tech-savvy users have long lamented the absurdity of teaching people to use passwords that are hard for humans to use but easy for computers to guess.</p> <p>But relief is in sight with the rise of the passphrase - a new password standard that champions length over complexity.</p> <p>Rather than requiring passwords to include capital letters and special symbols - like so: !f33dM3! - passphrases require more characters, usually between 16 and 64 (like this: nooneunderstandshowmuchilovebacon).</p> <p>New research from Carnegie Mellon University is the latest to confirm that passphrases make excellent passwords for two reasons. Firstly, length is almost as good as randomness at resisting hacking attacks. And, secondly, words and phrases are far easier for humans to remember.</p> <p>Cyber security expert Matthew Warren, professor of information systems at Deakin University, said traditional passwords were more susceptible to "brute force" cracking programs. </p> <p>Brute force attacks systematically test every possible combination of letters, numbers and symbols until they find the one that works. It's akin to trial-and-error on steroids, which is why length matters: longer passwords are exponentially more difficult to crack.</p> <p>"Because algorithms can be applied, a brute attack can break those passwords just through sheer logical sequence," Professor Warren said.</p> <p>"But with passphrases… there's a greater number of possibilities of what that password could be. So the passphrase is much, much more secure."</p> <p>Traditional passwords try to force us to choose more complex passwords by requiring the use of special characters and upper and lower case characters. However, this also has the unintended consequence of encouraging people to commit another security faux-pas, Professor Warren said.</p> <p>"People are bad at remembering [complex passwords] and also, people are lazy. So they might remember one complex password but then they use that one password for every account," he said.</p> <p>"Users go for the path of least resistance."</p> <p>Earlier this year, the National Institute for Standards and Technology in the US, which oversees government computer policy, recommended overhauling passwords and abandoning the practice of forcing users to change their passwords regularly.</p> <p>Security experts and privacy advocates have welcomed the move.</p> <p>"Passwords today are "completely unusable", NIST senior adviser Paul Grassi told The Washington Post.</p> <p>"Users forget, which creates all sorts of cyber security problems, like writing it down or reusing them."</p> <p>The trick with passphrases is to avoid popular or common phrases, such as song lyrics or idioms.</p> <p>Michelle Mazurek, one of the Carnegie Mellon University researchers now at the University of Maryland College Park, recommended users test potential passphrases by typing the first part into Google and seeing if the search engine auto-completes it.</p> <p>Of course, the passphrase also has disadvantages, Professor Warren said. Again, it comes down to human error.</p> <p>"Many password authentication systems… only accept typed passwords, so there's a greater chance of people making a typing mistake when entering a long phrase of text."</p> <p>Nevertheless, there are stirrings of change among government agencies and businesses overseas, which are increasingly likely to allow longer passwords.</p> <p>"Once it's been adopted in America or Europe, the rest of the world starts to use it," Professor Warren said.</p> <p><em>Written by Inga Ting. First appeared on <a href="http://Stuff.co.nz" target="_blank"><strong><span style="text-decoration: underline;">Stuff.co.nz</span></strong></a>.</em></p> <p><strong>Related links:</strong></p> <p><a href="/entertainment/technology/2016/04/how-to-remember-your-passwords/"><span style="text-decoration: underline;"><strong><em>How to remember your passwords</em></strong></span></a></p> <p><a href="/news/news/2016/03/access-your-iphone-without-a-password/"><strong><em><span style="text-decoration: underline;">How someone can access you iPhone without a password</span></em></strong></a></p> <p><a href="/news/news/2016/01/25-worst-online-passwords-used-in-2015/"><span style="text-decoration: underline;"><em><strong>25 worst online passwords used in 2015</strong></em></span></a></p>

Technology

Placeholder Content Image

How to remember your passwords

<p>Life used to be simple. We could visit a bank and sign for our money. When eftpos and ATMs appeared, our first passwords were four-digit pin codes.</p> <p>A friend's dad, who was a chief executive of a large Christchurch company, had a special method to remember his Pin. He wrote it on the back strip of his eftpos card right next to his signature.</p> <p>Life is not so simple any more. Most of us have many usernames and passwords to remember, especially for the internet.</p> <p>My brother, who works in a large London bank, has to use randomly generated passwords such as J4$pQ1!b for various internal banking systems. He has the ability to transfer millions to accounts in, say, Zimbabwe. Understandably, his employer requires staff to have highly secure passwords.</p> <p>The problem is that my brother has eight unique passwords, which are virtually impossible to remember, all of which are changed every month.</p> <p><strong>Password software</strong></p> <p>Password management is a problem even for regular people, and unfortunately there is not a simple solution. The best practice these days is using password management software.</p> <p><strong>Four tiers</strong></p> <p>Another strategy is to keep four separate password tiers. Password strength is highest for the first tier and lowest for the fourth tier.</p> <p>Tier 1 is for banking. Tier 2 is for primary email accounts. Tier 3 is for Trade Me-type websites (where commerce could be conducted in your name), social networking sites such as Facebook (to protect your online reputation), and blog sites (where what you type reflects on you or your employer). Tier 4 is for newsletter and subscription websites, fun sites such as YouTube.</p> <p>Why should primary email accounts have Tier 2 protection?</p> <p>Once a hacker obtains access to your email account, he may be able to access your internet accounts and passwords through the "password reset" facility that feature on almost all websites.</p> <p><strong>Password construction</strong></p> <p>Good passwords:</p> <ul> <li>Combine mixed-case alphabetic characters, numbers, symbols such as @ and include punctuation characters where allowed.</li> <li>Are at least seven characters long.</li> <li>Do not include your username or ID in any form, whether reversed, capitalised or doubled.</li> <li>Are never be based on a spouse, child or relative's name - unless your cousin's nickname is Cuz Y#Pi5+Q.</li> <li>Never contain keyboard sequences such as qwerty.</li> <li>Are hard to guess even by someone who knows you well.</li> <li>Never contain words – including profanities – found in English or foreign dictionaries. Password- cracking software will try all of these words and usually crack dictionary- based passwords within minutes.</li> <li>Are never written on a sticky note, desk blotter or other item close to your PC.</li> </ul> <p><strong>Remembering passwords</strong></p> <ul> <li>Use the first letter of each word of a line that is personal to you, such as from a favourite movie, poem, religious scripture, slogan, or a special event in your life such as your child's first spoken sentence. For example, Bryan Adams' song Summer of '69 contains the chorus line "Back in the summer of '69!", which would be Bitso'69! as a password and would be suitable for Tier 3 passwords.</li> <li>Create an imaginary car licence plate using numbers, symbols and letters, such as 1LoveMyC@t! This would be suitable for your email account password as it is longer and more complex than the Bryan Adams example, but probably doesn't suit known cat lovers.</li> <li>Join a series of words together using symbols and substituting numbers for vowels. For example, "Half a dozen Speight's" could translate to 1/2dozSp31ghts which, as a password, measures "best" on the Microsoft Password strength indicator due to its length and complexity. It's suited for online banking.</li> <li>To distinguish between workplace and personal passwords, append a W to the end of workplace passwords and a P to personal passwords. Better yet append -W and -P. Even better, make up your own system. This will increase the length and complexity of your passwords yet still retain an easy-to-remember formula.</li> <li>Above all, use an easy-to-remember method to construct your passwords that is personal to you and obscure to others.</li> </ul> <p><strong>Best practices</strong></p> <p>When prompted for a "security question" or "password hint" use something that is not public knowledge. Use your first car or first pet's name, but never your current car or current pet's name, which could well be obtained from your Facebook profile or through other means.</p> <p><strong>Change your passwords regularly</strong></p> <p>If you feel the need to write your passwords down, never identify them as passwords or usernames on the same piece of paper (and don't store passwords on a computer with a file name such as Passwords).</p> <p><strong>And don't ever:</strong></p> <ul> <li>Use the same password for everything.</li> <li>Use your top three tier passwords on public computers, internet cafes, hotel lobbies or airport lounges.</li> <li>Provide any of your passwords by email or by phone. A reputable online company will never ask for your password by email and a Help Desk doesn't need your password to help you.</li> <li>Reveal the method you use to create your passwords to anyone.</li> </ul> <p><em>Written by Matt Long. First appeared on <a href="http://www.stuff.co.nz/" target="_blank"><strong><span style="text-decoration: underline;">Stuff.co.nz.</span></strong></a></em></p> <p><strong>Related links:</strong></p> <p><a href="http://www.oversixty.co.nz/entertainment/technology/2016/01/myths-about-facebook/"><strong><em><span style="text-decoration: underline;">3 myths about Facebook busted</span></em></strong></a></p> <p><a href="http://www.oversixty.co.nz/entertainment/technology/2016/01/great-tip-for-using-youtube/"><strong><em><span style="text-decoration: underline;">YouTube tips you didn’t know</span></em></strong></a></p> <p><a href="http://www.oversixty.co.nz/entertainment/technology/2016/01/computer-shortcuts/"><strong><em><span style="text-decoration: underline;">10 computer shortcuts to save you time</span></em></strong></a></p>

Technology

Over 60

© Copyright 2024 OverSixty.All Rights Reserved.