Good Password Practice

My customers are getting a lot of scam e-mails that say, in essence:

“I an a hacker and I know your password is tulip123. I have recorded you looking at porn. If you don’t send me £1,000 in the next 24 hours, I’ll send an embarrassing video of you to all your friends and contacts”.

In my example, the person getting the e-mail really does have a password of tulip123, so it’s all a bit worrying.

The e-mail is a try-on, of course: the “hacker” doesn’t have an embarrassing video of you. But how does he (or she, but I’ll use “he” here) know your password?

Well, he doesn’t. He’s not even a hacker; he’s most likely bought a list of e-mail addresses and password from somewhere, and is e-mailing each one to try to extort money. I guess it works, or at least the perpetrators think it will, because it’s very widespread.

Note he doesn’t say what password. Is he claiming he knows my mail password, my Amazon password, my PayPal password, my computer logon password, or what?

They’d all be different, right?

You can check if any of your passwords are for sale. Just put in your email address here. (I wouldn’t normally suggest putting your email address – and especially not a password – into a web page, but this one is well-known, has been around for a long time, and seems to be reputable. But as you’ll find, in the world of computer security, trusting the things are what they seem may be unwise.)

Here’s what I got:

As you can see, I’m on Linked In – and my email address and password (my credentials) were revealed in a “breach” that Linked In suffered in 2016. (I’ve since changed them.)

If I had used my Linked In password and e-mail address for, say, my Amazon account, anyone who had my LinkedIn credentials would also be able to log into my Amazon account. That’s why it’s very unwise to re-use passwords.

But what about the passwords themselves. I wonder how easy mine might be to guess? Well password-cracking programs exist, and they are pretty good. They are cleverer than you’d think – they start with common passwords – things like secret123 and welcome123 and pa55word – before going through all the combinations.

The same website that I mentioned above can also check all the passwords that have been revealed on the “dark web” and tell you how many times a password you are considering has been used and revealed. I tried tulip123:

And Tulip123:

And tuliP123:

So, here’s my four rules for passwords:

  1. Make each one different.
  2. Make them a random set of number, digits and symbols.
  3. Make them at least 12 characters long.
  4. Write them down in at least two places, and keep the list up to date.

All this means you’ll have to use a program to generate, store and back-up your passwords for you. Using a Password Manager is the only sensible way to handle passwords. I have an article on password managers here.

Finally, consider using Two-Factor Authentication (2FA) for important passwords. The most common form of 2FA sends a code to your mobile phone every time you log in from your computer, and you have to type in this code as part of the log in process. But don’t do this for mail if you use a mail program (sometimes called a mail client), for example Microsoft Outlook. In that case, see if your mail provider support the use of an Application Password when using a mail client. Gmail and G Suite do, but BT, Yahoo, Sky, TalkTalk and so on mostly don’t.

PS: When I ask people which is their most important password, they usually answer “the bank” or similar. In fact, it’s not: for most people, their mail password is their most important password. This is because once someone knows your mail password they can sit back and watch every mail item you receive (and possible every mail item you send). They can do this from their own computer anywhere in the world – they doesn’t need access to your computer. Now consider what happens if you forget the password to (say) you Amazon account … Amazon sends a link to your e-mail which will allow you to re-set your Amazon password. So anyone who knows your email password can probably change any other password to one they know.

Additionally, If someone else can read all your e-mails, consider what happens if you’re buying a house, say. The day before you are due to send your solicitor the deposit, you get an email from him/her (the solicitor, as you think) mentioning they have changed their bank, and would you send the money to their new account, as follows. It looks genuine, is signed in the normal way and with the right name, and has all the right logos, so you believe it … and lose you money. The person with your mail password saw you were about to send a large amount of money (by reading your email) and was able to see exactly how he or she had to make the fake e-mail look. He had a newly set-up account waiting (scammers often trick someone else into letting them use their account), you transferred the money to it, he transferred the money into Bitcoin and closed the account. No trace.

There are plenty of well-documented examples of this. Google found me these three, but there are plenty of others. Protect that email password!

How to avoid solicitor conveyancing email scam that costs house buyers

Property sellers warned not to email solicitors: ‘We lost £204,000’

More Reading

Articles

Password Cracking Evolution
Top Ten Password Cracking Techniques used by Hackers
Testing a Password Cracker

Password Strength Testers

These sites say they don’t store your passwords, or even send them over the Internet, but I haven’t checked them.

https://random-ize.com/how-long-to-hack-pass/
http://password-checker.online-domain-tools.com/
https://www.comparitech.com/privacy-security-tools/password-strength-test/

Windows 7 Ending?

Here’s a question from one of my customers:

I see that Windows 7 finishes in January, do you think it’s worth upgrading my computer to Windows 10? How much is the cost for this?

I am being asked this sort of question a lot recently. Here’s my answer.

When Microsoft ends support for Windows 7 on 14th Jan 2020, nothing will change immediately. If it worked on Jan 13th, it’ll still work on Jan 15th.

There are two implications though:

  1. Microsoft will no longer have people working in Windows 7, so any problems that are found with it won’t be fixed. There is only one area where this matters – security flaws. If a security weakness is found in Windows 7 in the future, it won’t be fixed. Arguably, this makes Win 7 less secure as time passes, but personally I think the dangers are overstated. It’s ages since any security flaws were discovered in Win7, and anyway most home-PC attacks are not based on security flaws in the operating system, they are based on tricking the user.

  2. More importantly, other companies will stop testing new versions of their products on Windows 7, because if Microsoft has lost interest in it, they reckon they can too. So Sage 2021, for example, probably won’t be guaranteed to run on Windows 7. It may do, but Sage won’t guarantee that it will. So if you run any program that needs to be kept up to date, there’s no guarantee that this will be possible after 2020. For most people that doesn’t matter much – even if future versions of some program won’t work, the version they have now will still be fine.

    The problem eventually comes, for most people, with their browser – the thing they look at web pages with. Things like Chrome get regular updates to cope with fancy new websites. Over time, never versions of Chrome won’t work on Windows 7, and you might not be able to view some websites properly.

    You’d also have to find an anti-virus program where future updated versions will work under Windows 7, but that should be fairly easy, at least for a few years. I think Malwarebytes that I recommend will be OK.

All that takes ages to really become a problem – several years. So I’d say there’s no need to do anything for a year or two, but when the time comes to buy a new computer, it probably should use Windows 10. All new computers do, anyway.

It’s a bit like running an old car. I used to have a Saab, and then Saab went out of business. Nothing stopped me running the car, but
over time spare parts got harder to get (but not impossible). But after a while it didn’t meet new emission regulations (it was a diesel)
and they wanted to change me for driving into London (plus the congestion change) and higher road tax. So when the time came to
change it, I couldn’t buy another Saab anyway, but I bought a petrol car rather than another diesel. Same when they phased out 4-start petrol – nothing changed overnight, but over a few years we all changed to unleaded.

So it’s the same with Windows 7. No need to do anything for a couple of years, but when you buy your next PC, don’t expect it to be Windows.

Windows 10 is OK anyway, and much of it is better than Windows 7. It’s pretty similar to Windows 7, so (unlike with Windows 8) people usually get used to it reasonably