Posts

Have Your Online Passwords Been Stolen? Here’s How to Find Out.

/in /by

Data breaches have become commonplace, with online thieves constantly breaking into corporate and government servers and making off with millions—or even hundreds of millions!—of email addresses, often along with other personal information like names, physical address, and passwords.

It would be nice to think that all companies properly encrypt their password databases, but the sad reality is that many have poor data security practices. As a result, passwords gathered in a breach are often easily cracked, enabling the bad guys to log in to your accounts. That may not seem like a big deal—who cares if someone reads the local newspaper under your name? But since many people reuse passwords across multiple sites, once one password associated with an email address is known, attackers use automated software to test that combination against many other sites.

This is why we keep beating the drum for password managers like 1Password and LastPass. They make it easy to create and enter a different random password for every Web site, which protects you in two ways.

  • Because password managers can create passwords of any length, you don’t have to rely on short passwords that you can remember and type easily. The longer the password, the harder it is to crack. A password of 16–20 characters is generally considered safe; never use anything shorter than 13 characters.
  • Even if one of your passwords was compromised, having a different password for every site ensures that the attackers can’t break into any of your other accounts.

But password security hasn’t always been a big deal on the Internet, and many people reused passwords regularly in the past. Wouldn’t it be nice to know if any of your information was included in a data breach, so you’d know which passwords to change?

A free service called Have I Been Pwned does just this (“pwned” is hacker-speak for “owned” or “dominated by”—it rhymes with “owned”). Run by Troy Hunt, Have I Been Pwned gathers the email addresses associated with data breaches and lets you search to see if your address was stolen in any of the archived data breaches. Even better, you can subscribe to have the service notify you if your address shows up in any future breaches.

Needless to say, you’ll want to change your password on any site that has suffered a data breach, and if you reused that password on any other sites, give them new, unique passwords as well. That may seem like a daunting task, and we won’t pretend that it isn’t a fair amount of work, but both 1Password and LastPass offer features to help.

In 1Password, look in the sidebar for Watchtower, which provides several lists, including accounts where the password may have been compromised in a known breach, passwords that are known to have been compromised, passwords that you reused across sites, and weak passwords.

LastPass provide essentially the same information through its Security Challenge and rates your overall security in comparison with other LastPass users. It suggests a series of steps for improving your passwords; the only problem is that you need to restart the Security Challenge if you don’t have time to fix all the passwords at once.

Regardless of which password manager you use, take some time to check for and update compromised, vulnerable, and weak passwords. Start with more important sites, and, as time permits, move on to accounts that don’t contain confidential information.

Social Media: Have any of your online passwords been stolen in a breach? The answer is probably “yes,” and today’s article helps you discover and correct your most problematic passwords.

Install Minor Operating System Updates to Maintain Herd Immunity

/in , , /by

It seems like Apple releases updates to iOS, macOS, watchOS, and tvOS nearly every week these days. It has been only a few months since iOS 11 and macOS 10.13 High Sierra launched, and we’ve already seen ten updates to iOS and seven updates to macOS. Some of these have been to fix bugs, which is great, but quite a few have been prompted by the need for Apple to address security vulnerabilities.

Have you installed all these updates, or have you been procrastinating, tapping that Later link on the iPhone and rejecting your Mac’s notifications? We’re not criticizing—all too often those prompts come at inconvenient times, although iOS has gotten better about installing during the night, as long as you plug in your iPhone or iPad.

We know, security is dull. Or rather, security is dull as long as it’s present. Things get exciting—and not in a good way—when serious vulnerabilities come to light. That’s what happened in November 2017, when it was reported that anyone could gain admin access to any Mac running High Sierra by typing root for the username and leaving the password field blank. That one was so bad that Apple pushed Security Update 2017-001 to every affected Mac and rolled the fix into macOS 10.13.2.

Part of the problem with security vulnerabilities is that they can be astonishingly complex. You may have heard about the Meltdown and Spectre hardware vulnerabilities discovered in January 2018. They affect nearly all modern computers, regardless of operating system, because they take advantage of a design flaw in the microprocessors. Unfortunately, the bad guys—organized crime, government intelligence agencies, and the like—have the resources to understand and exploit these flaws.

But here’s the thing. Security is an arms race, with attackers trying to take advantage of vulnerabilities and operating system companies like Apple, Microsoft, and Google proactively working to block them with updates. If enough people install those updates quickly enough, the attackers will move on to the next vulnerability.

The moral of the story? Always install those minor updates. It’s not so much because you will definitely be targeted if you fail to stay up to date, but because if the Apple community as a whole ceases to be vigilant about upgrading, the dark forces on the Internet will start to see macOS and iOS as low-hanging fruit. As long as most people update relatively quickly, it’s not worthwhile for attackers to put a lot of resources into messing with Macs, iPhones, and iPads.

That said, before you install those updates, make sure to update your backups. It’s unusual for anything significant to go wrong during this sort of system upgrade, but having a fresh backup ensures that if anything does go amiss, you can easily get back to where you were before.