Data Privacy Day Prep Part 5: Network Security

Data Privacy Day is one of my favorite holidays and falls on this upcoming Monday. Every year, for the days leading up to it, I like to talk and publish reminders about. I normally post this on the Bethesda forums, where I'm quite active, but now that I have a blog, why not also add it on here? Here's part 5; it's about Network Security. It's long, so maybe read it in chunks. It'll always be here for you to refer to later :P

The goal of Data Privacy Day is to make people more informed about their data and privacy. I hope you find some of this information useful and put it into action. Security and privacy are constantly evolving items, and what cuts it today may not in the future, but this should be a good springboard to boost your security and privacy for Data Privacy Day and the years to come. As always, the level of security you need will differ from others, so you need to figure out what level is good for your needs. Some things, though, are universally applicable to all, such as a good password system. Another thing to remember is that even if you follow the best of security practices, it may not be enough to stay safe if a company who has poor security practices gets hacked (and after the summer of 2011 hacks and the ones that followed in 2012, I think we are all familiar with that).

An important definition:

•  Man-in-the-Middle attack: Any attack wherein someone intercepts data you receive and send to someone else by acting as a relay ("in the middle"). This can be done in numerous ways (arp and DNS poisoning being two common methods, though many other methods exist) but the end effect is the same: your information and communication is compromised. Your passwords can be stolen and your sessions hijacked. This threat is an increasingly common problem on wireless networks, and can even affect mobile telecommunication networks (for around $500 and enough know-how is the current going rate, FYI).

Networks

Your local network is an important point of security. A properly set up one will allow easy sharing and collaboration while simultaneously keeping out those who would intrude on it from the outside. This section will cover your local network, your local computer, and how to protect your computer and privacy when on public networks.

Your Wired Network

For a wired network, you don't have as much to worry about. Make sure not to use the DMZ your router allows: this is a black hole for security and offers nothing over properly forwarded ports. Any forwarded port should have a distinct purpose, otherwise don't forward them. Disable remote/WAN administration (might be buried in there somewhere). Make sure to keep the router nice and updated with any new firmware releases (better yet, use custom firmware like DD-WRT, OpenWRT, or Tomato), as they patch various security flaws. Next you should change the username/password for logging into your router. Finally make sure your router firewall is enabled; it's one of the nicest features they have. While not necessary, disabling UPnP can add a little more security by closing any vulnerabilities it may have that are unpatched and keeping rogue software for dynamically forwarding ports. Being careful is simpler and more friendly, though.

Your Wireless Network

Wireless networks are another thing. On top of all the above, you NEED to be using WPA2 with AES. Nothing else is secure!!!! Well, nothing you can reasonably implement, at least. This checklist is pretty good; the only two things I disagree with are using MAC filtering and disabling SSID broadcasting. If someone knows how to crack a WEP key, they can easily find out how to spoof a MAC address or uncover an invisible network. Both also come with significant disadvantages while offering no real security. As mentioned in that checklist, make your WPA2 key very complex. You don't need to worry about forgetting it: write it down and stick it to your router. If someone is in your house, your WPA2 password isn't going to keep them out of your network. If you want to be secure with your WPA2 key, consider using the same password strategies mentioned in the passwords section.

 But what about your WEP-only devices? I've not tried it yet myself, but here is a guide on how to set up a virtual wireless network for your WEP devices. Other options are to set up a wireless access point with WEP for when you want to use your DS/other WEP-only devices, and just unplug the WAP when not using it. Everything else will be on your normal WPA2 connection.

 A very new happening in attacking WPA/WPA2 networks is to ignore trying to break the WPA/WPA2 encryption and instead have the router give you the password. A common feature included in many modern routers is Wi-Fi Protected Setup (WPS). Unfortunately, this is a weakness as it is a simple (generally hardcoded) PIN that is very easy to brute-force. Lifehacker did a full rundown of this attack vector and the primary tool to abuse it (Reaver), which I suggest you read so you can stop it from happening to you. A redditer created a wonderful spreadsheet of many common household routers and whether they are vulnerable to Reaver and whether you can disable WPS on them (some routers cannot have the feature disabled even if there is an option on the web interface to do so). One thing to immunize yourself against this attack is to flash a custom firmware on the router, such as DD-WRT. Many custom firmwares do not have support for WPS, so it nullifies this vulnerability.

Your Computer (localhost)

Your computer can leak information out of your local network if you are not careful. The browser section covered many of the most common leaks, but if you computer is infected with a keylogger or other malware, data may be leaked and all of your network security can be bypassed. Likewise, on an open network, someone may try to break into your computer over the network. There are a few things you can do to mitigate these risks:

 Keep your Operating System updated. It's easy to fall into the cycle of not getting the latest updates for your OS. These often patch security holes that can be exploited. Along the same lines, keep your software updated, especially major programs and anything that uses the Internet. Along these lines is NOT using an unsupported OS. Windows Vista Home and Ultimate editions reach end of support this year in April, so upgrade before then or it'll only be a matter of time before an unpatched hole allows for unassisted malware installation on your computer due to running an unsupported OS.

 Just as important to keeping your OS updated, is keeping your software updated. Key programs that should be kept updated are your Antivirus/antimalware/firewall solutions, your web browser of choice, your pdf viewer, Java (if installed), Microsoft Office (if installed, can be updated through Windows update), and your media player.

 Use a password! Windows passwords are trivial to overwrite if someone has access to your PC (which is where encryption comes in), but they are VERY useful in keeping other, unwanted people on the network out of your shared folders. You should also, of course, disable shared folders on public wifi networks.

 Install a firewall. Your router has one, but when on open networks like your laptop may often connect to, your router firewall won't be of any help. With Windows Vista/7, the built in firewall is pretty good (and can be improved with Windows7FirewallControl -- which works with Vista/XP as well). The best free one is Comodo's Firewall. the Defense+ feature also is a basic HIPS program (Host-based Intrusion Prevention System) that will stop rogue programs from doing naughty things. This does an excellent job on keeping keyloggers, trojans, and worms from sending data out from your computer (keyloggers can also be effectively nulled with the use of a password manager such as KeePass and LastPass). Lately Comodo has been getting bloated, a good HIPS-based alternative is PrivateFirewall.

 Keep your antivirus/antimalware/antispyware solutions up-to-date and scan as you feel needed. Whther you run full-fledged real-time protection antivirus + antimalware solution, or a free antivirus and something to occaionally scan with like Malwarebytes, it's better to have it on your system now and not need it then need it and not have it. Some malware make it near-impossible to install antimalware programs and/or update them successfully. Instantly being able to do a scan after you think you've been compromised is a very nice thing. The next-best thing is to instantly shut down your computer and use live rescue CDs like Kaspersky offers (there's tons of them). Antivirus/antimalware/antispyware, whether proactive or retroactive, should always be considered your last line of defense.

 Disable file sharing when you don't need it. This is of particular importance when on public wifi. In Windows 7 this is done simply by going Control Panel > Network and Sharing Center > Change Advanced Sharing Settings (left panel item). Expand the Public profile. Turn off Network Discovery (not really necessary, it doesn't offer any real security), Turn off File and Printer Sharing, and Turn off Public Folder Sharing. Save the changes and exit. Next, disable your administrative shares. Disabling shares you don't need is important for those "oops" moments when you connect to a network and accidentally make it a home or work network instead of of a public one.

Shared and Public Computers

Shared and public computers are of particular risk. With shared computers, it's possible someone else using it has unwittingly installed some privacy-invading software or may try to snoop your files. On public computers you never know if there's a keylogger or some other malice acts going on. It's best to do your best to minimize your risks on these computers. With shared computers, you should verify that other user accounts cannot access your data by checking folder permissions and make sure other accounts don't have read (or execute) access. Another thing you can do is set up email alerts for whenever someone logs in to your computer. It may be handy if you think someone is snooping around. I personally prefer blat for sending emails from the command line on Windows, though sendemail is fine too. SendEmail is also available for Mac OS X and Linux, and the instructions given there will mostly apply, but you'll need to create a shell script to run them on those platforms and set it to run at start-up. An alternative program for Linux and Mac OS X is ssmtp, which I find a bit simpler than sendemail. Here are some instructions on ssmtp's basic set up and some Mac OS X instructions.

 Public computers are especially scary because there's so much unknown about them. The best bet is to reboot into Linux if possible. It's not always possible with public computers, but when it is it'll provide you the best option. A privacy and security-minded Linux distro is Tails. Of course, booting into Linux isn't always possible on public PCs (being able to do it is actually a really bad sign) so instead you may have to make due with some portable apps. I'd recommend avoid using passwords when possible, and using only accounts with two-factor authentication otherwise. Definitely use a portable version of your web browser of choice all tricked out with your favorite privacy plugins. Only save stuff to the usb stick and only run stuff from it. Pretend every program on the computer is a poisonous snake trying to eat your mouse (pointer). Besides that, there isn't much you can do besides following some good practices.

Foreign (public) Wireless Networks

Foreign, public wireless networks are a war zone, especially the open ones. Ones properly protected and configured with 802.1x (aka, WPA2 Enterprise) can be safe networks, but assume that any 802.1x network is poorly configured and multiple people have the same key you do and can see your traffic. Man-in-the-Middle attacks happen with more and more frequency, and the skill required to initiate them is at an all-time low (can be done with just a smartphone). There are two primary technologies you can use to secure your roaming on such networks: SSH Tunnels and Virtual Private Networks (VPNs).

 NOTES:

 1. For all server installs, you will need to know the pubic IP of your server. This can be done by visiting http://www.whatismyip.com/ on your server. Better is to set up no-ip on your server (the computer running SSH or your VPN) and use their free dynamic dns service (it'll work even if your home IP changes). No-ip is so simple, it hardly warrants directions, but no-ip provides them for a simple setup anyway. You will need to do this for PPTP VPN servers and SSH servers.

 2. You will also need to set a static IP for your server. This is simple enough

Static IP - Mac OS X

Static IP - Linux (various)

Static IP - Windows XP/Vista/7

 3. A simple tool to use to see if an ARP poisoning attack is happening on the public wifi is DecaffeinatID. It keeps track of the default gateway MAC address and will alert you if it changes.

SSH Tunnels

An SSH tunnel is a simple, yet effective way to protect your web browsing (and select other traffic) while on public wifi when properly configured and relatively simple to set up. Setting up an ssh server is simple on Mac OS X and Linux; windows is simple after installing a program. Your tunnel will be a SOCKS proxy, and Firefox with QuickProxy makes switching to that proxy simple to secure your web browsing traffic (I recommend using Firefox because of QuickProxy, and also because Firefox can be configured to send DNS requests through the tunnel, something I've yet to find out how to do in Opera or Chrome).

 NOTE: You may wish to get email alerts whenever someone logs in via SSH to your server. It's simple to do. These instructions apply to openssh, so should work for both Linux (assuming OpenSSH is your SSH Server) and Mac OS X. If you use my recommended program of BitVise for Windows, you'll have an option to run a program after successful logins, so you'd just create a batch file that uses either sendemail or blat to send the email.

 First, you need access to an SSH server to log into and create the tunnel. This computer needs to be located at home and always on.

 Mac OS X: Enable Remote Login for Mac OS X

 You will then need to forward port 22 from your Mac on your router so you can access the ssh while on the go. Locate your router on PortForward and follow the instructions for SSH.

 Linux: Simply install OpenSSH (or your SSH server of choice). Your distro should have sufficient instructions on how to activate key-based authentication and disable keyboard authentication in their documentation. It won't be any different than the instructions for Mac OS X if you use OpenSSH. Then likewise forward port 22 from your Linux PC on your router so you can access the ssh while on the go. Locate your router on PortForward and follow the instructions for SSH.

 Windows: Windows lacks a built-in SSH server, though there is a very good free (for personal use) SSH Server provided by BitVise. It offers very fine-grained controls, public key authentication, virtual users, jailing, and everything else you could want in an SSH server. If you have any questions, feel free to ask me as I'm very familiar with BitVise's SSH server. Don't forget to forward your port, though.
 

 I HIGHLY suggest setting up key-based authentication for SSH to prevent brute-force attacks on your SSH server. Then just disable keyboard-authentication. (the instructions are for PuTTY as it's fairly cross-platform and allows for me to just post a single set of instructions. Feel free to use any client you wish, though).

Now that your server is configured, time to configure your client (probably your laptop). I will do my instructions through PuTTY (for simplicity once again) so download and install putty. On Mac OS X, you will need to use MacPorts to get putty

 Launch Putty. Type the dynamic DNS (or IP) address into the Hostname/IP box. Looks like this

 Under Connections in SSH, select tunnels. Change Enter in 7070 for the destination (technically any port will do, I just always use 7070 because it's easy for me to remember), set it as Dynamic and Auto. Click the Add button. Looks like this.

 It isn't absolutely necessary, but I highly suggest saving this configuration, which requires going back to the session panel. Enter some title in the "saved sessions" box (like sockstunnel) and hit Save. Now in the future you will just have to select sockstunnel and click load.

 Now click the open button. A window that looks like a command prompt will open up and ask for your username, so enter it. If using keyboard authentication, enter your password. If using key-based authentication with a passphrase, enter your passphrase (the earlier linked howtoforge guide for key-based logins with putty explained how to load a key into putty). Leave this window open.

 Now we configure Firefox. Download QuickProxy as this makes things simpler (you'll be able to switch to your proxy with the click of a button).

 In Firefox go Tools>Options. Go to Advanced. In Advanced, go to the Network tab. Under "Connections" click the settings button. Select "Manual Proxy Settings". Enter a SOCKS Host of 127.0.0.1 and a port of 7070. It should look like this. Change back to "No Proxy" and OK out of all open windows.

 One more thing needs to be changed: go to about:config. Enter in socks as your filter. Change network.proxy.socks_remote_dns to true. Should look like this.

 Now Firefox can be configured to use the proxy (when logged into the SSH server in putty) by just hitting the QuickProxy button.

 When you're done using your SSH tunnel, disable the proxy by once again clicking the QuickProxy button and type "logout" ("exit" if it's a BitVise server running on Windows) into the putty terminal window to end the session. 

 

PPTP VPN

 Windows has a basic VPN built-in that used the Point-to-Point Tunneling Protocol. It is limited in that you can only have one remote connection, it uses your Windows password (so it must be strong), and it won't work when the CLIENT is behind old or improperly configured routers. From a security standpoint, PPTP has been broken, and can be broken by someone proficient with the right tools, but from a average user standpoint, people getting their MitM on are going after easy fish, and short of someone coming after you in particular, PPTP should be sufficiently secure. Also in its favor: it's simple to set up.

 Server configuration:

 NOTE: both guides also include information on port forwarding for PPTP, which involces port forwarding TCP 1723 and enabling PPTP Passthrough -- this second part is important because PPTP uses a non-TCP/UDP protocol: GRE. You may have to look around a bit to find where PPTP Passthrough is on your router (GRE is also the reason why PPTP won't work when the client is behind some old routers, as they drop the GRE packet before it leaves the network).

 1. PPTP Server on Windows XP

 2. PPTP Server on Windows 7 (Vista is almost identical)

 Client configuration:

 3. PPTP client on Windows XP

 4. PPTP client on Windows 7 (Vista is almost identical)

 5. PPTP client on Mac OS X

 6. PPTP client on Linux (GNOME)

Make sure to always test that your PPTP VPN tunnel is being used as the default gateway. This is default behavior for Windows clients.

Hamachi VPN with Privoxy and ProXPN Free

Finally, the last option is to use Hamachi VPN and Privoxy. It's a cross-platform solution and Lifehacker has a write-up on how to do it here.

 A managed, simple, free VPN service is ProXPN Free. Note that you are using their service, so they are your exit point. To me, this is less ideal as you do not control the exit point. Also, you have to use their [proprietary] VPN implementation, as the free service does not include PPTP access. Their free service VPN implementation is incompatible with all other VPN clients I know of. Still, for simplicity it wins hands-down and it will protect you from Man-in-the-Middle Attacks on public wifi.

 That's all for this section. By following some of these tips, your public wifi browsing is now secured. and you have much less to worry about.

Read More

Data Privacy Day Prep Part 4: Encryption

Data Privacy Day is one of my favorite holidays and falls on this upcoming Monday. Every year, for the days leading up to it, I like to talk and publish reminders about. I normally post this on the Bethesda forums, where I'm quite active, but now that I have a blog, why not also add it on here? Here's part 4; it's about encryption. It's long, so maybe read it in chunks. It'll always be here for you to refer to later :P

The goal of Data Privacy Day is to make people more informed about their data and privacy. I hope you find some of this information useful and put it into action. Security and privacy are constantly evolving items, and what cuts it today may not in the future, but this should be a good springboard to boost your security and privacy for Data Privacy Day and the years to come. As always, the level of security you need will differ from others, so you need to figure out what level is good for your needs. Some things, though, are universally applicable to all, such as a good password system. Another thing to remember is that even if you follow the best of security practices, it may not be enough to stay safe if a company who has poor security practices gets hacked (and after the summer of 2011 hacks and the ones that followed in 2012, I think we are all familiar with that).

Encryption remains the same as ever mostly. AES is still going strong, in spite of a very tiny chink in the armor being found over a year ago now (still unexploitable because even with the chink it takes hundreds of years to decrypt).

Email Encryption

Most people send emails fairly frequently, sometimes even containing confidential information. The Dead-simple file encryption options listed below are excellent for attaching encrypted attachments, but what about the email message itself? Well, there's been a long-standing encryption for email known as PGP (Pretty Good Privacy) and it is still going today. Some derivatives of it are OpenPGP and GnuPG, but they all play nice with each other.

 One caveat about PGP until recently was you needed a dedicated email client to use it. It's still probably the easiest way, but it's no longer the only option. If you want to go this route, I recommend GnuPG + Thunderbird + Enigmail. Here are some instructions on how to set it up.

 Most of us, though, probably use a web browser for our email. Now there are PGP encryption options directly in your browser thanks to OpenPGP.js -- an open source Javascript library. There are two browser plugins useing it: Mailvelope, which has a Firefox and Chrome plugin, and MyMail-crypt for Gmail which is a Chrome-only plugin. Once more, Mailvelope works with numerous webmail platforms, not just Gmail, so is an option for more people. OpenPGP.js (and these plugins) are still under active development, and not quite 100% stable, so issues may be encountered. An advantage, though, is that they'll work with any OpenPGP/GnuPG program, being fully compatible.

 The downside to Mailvelope and MyMail-Crypt being fully compatible with OpenPGP/GnuPG is that they have the same barriers to entry as regular OpenPGP/GnuPG -- in order to use them you must generate a private and public key pair, and so must anyone you want to securely send email to. For you to send email to someone securely, you encrypt it with their public key. They can then decrypt it. To reply they must encrypt the reply with your public key for you to be able to decrypt it with your private key.

 A simpler solution is SafeGmail. It's Gmail-only and Chrome-only, but a Firefox plugin is in the works. It's an open source project and tries to make PGP simpler and more friendly to newcomers. On the plus side is that only you need the plugin installed, the recipient doesn't need to mess with keys or anything. They just click a link, enter in a password you sent them/answer a question, paste the encrypted text, and press the decrypt button. The downside is that you are dependant on SafeGmail, and without looking at the source code I can't say with 100% confidence that no snooping is being done, though I do believe it's a strong candidate for being 100% secure.

Dead-Simple File Encryption

TrueCrypt is a great tool and all, but it's not the best choice out there for simple file encryption. You have to create a virtual container and then put the files in there, it's a bit of a hassle and waste. The problems with TrueCrypt are amplified if you are trying to share files with someone else securely, especially if that other person isn't very computer literate. Thankfully there are alternatives. The big ones are AxCrypt, AES Crypt, and 7-Zip.

AXCrypt - AxCrypt is a simple file encryption tool that uses AES-128 available in installed and portable versions. The advantage of the installed version is that it offers context menu integration, allowing simple right-clicks to decrypt and encrypt. Another advantage of the tool is it offers a portable Decrypt-only tool. This makes it simple for your non-savvy friends to decrypt files you send them. Unfortunately it is currently Windows-only, but version 2.0 will be cross-platform (through Mono). If you have a Mac OS X friend you'd like to send encrypted files to, thoguh, they can use the prerelease. Linux also has a prerelease, but you have to register on the AXCrypt website to access it. My experience with the prerelease has been positive so far, though getting your friends to install Mono may be a bit hard (it's a separate installer). Once they do, they simply launch AxCrypt from the download and click the unlocked icon to decrypt files. Simple enough for even a Mac OS X user (in jest, I promise).

AES Crypt - AES Crypt isn't as slick as AxCrypt, but has the advantage of having a stable cross-platform release. Context menu available once again and the Mac OS X application is simple drag-and-drop. It lacks the portable or decrypt-only Windows options that AxCrypt has, but that's the price to pay for a cross-platform application.

7-Zip - When combined with the AES-256 encryption option available for .zip and .7z archives, 7-Zip becomes a powerful encryption tool. It's made even simpler with the SFX archive option (Self-extracting archive) when using .7z. This creates a .exe archive that when run will ask for the password and extract the contents once entered in properly. It's not without problems, though. First, AES-256 .zip files are a bit of a hack, and not compatible with all archiving programs (for example, Windows can't handle them natively). Second, 7-Zip isn't properly cross-platform. You'll have to direct your Mac OS X and Linux friends to an alternative tool for them to decrypt the files. Thirdly, you'll find it hard to email self-extracting archives to people as most email programs will block .exe attachments (so you'll need to use a file hosting service). Still, it's a viable option especially for Windows users.

Drive Encryption

Drive encryption is the ultimate in data privacy and security. There are many encryption tools out there, but for the purposes of discussion here I will only talk about TrueCrypt. TrueCrypt offers many advantages over other options, including BitLocker. In being cross-platform, it makes recovery in any situation possible. Other encryption schemes may offer advantages over TrueCrypt (for example, if interested in TPM), so it may not necessarily be the right choice for you.

 There are three basic encryption options, as well as the choice between hidden and non-hidden volumes. These options are: an encrypted file container, an encrypted non-system partition or drive, and an encrypted system partition/drive (this last option is currently only available on Windows). Two-factor authentication is also available through the use of keyfiles, though it isn't an option for system encryption (but two-factor authentication still can be achieved).

 Encrypted file container: This option is the simplest to implement. You create a volume that appears to be a normal file (you can make it any filetype you want), but when you mount it with the proper password (and/or keyfile) it reveals the truth. You can make it a hidden volume for even added privacy/security (a would-be attacker may uncover the outer volume in one way or another, but the hidden volume remains secure). The disadvantage to making an encrypted file container is it is relatively simple to just copy the file container to a removable drive where the attacker can try and crack it at their leisure without you being aware of it (a keyfile would drastically lower their ability to succeed, if the keyfile and file container are not stored in the same location).

 Encrypted non-system drive/partition: This option is relatively simple to implement. The advantage is it looks like just unallocated disk space to the untrained eye, and, in the case of removable storage, the user would be prompted to format it before use. Of course in removable storage you must be careful to not format it yourself. Once again the use of a hidden volume and keyfile can be used for increased privacy/security.

System drive/partition Encryption

SSD users: Please note that there is currently no way to verifiably securely wipe an SSD short of drive destruction. As such I highly recommend encrypting SSDs.

 This one is a bit more advanced than the earlier options, but offers significantly greater security and privacy as well. On your system there are temporary files and various files tied to programs that make it hard (though not necessarily impossible) to seamlessly use file containers or encrytped non-system drives/partitions to protect their contents from prying eyes. For example, say you stored your IM logs, program profiles, and bookmarks in an encrypted file container. It would be relatively simple to accidentally start up the program those files are related to without unencrypting the container, which could either cause instability or write new files to an unencrypted area. System drive/partition encryption allows for seamless encryption of all system/program files you want out of prying eyes. You can make it a hidden volume if you choose, which LifeHacker did a good job at covering.

Unfortunately keyfiles do not work with system encryption, but you can still get two-factor authentication. Before you encrypt the system, you will be prompted to create a recovery disc in case anything goes wrong, which you can use to restore the TrueCrypt boot loader, boot into the encrypted system, restore the original system loader, or permanently decrypt your system. By restoring the original system loader, or installing a new boot loader to the MBR (such as GRUB2), you would be required to boot from the rescue disc, making a two-factor authentication setup (you must know the password, and you must have the recovery disk). This can be further streamlined if your computer can boot from USB by loading a USB drive with the recovery disk. You'd then do something like booting the TrueCrypt ISO from Grub4Dos.

Dual-booting is complicated for Linux-TrueCrypted Windows (Windows-Windows can be simply done through the use of the hidden operating system feature), but not impossible. You can do the above and have GRUB2 written to MBR and use the CD/USB to boot into Windows, or you can force GRUB2 to install to the root (or boot) partition. Here's a guide to doing this.

If Linux is already installed, simply restore GRUB2 from the TrueCrypt rescue disc, boot into it, force GRUB2 to install to your root/boot partition, and then reinstall TrueCrypt Boot Loader to the MBR from the rescue disc. If you are using the two-factor authentication method, all you need to do is restore GRUB2. Since you don't need TrueCrypt on the MBR, GRUB2 can happily rest there.

 If Linux isn't already installed, make sure you have the necessary unencryped partition to install it to. You cannot partition a TrueCrypt encrypted volume, so the partitioning for Linux needs to be done before encryption (or if you have a non-system partition/drive already, you could further partition that). Encrypt Windows with TrueCrypt and install the Linux distro of your choice. After installation force GRUB2 to the root/boot partition and restore TrueCrypt to the MBR (once again, this last step can be skipped if you are going to use the two-factor authentication method for TrueCrypt).

 Linux can also be encrypted. Many distros offer options to encrypt Home at install. Full encryption, including root, requires more work and generally not included as options from live CD install. Just look through the distro documentation for dm-crypt/LUKS or Google your distro along with those terms and you will find a guide on how to do it.

Mac OS X offers built-in full-system encryption in the since 10.7 Lion through Filevault 2. Apple posted excellent instructions on how to do this on their knowledge base. Older versions of Mac OS X could only encrypt their home directory.

There is one disadvantage to system encryption: it will slow down your OS. This is mitigated with a good hard drive and a modern processors that has AES-NI when using just AES encryption -- to the point it is negligible to unnoticable. Currently most i5s and newer i7s (the entire i5 and i7 line for Sandy Bridge) support it as well as AMD's Bulldozer line, but still something you should be aware of.

 Further reading:

TrueCrypt Docs: Keyfiles
TrueCrypt Docs: Hidden Volumes
TrueCrypt Docs: TrueCrypt Rescue Disk

 With that, you can properly encrypt your important data and keep it from prying eyes.

Read More

Data Privacy Day Prep Part 3: Web Browsing

Data Privacy Day is one of my favorite holidays and falls on this upcoming Monday. Every year, for the days leading up to it, I like to talk and publish reminders about. I normally post this on the Bethesda forums, where I'm quite active, but now that I have a blog, why not also add it on here? Here's part 3, it's about web browsing and websites. It's long, so maybe read it in chunks. It'll always be here for you to refer to later :P

The goal of Data Privacy Day is to make people more informed about their data and privacy. I hope you find some of this information useful and put it into action. Security and privacy are constantly evolving items, and what cuts it today may not in the future, but this should be a good springboard to boost your security and privacy for Data Privacy Day and the years to come. As always, the level of security you need will differ from others, so you need to figure out what level is good for your needs. Some things, though, are universally applicable to all, such as a good password system. Another thing to remember is that even if you follow the best of security practices, it may not be enough to stay safe if a company who has poor security practices gets hacked (and after the summer of 2011 hacks and the ones that followed in 2012, I think we are all familiar with that).

Web Browsing

There's not a single person reading this who doesn't do it. We all are doing it right now, in fact. Web browsing is a part of all of our lives, but without proper care it can be quite dangerous.

 When randomly searching for things, you never know if that next search result is going to contain malware. Your antivirus software may have a rating feature, and your browser may have some protections (as does the search engine itself), but for more information a website reputation tool is needed. There are various ones out there, but the one that I feel does the best job is WOT: Web of Trust. Like any web rating site, it is prone to users downrating, but overall I feel it does a very good job. It does collect information on "you", as to get ratings it needs to know the domains you are looking at. This is true for any web rating service, though, so if you want to have this functionality, you'll have to allow the data be collected. WOT has an extension for Firefox, Google Chrome, IE, Opera, and Safari. Other browsers can use a bookmarklet for the service.

 In recent years, there's been widespread coverage of packet sniffing. The main tool to this end is Firesheep, which can collect password cookies sent over non-secure connections. Firesheep in particular can be countered with Blacksheep, but other tools can do a similar job, such as Wireshark. To combat these other tools, the most effective way is to always establish a secure connection. To that end the Tor Project and EFF have teamed up and made an extension called HTTPS Everywhere for Firefox (NoScript can also do it, but it is a bit more complicated. Here is the FAQ). Similar extensions exist for Chrome (HTTPS Everywhere is in alpha) and Opera also exist, but are not as foolproof.

 Also note two things: Using these plugins is NOT enough to guarantee you are secure, especially on public wifi. In recent months an attack to defeat earlier versions of SSL/TLS has proven successful known as BEAST. To make matters worse, very few browsers support TLS 1.1 and 1.2 (the only two versions not vulnerable to BEAST) and as such few websites use them, making virtually all of HTTPS vulnerable to BEAST. Of course BEAST is rare right now, but there is an older attack possible on wifi known as SSLStrip. SSLStrip does not break HTTPS, but instead acts as a proxy, removing SSL from requested pages. It is a type of Man-in-the-Middle attack. Still, these are really only threats on public wifi (which I'll talk about another day), but just be aware of them.

Cookies and LSOs

Cookies are not necessarily bad, in fact there is a cookie keeping you logged in to this forum right now. However, advertisers often use cookies to track you around the web. Given the usefulness of cookies in general, you probably don't want to outright disable them, however blocking third-party cookies will block practically all advertiser cookies without hindering your web experience.

 One big win happened this year on the tracking cookie front: the introduction of Do Not Track. It's gaining widespread adoption. Enable it if you don't want to be tracked. It's not guaranteed to be honored, but it'll keep the respectable websites from tracking you.

 Firefox: Tools > Options > Privacy > Use Custom Settings for History > Uncheck "Accept third-party cookies"

 Google Chrome: Wrench/Tools icon > Options > Under the Hood > Content Settings > Cookies > Check "Block all third-party cookies without exception"

 Opera: Tools > Preferences > Advanced > Cookies > Select "Accept cookies only from the site I visit"

 Local Shared Objects (LSOs), also known as flash cookies, are a part of Adobe Flash and are becoming an ever-more prevalent way of storing data on your computer as well as tracking your whereabouts. Note that as before, LSOs do have legitimate uses, so don't think that they are all bad. There are a few things that can be done. The one thing that is the same for everyone is to go to Adobe's Online Flash Settings page and delete/disable the storage for various websites. This has one significant advantage over other options: You can set those websites that do use flash cookies to track you to 0kb. That way they can't store data and you don't have to worry about a new one being created. Firefox and Chrome have addons for flash cookies, that being BetterPrivacy for Firefox and Click&Clean for Google Chrome. Both of which can automatically delete LSOs on browser close. Another way to go about this is to block Flash except when needed.

 Firefox: NoScript can block flash perfectly fine. If you are not a fan of NoScript, there is Flashblock (Flashblock and NoScript don't work well together, and since NoScript does what Flashblock does by default, it isn't necessary)

 Google Chrome: FlashBlock is available here as well.

 Opera: Flashblock for Opera -- Even though it doesn't specify Opera 11, it works fine in it.

 One more: The Evercookie. Evercookie is new on the field and is a javascript that creates multiple files through multiple methods to store data on your computer. It is not wide-spread yet, but may be in the future. The only truely effective way to deal with the evercookie is to block the javascript.

 Using an ad-blocking feature, add the following entry: */evercookie.js*

Ad-blockers and Script-blockers

Ad-blocking does more than just remove annoying ads (though that is the most obvious) -- it also adds security. ads are not controlled by the website they are displayed on, and there are many cases of malicious ads infecting users, the most recent example I can remember was not even a year ago on SlickDeals.net. I am all for supporting websites you visit, but when the ads don't run on their own server, you are taking a risk. Thankfully whitelists are fairly popular for ad-blockers, so you can get rid of the annoying/dangerous ones while still supporting your favorite websites. For extra privacy, consider adding the Track-blocking lists from here.

 Script-blocking is similar. Many scripts from domains other than the one you are on can be dangerous or track you.

 Firefox: Does it really need to be said? Adblock Plus! Undeniably the king of Ad-blockers.

 The Previously mentioned NoScript is the add-on of choice for script-blocking.

 Google Chrome: There are two popular ones: AdBlock and the port of Adblock Plus. Pick the one that suits your tastes.

 For Script Blocking it is NotScript, and another option is ScriptNo

 Opera: Opera has a built-in Content Blocker that is best used with the Fan-boy filter list. Right-click any page and select "Block Content" to access the blocker. Hold shift while clicking to block specific items. Both AdBlock and AdBlock Plus also exist on Opera now, if you prefer those.

 Chrome's NotScript was ported to Opera 11 and is available here

URL Unshorteners

With the advent of microblogging, URL Shorteners have grown in popularity. However, just randomly clicking a shortened link is very dangerous, as the site on the other side may be crawling with all sorts of nasty malware. Luckily, there are ways to unshorten a URL.

 Firefox: Long URL Please

 Google Chrome: LongURL

 Opera: Unshorten

 You can also always just use unshort.me for those urls that don't want to unshorten.

Private Browsing and Deleting Browser Data

Private browsing is supported in Firefox, Google Chrome, and Opera. It allows you to browse the web without leaving a trace (not really, but for the most part, yes). It is great for when you occasionally want to browse without leaving a trace, but if you are willing to go futher, you can clear all or at least select browser data every time on close. Why would you want to do this? Your browser cache and cookies are insecure. If someone gains access to your computer and you leave don't clear out your cache and cookies they will be able to gain access to your accounts since you are still logged in. This can be remedied in Firefox, Chrome, and Opera in different ways by deleting your browser data on browser close.

 Firefox: Tools > Options > Privacy > Check "Clear history when Firefox closes". Proceed to click the "Settings" button. Cookies, Cache, and Active logins should definitely be cleared on close. It does mean you'll have to log in to your sites every time, but that is what password managers are for. For extra security clear your Form & Search History and Download history. If extra paranoid and you won't miss it, clear your Browsing history as well. super-paranoid people may also want to consider clearing offline website data and site preferences to not leave a trace behind.

 Google Chrome: Google Chrome only supports deleting cookies on browser close. To enable this go Wrench/Tools icon > Options > Under the Hood > Content Settings > Cookies > Check "Clear Cookies and other site data when I close my browser". You need previously mentioned Click&Clean to completely clear out your private data on browser close. It is an option under the extension options.

 Opera:
 Cache: Tools > Preferences > Advanced > History > On "Disk Cache" check "Empty on exit".
 Cookies: Tools > Preferences > Advanced > Cookies > Check "Delete New Cookies when Exiting Opera"
 Download: opera:config#TransferWindow|KeepEntriesDays and set to "0"
 If feeling extra paranoid: Tools > Preferences > Advanced > History > Set History Addresses to "0" and uncheck "remember content on visited pages" and set opera:config#UserPrefs|SavePasswordProtectedPages to 0

The Remaining stuff: Web domains and Browser Plugins

The single greatest thing you can do to check if you are on a phishing website is to check the domain. Modern web browsers all highlight the actual domain of the site making it all the easier. Doing that alone will greatly lower your risk of being a phishing victim.

 The last thing to talk about is plug-ins. Plug-ins are insecure, to put it simply. They aren't updated automatically with your browser, and it is very easy to miss one that is a security risk. The biggest security risks in general to your computer are: Adobe Flash, Adobe Acrobat/Reader, Java, Silverlight, and Quicktime (a video on the vulnerabilities and flaws of the PDF format). On top of not updating with your browser, these plugins also have a great deal more permissions than your standard browser extension does. Ask yourself if you really need those plugins, and then, even for those you do, think about at least making your addons on-demand (I currently run with Java always disabled, being the least useful in the modern web and one of the most dangerous). Mozilla made a wonderful plug-in checker that is available here, use it often. It works with Firefox, Google Chrome, and Opera. I also highly recommend using an alternative to Adobe Reader. Sumatra PDF is my favorite on Windows (Mac OS X includes it's own great built-in one, and on Linux whichever comes with your desktop environment is probably plenty good). Take a moment to see what plugins you have installed in your browser. This can be done simply by typing about:plugins into your url bar for Firefox/Chrome and opera:plugins for Opera.

 This year saw a huge resurgence in Java attacks, many zero-day exploits happened this year. Ask your self: Do I need Java installed on my computer? If not, UNINSTALL IT. If you do need it on your computer, ask yourself: Do I have any websites that need Java? Most likely you don't, as very few modern websites require Java. I HIGHLY suggest going a step beyond plugins on demand for Java and just plain disabling it in your default browser. If you happen to need it, have a backup browser JUST for Java. It's easy with the plethora of web browsers out there today.

 Firefox: NoScript is the closest thing to plug-ins on demand. If you don't want to block javascript, you can set it up so that only plugins are disabled. To do this Go into the Options for NoScript. Under General, select "Scripts Globally Allowed (dangerous)", then on the "Embeddings" tab, forbid java, flash, silverlight and other plugins, select "Apply these restrictions to whitelisted sites too". Plugins are now effectively on-demand.

 Chrome: Plug-ins on Demand

 Opera: Plug-ins on Demand

 Note that running plugins on demand may break some sites.

Specific Websites

On the various websites we share all sorts of information. These sites generally have various security and privacy settings so you can control who can see that information and how secure your account is.

Webmail

Currently Gmail is set to always use HTTPS for secure email browsing, which is a good thing, but if you changed this yourself you can fix it under the General tab in Settings. Windows Live Mail/Outlook recently added this feature, which you can set by going here. Unfortunately Yahoo! has not added this feature for free users. If using Yahoo! you should request this very important security feature be added, or better yet: switch to Gmail or Windows Live Mail. Likewise if you are still stuck on AOL mail SWITCH NOW!

WLM/Outlook also has a single-use code system for signing in on computers that are not your own. For information on how to set it up, read WLM's FAQ. Gmail does not offer this, but does offer Two-step authentication, which significantly boosts your security. Enabling it is easy, as Google explains how to enable two-step authentication in their blog.

 Google also offers the ability to recover your account via SMS or your smartphone. To add this feature, Go to your Google Account's Password recovery options. Windows Live also offers this feature. Go to Account Overview and under Account Settings there is a line that says "Security Info". Click Manage and you will have the option to enter a phone number for recovery use.

 A Feature unique to Windows Live Mail is Trusted PC. On the plus side it makes password recovery dead-simple from a single PC, the downside is it's useless if you use it on a laptop, and unfortunately you need Windows Live Essentials installed as well as use Internet Explorer, making it out of the realm of possibility for Mac OS X or Linux users.

 Gmail offers the ability to remotely log out of any computer, which can be very useful if you leave yourself logged in somewhere on accident.

 An alternative webmail service is Lavabit which stresses privacy above all else. It doesn't log IPs, it doesn't retain your sent emails past 7 days, and it encrypts everything. Of course it's a big switch.

Facebook

Last year it was Timeline, this year Facebook is introducing Social Search. Lifehacker's guide to Facebook has been updated appropriately.

I was ready to do this big expose on Facebook privacy settings, but then I found out about Lifehacker's always-up-to-date guide to Facebook Privacy. Read it, bookmark it, check it every now and then.

Facebook rolled out HTTPS across the site and it can be found in your Account Settings, I highly recommend enabling it ASAP if it isn't already.

Facebook now can notify you when your account is logged in from a new device. I love services like this, so recommend you enable it to keep tabs on your account.

 Now go to Account Settings to get the last little bit of Privacy and security settings:

 Set up your mobile phone with Facebook, and you can get one-time passwods through SMS for Facebooking anywhere you don't feel 100% safe (like those public wifi networks previously mentioned). In "Account Settings" you can also remotely log out any other active computer connected to your account.

 For the last thing, head over to the "Facebook Ads" tab in your account settings. Set to "No one" both "Allow ads on platform pages to show my information to" and "Show my social actions in Facebook Ads to". With that, your Facebook is now nice and secure.

 Also: be aware that linking to content from your profile IS a leak that can lead to your profile being uncovered. Be aware of this when linking to images you've uploaded to your Facebook account. Likewise be weary of Facebook Connect. If you Facebook login information is compromised, so are these sites. It can also be used to track down your Facebook page if your profile picture is tunneled through FB Connect.

 Be aware of how much information leaks through to Apps when using them. The WSJ did a good writeup on this:

 "The apps reviewed by the Journal were sending Facebook ID numbers to at least 25 advertising and data firms, several of which build profiles of Internet users by tracking their online activities."

 Your Facebook ID is always collected, so it isn't fully anonymous, this data is linked directly to you:

 "Defenders of online tracking argue that this kind of surveillance is benign because it is conducted anonymously. In this case, however, the Journal found that one data-gathering firm, RapLeaf Inc., had linked Facebook user ID information obtained from apps to its own database of Internet users, which it sells. RapLeaf also transmitted the Facebook IDs it obtained to a dozen other firms, the Journal found."

Google

Pretty much all of us use it, and it knows a ton about most of us. Thankfully Google does give you some control.

 Google+ users check out this Guide to Google+ Privacy. One thing I really do admire about Google was how up-front they are about the privacy settings for Google+.

Google Privacy Center - Learn it, love it, visit it often. Click on Privacy Tools to get to the settings. The rest is just information. In privacy tools you will see many options.

 Google Dashboard: The important one is Google Dashboard, which will tell you what Google products you are using and what Google knows about you through them. It is a central point of control for all your use of all Google products.

 Ads Preference Manager: this will allow you to control what ads Google will show you. In doing so you tell Google what you like so you get more accurate/relevant ads.

 Data Liberation Front: If you are looking into biting the bullet and leaving Google entirely, head here. This site will tell you how to get any and all your data from all the Google services out so you can switch to different options. It's drastic, but if you are THAT worried about Google, it may be interesting.

 Google Encrypted search: This secures your connection between you and Google for your searches, and in recent months, Google has been rolling it out as default for all logged-in Google users. Google still stores your information, and scroogle is no more. Your best option if you don't like this is to use DuckDuckGo, which has a very fair privacy policy, much less invasive than Google.

 Web History Controls: This is a setting you may have inadvertently enabled. It uses your previous web searches to "help" you in the future as well as potentially storing other web usage information. It doesn't remove your searches from Google's servers, but it may still be useful especially in a multi-user environment.

 Google Analytics Opt-out. You can opt-out of being tracked through Google Analytics. You will need to install a browser extension, and currently only supports Firefox, Google Chrome, and Internet Explorer. This can, of course, also be done through a content blocker.

 Search Personalization Opt-out: If you are using Web History, this is enabled. Instructions on how to disable it when not signed into a Google Account are also explained.

Other sites & Web App Permissions

Microsoft's gotten into the game this year, and now offers a dashboard for your privacy settings and personal info like Google. If you're a big Microsoft/Windows Live/Bing user, you should check it out: https://choice.microsoft.com/Data/?lc=1033

Beyond that, just check out the sites you use and make sure everything seems right according to you. If you use a password manager, figuring out what sites you use and maybe don't visit often is very simple.

 Also, a simple way to check your website's app permissions is with MyPermissions. It's a one-stop link shop for finding out who has permission to your various social network sites. Clean out any apps for all of them you don't need (I checked myself at the beginning of the year, and the only thing I had was an email app for my main gmail account -- an app I still use, so I was 100% clean). Another service is Adjust Your Privacy. There's some overlap between the two, but AdjustYourPrivacy offers some links that MyPermissions lacks (and vice-versa).

Some General Privacy Remarks and Tricks for the Web

If you want to send a note to someone over the Internet, but don't want to leave it around afterwards, a cool tool is Burn Note. You can also recreate this in Google Docs if you prefer that route.

 WikiHow has a pretty cool trick for helping you spot identity theft by making Google play for your side via Search Alerts. Of course, this means giving Google some information on you.

 The EFF released a star rating system for who cares about your privacy. It may surprise you that Google didn't score that bad. THe worst offenders, besides ISPs, were FourSquare, MySpace, Apple, Microsoft, and Yahoo (Skype is now owned by Microsoft, so I didn't list it, but it also scored zero).

Read More

Data Privacy Day Prep Part 2: Smartphones

Data Privacy Day is one of my favorite holidays and falls on this upcoming Monday. Every year, for the days leading up to it, I like to talk and publish reminders about. I normally post this on the Bethesda forums, where I'm quite active, but now that I have a blog, why not also add it on here? Here's part 2, it's about Smartphones. It's long, so maybe read it in chunks. It'll always be here for you to refer to later :P

The goal of Data Privacy Day is to make people more informed about their data and privacy. I hope you find some of this information useful and put it into action. Security and privacy are constantly evolving items, and what cuts it today may not in the future, but this should be a good springboard to boost your security and privacy for Data Privacy Day and the years to come. As always, the level of security you need will differ from others, so you need to figure out what level is good for your needs. Some things, though, are universally applicable to all, such as a good password system. Another thing to remember is that even if you follow the best of security practices, it may not be enough to stay safe if a company who has poor security practices gets hacked (and after the summer of 2011 hacks and the ones that followed in 2012, I think we are all familiar with that).

Smartphones

Do note, that while this section is specifically about smartphones, since most popular tablets on the market are based off of smartphones currently on the market a good chunk of this can be applied to tablets too.

 I'd argue that phones and data privacy and security don't even belong in the same playing field. Phones leak information like a sieve, and smartphones are even worse at it. Many scandals related to various smartphones have occurred in recent years. There was the iPhone location scandal, which lead to general coverage of all the information the main smartphone OSes collect on you, and then it turned out that Windows Phone 7 is as bad as the iPhone was at location leaking (Even though Microsoft went on record during the original iPhone scandal saying WP7 didn't do nearly that much), and then we found out about Carrier IQ potentially collecting all sorts of information on you for pretty much all phones (except Verizon phones), Smartphones were the last to revoke DigiNotar SSL certs and a good many smartphones still have these certs active, and there's nothing you can do about it. This year was also a big year for malware on smartphones. Malware on Android continued to get lots of coverage (though it's not as bad as the coverage made it out to be), and even the iPhone wasn't immune to it. Of course why bother with malware when you can just completely own the phone with one SMS message? Throw in some good old GSM ownage, maybe tracking down and eavesdropping on phone calls, and why not even some CDMA compromising as well as WiMAX ownage just for kicks.

 Ok... I think you get the picture, the sad thing is that the above is not even close to covering all there is when it comes to smartphone (and phones in general) insecurity. Smartphones may be wonderful tools, but they definitely aren't secure. There are some things you can do about this, but the best is probably just turning the phone off when you don't need it.  Really though, there's no way many of you can imagine going back to your life without a smartphone, so at least do your best to bolt down what you can, which is mostly physical security.

Locking your phone

Android: Android 2.2 enabled PIN and password locking, prior to that you could only do a swipe pattern*. How to enable a Password, PIN, or Pattern on Android. Later Face Unlock was introduced in Jelly Bean, but I don't really recommend that.
 *Note: If using a swipe pattern, make sure to have at least one part of the pattern trace over itself. If you do not, someone can tell your pattern by looking at your smudge marks.

 For Apps there are two tools: Smart App Protector and Tasker:

Smart App Protector

Tasker - $5-7 (out of market version is cheaper and recommended for file encryption). How to lock an app with Tasker.

 Why lock an app? Let's say you are letting a friend borrow your phone, but don't want them "accidentally" reading your emails or posting something from your Facebook account. Now you can lend them your phone without watching over their every move like a hawk.

 iOS: with iOS4, full password support came to the iPhone. Instructions on setting up a long passcode on iOS4 -- iPhones not using iOS4 or later: 4-digit Passcode video

 Unfortunately I can't find any tools in the market to lock apps. For jailbroken iPhones it looks like there are a few options for locking down your phone, one promising one is Protecti.

Windows Phone 8: Unfortunately, picture passwords aren't an option, but you can have proper passwords now!. WP7 is still limited to numerical passwords. WP8 Lock Screen FAQ

Password Managment on your Smart Phone

USE ONE! KeePass-compatible, LastPass Premium, or something else, just use one! I already listed them all out in the password section, so just pick one out. Here, I'll make it easy for you: KeePassDroid for Android, 7Pass for Windows Phone 7, and either MiniKeePass (free) or one of the others on iOS. For LastPass users, $12/yr isn't much and then you can use their numerous mobile offerings. DashLane will work with limited features on smartphones for free, but you'll have to pay for all that it offers like LastPass. Don't forget pwsafe (iOS) or PasswdSafe (Android) for the Password Safe fans. I can't begin to tell you how many times I've seen someone open their smartphone's unsecured notes to find a password. Stop it! Please. Your phone is insecure enough as it is without you storing your passwords in plaintext.

Remote Locating/locking/wiping

Your smartphone contains all sorts of juicy information on you. You need to be able to remotely wipe it if you ever lose it.

 Android:

The official offering by Google was made available in 2013. It's the Android Device Manager and allows you to remotely locate, lock, and wipe your Android phone. There are also many alternatives for Android, some of which offer features not found in the official Device Manager by Google. Most notably are text commands and app masking.

Avast! Mobile Security - Free for all. Remote Locate, Lock, and Wipe via either a web portal or text messages.

Lookout - Free or Premium version for $30/yr. Not only does it offer remote finding through the website, but also has an antivirus program (the usefulness of an Antivirus program on Android is highly debatable right now, but the location/wipe feature is undeniably good). The Premium features include the ability to lock your phone until you find it or wipe it clean, as well as even more goodies.

Cerberus anti-theft -- One-time fee of $5 or so bucks. Can be installed as a system app and just as capable as the big boys.

WaveSecure - $19.90/yr. You can track your phone, lock it, and back up/wipe the data.

Where's My Droid - Free for basic features (basic locate, basic remote control, basic lock), $4 for full features (remote wipe)

 iOS:

Find My iPhone -- Free for all thanks to iCloud. You can even have it automatically wipe your device after 10 failed attempts.

 Windows Phone 8:

 Built-in feature through connected Windows live accounts using http://www.windowsphone.com/en-us -- See here for full details

Encrypting Files on your Phone

As already mentioned, your device leaks data like a sieve. Using encryption can help secure your device some (either full-disk encryption or folder encryption)

Android 3.0 and higher support full-disk encryption. Though the option may not be available for old phones that upgraded to Android 4.0+

For file encryption, you can use Tasker. The Android Market version used to not have encyption, but I don't know if this changed or not. To be safe just buy the version on the website and manually install the apk. Instructions on how to encrypt files using Tasker. Another option is Crypt4All Lite. The advantage of Crypt4All is that it's based on AES Crypt, which runs on desktops, so your encrypted files can be used on both your phone and desktop.

iOS: The phones have default built-in hardware encryption, but to make it useful you need to set a passcode. No further options exist on stock devices, however for file-level encryption, AxCrypt can be used. AxCrypt also runs on Windows with a prerelease for Mac OS X and Linux.

 Windows Phone 8: Windows Phone 8 has full device encryption through a variant of BitLocker. Unfortunately it appears to be only be an Enterprise option, as it requires Echange to enable. It also doesn't encrypt removeable storage and I still can't find a tool for file-level encryption.

App Permissions

Be careful what you install. Here is a list of some of the worst offenders of apps that invade your privacy: What they Know. On Android, always pay attention to what permissions an app asks for on install and make sure it makes sense.

 There are ways to restrict app permissions on Android, but they all require root and/or special ROMs/kernels:

 1. PDroid -- Doesn't require root to run (but does to install, the difference being the app itself doesn't need superuser privileges), but is quite an involved setup process and only very specific ROMs are supported.

 2. LBE Privacy Guard -- Requires root. Unfortunately, it's very heavy on the CPU (and therefore battery) and the latest version apparently has issues remembering blocked privileges past a reboot.

 3. CyanogenMod can do it natively but it isn't without issues, so about on-par with LBE Privacy Guard.

 Even for jailbroken iOS, I couldn't find anything to restrict app permissions, the best I found was a jailbroken app that alerts you when other apps try to access your contacts: ContactPrivacy.

Android Specific: Apps to Improve your Security and Privacy

1. DroidWall -- it brings a firewall via iptables to your phone (requires root and doesn't work with all kernels)

 2. Get an AdBlocker. Opera Mobile has it built in and you can get AdBlock Plus for Firefox. This doesn't include Apps though... How to fix this? Well if you're rooted you can use AdAway, which modifies your hosts file to completely block all apps. If you're not rooted, you still have some options, but it's not as feature-rich (though if you're rooted, it is), and the option is AdBlock Plus for Android. Yes, AdBlock Plus exists for Android as a whole so will block ads throughout it. If you're not rooted it'll only work on WiFi( and if you have an old version of Android, it'll require manual configuration).

 3. Incoming calls/texts: Some ROMs have native ways of blocking incoming calls/texts. Others don't. If you want this feature you have a few options. On the rooted end, and very feature-rich is Root Call Blocker, but it seems finicky on which phones it works on. Other options that don't require root are Mr. Number and Call Control.

 4. Use TOR on your phone with Orbot.

 5. Get your Proxy On in Firefox Mobile via ProxyMobile. Note: this plugin is still very much in beta, so you may wish to configure your proxy by hand. This can be done by going to about:config and changing some settings. I'd also recommend changing network.proxy.socks_remote_dns to true. You can also use this with your own SSH server instead of random SOCKS proxies by using SSH Tunnel or ConnectBot (both of which allow creating SSH Tunnels). I personally have configured Firefox manually and use ConnectBot, but that's because I connect to various SSH servers frequently.

 6. Go a step further and use a VPN. Android has built-in support for various VPN protocols like IPSec, L2TP, and PPTP (those are the common ones supported out of the box). VPN settings can usually be found in the network settings. OpenVPN support can be found in various roms like Cyanogen as well as through apps like FeatVPN and OpenVPN for Android.

iOS Specific: Apps to Improve your Security and Privacy

1. Get an Adblocker. Unfortunately the only option I'm aware of requires a jailbreak, and that's AdBlocker

 2. Incoming calls/texts: Once again, jailbreak is needed. It can be done with iBlackList

 3. Use TOR on your phone. This one doesn't require a Jailbreak! A Miracle by any meaure :P Just install the Onion Browser. Unfortunately it doesn't seem like it works out well for most people, so there's a jailbreak option with more success

 4. Set up a VPN on iOS. You can also connect to OpenVPN, but that requires a jailbreak.

Android Specific: Rooting and ROMs (and a bit on jailbreaking for iOS)

To root or not to root is a very good question. There are pros and cons to both. Rooting itself isn't much of a desired thing for your average, though if you are careful with your superuser privileges, it's certainly adds a lot of new capabilities. When flashing ROMs, it's important to make sure that you secure new vulnerabilities you may have gained, such as an ssh server. Same for iOS users: If you jailbreak your device, you now have SSH access that has a default and well-known username and password, so change it. There's been scattered incidents of jailbroken and rooted phones being hacked due to unchanged SSH credentials.

 On to ROMs specifically, I suggest everyone using Android looks into them, especially after your 1 or 2-year warranty is up. The reason? Security patches. Many phones get abandoned and never receive critical android security patches. By running your own ROM you no longer have to wait for slow companies to patch your devices, but rather generally speedy groups of people who want to ship the latest Android in their ROM.

Smartphones: The remaining stuff

Disable Bluetooth when not using it.

 Watch your picture uploads, especially if paranoid. By default the metadata in the picture will include geolocation information that you may not want out there. It's relatively simple to disable by just changing some settings.

Read More

Data Privacy Day Prep Part 1: Passwords

Data Privacy Day is one of my favorite holidays and falls on this upcoming Monday. Every year, for the days leading up to it, I like to talk and publish reminders about. I normally post this on the Bethesda forums, where I'm quite active, but now that I have a blog, why not also add it on here? Here's part 1, it's about Passwords. It's long, so maybe read it in chunks. It'll always be here for you to refer to later :P

The goal of Data Privacy Day is to make people more informed about their data and privacy. I hope you find some of this information useful and put it into action. Security and privacy are constantly evolving items, and what cuts it today may not in the future, but this should be a good springboard to boost your security and privacy for Data Privacy Day and the years to come. As always, the level of security you need will differ from others, so you need to figure out what level is good for your needs. Some things, though, are universally applicable to all, such as a good password system. Another thing to remember is that even if you follow the best of security practices, it may not be enough to stay safe if a company who has poor security practices gets hacked (and after the summer of 2011 hacks and the ones that followed in 2012, I think we are all familiar with that).

 Important definitions for this section:

• Two-factor/multi-factor authentication: The use of two (or more) forms of authentication. They must be different forms, using two items of the same form does not qualify (so two passwords is still considered single-factor authentication). There are three forms of authentication:
  
  
  1. Something you know (Password is most common, followed by a PIN, and in smartphones: a swipe pattern)
  2. Something you have: A keyfile, ID card, or a token
  3. Something you are: Anything biometric such as a fingerprint or iris scanner


• Brute-force attack: A hacking attack where the hacker systematically tries every possible combination to gain access to your account
• Dictionary Attack: A hacking attack where the hacker systematically goes through every word in the dictionary, followed by every name, followed by any personal information they know about you

Passwords

Passwords are the most common form of security online, and they aren't going anywhere any time soon. Unfortunately, passwords probably aren't the best form of security for numerous reasons: people can only remember so many good passwords (without using a manager or system, which I will talk about shortly) causing password reuse to be rampant, people can easily fall victim of social engineering (either in the form of spearheaded attacks or phishing), the rules for what you can include in a password are not universal (which causes problems for password creation systems), and they can be captured in transmission. Still, as I mentioned, they aren't going away any time soon and making your passwords good is a very simple thing to do.

 Let's start with some questions about your current passwords:

1. Do you use the same password everywhere or almost everywhere?
2. Are your passwords less than 12 characters in length?
3. Do your passwords contain a word from the dictionary or a name properly spelled?
4. Is one (or more) of the following missing from your passwords: a lower-case letter, an upper-case letter, a number, or a special character?

If you answered "Yes" to the above questions, there's a good chance your passwords are weak. If you see your passwords on this list of the 25 worst passwords of 2012, then even more-so are your passwords weak as they are on every password list out there. Some other lists are: 20 most common pins, Top 20 worst Passwords, Top 500 Worst Passwords, and Password analysis of 3 hacked password databases (I quite enjoyed the character frequency analysis, might give you some ideas for characters to use)

 So what is wrong with those 4 things?

1. When you use the same password everywhere or almost everywhere, if any site gets hacked or you slip up and give out the password just once, all or almost all your accounts are compromised. -- XKCD on using the same password everywhere
2. The shorter the password, the easier it is to crack. In some instances, short passwords use weaker hashing algorithms in general than longer ones (for example, Windows XP passwords under 15 characters use LM Hash, which is extremely weak, passwords with 15+ characters use NTLM)
3. Words and names are extremely easy to crack with a modern PC by just doing a dictionary attack. It's all the easier if you have a botnet or supercomputer trying all the possibilities.
4. The more variance in your password, the better. Having at least one of each character type significantly boosts your password strength compared to not. Once you leave alphanumeric passwords, the chances of your password being in a dictionary list, once you get past simple substitution and just appending special characters at the end or beginning, you can even beat many pinpointed attacks such as those that can be created by the Common User Password Profiler

So, just how secure is your current password? Test it out here. If you are paranoid (which in this case is NOT a bad thing), you can view the source. It all runs locally and sends nothing back, it even works fine in offline mode. Still a little anxious about entering your password? Just type in something that is similar to your password. So long as you use the same number of each characters it'll return a similar value. Note that the time that how secure is my password tells you is a best-case scenario, so if you have something like 3.2 years, it can probably be done in a few weeks using CUDA and good NVidia GPU.

Further reading: How I'd Hack Your Weak Passwords -- a bit on the old side, but still a great read.

Keeping Track of your Strong Passwords

The problem with creating a bunch of strong passwords is that it's hard to keep track of them. As I mentioned, this is one of the problems with the password system. Thankfully, there are things you can do about it. I personally have over 100 passwords and have no issue entering them in when needed. The trick is to not memorize all your individual passwords (I personally only have maybe 10 passwords committed to memory).

 One of the more simple ways to do this is, rather than memorizing your passwords, you memorize an algorithm, or system, to creating them. That way, even if you forget the password, you can easily reverse engineer what the password would be. The password remains strong and only those that know the algorithm can come up with the password. The Mozilla Team created an excellent video on this that you can watch here.

 There are problems with algorithmic passwords, though, one of them going back to a flaw with the password system as it exists: the rules for what you can have in your password are not uniformly followed by all sites, so your password algorithm may not work for all your sites. In general, I'd say you need at least 4 or 5 algorithms to cover all your sites, assuming all of them allow all characters: a sub-8 character algorithm, a sub-15 character algorithm, a sub-20 character algorithm, and a 20+ character algorithm. This is due to various sites putting limits on password length, a very unwelcome problem in my book that I wish would go away. The fifth algorithm you may want to implement is a separate algorithm for the most important of sites, such as your bank and email. Even so, remembering 5 algorithms is relatively simple to do, especially compared to remembering 30 different passwords (much less, 100 different passwords).

 The other option (and it's not an exclusive other option, you can more than easily implement both) is to use a password manager of some kind. There are many out there, but the good ones in my book are: KeePass, Password Safe, LastPass, DashLane a physical password list you always keep on you, and an encrypted digital password list. The first two are real password managers, the other two are merely a secured list of passwords. The difference is that a password manager helps simplify entering in your passwords (and that may be an issue with long, complex passwords).

 You may be thinking "What's wrong with my browser's password manager?" and the truth is: many things. Firstly the encryption on the password database isn't very strong. It is extremely easy to brute-force the encryption and many tools do it. Or even more simply, just copy those files over to another computer and place them in the application directory for the same web browser, and the browser will be able to use them (unless you enable a master password) and if these are password databases for Google Chrome or Firefox, they are viewable as well (once again, unless a master password is set). Opera is a step up in that it will never show you the passwords, just the username, but the encryption is still weak and plenty of tools will crack it to display all your passwords. I really cannot recommend Chrome's password manager at all as there is NOTHING you can do at the current time to secure it on Windows. If using Chrome, you really do need to use a third-party password manager. Both Firefox and Opera aren't much better off, but if you are going to use them, you do have some options. You may scoff that no one will get physical access to your computer, but they don't need to on Windows machines. A broswer's password database is stored in %AppData% which is easily accessible remotely thanks to it being included in Window's default share for user profiles. Even if you disable that, the admin share of C$ will include it (of course now I'm starting to delve into network security, which isn't supposed to be in this topic much).

Firefox's built-in password manager:

 First download the Master Password+ add-on and set a master password. A quality meter will tell you how strong it is. Set up an auto-logout time. You will never be prompted for your master password so long as you don't time out, but if you do you'll need to re-enter it again. Either leave it on a short time but only when inactive or set it to a long time (an hour or so) but always times out. Which to choose depends on your browsing habits and how easily you are annoyed.

Opera's built-in password manager:

 Opera's password manager is a bit more feature-rich than Firefox's and so is it's master password, which is good since there is no extension for it. Tools -> Preferences -> Advanced -> Security -> Set Master Password... and set your password. Set your timeout interval (right underneath it called "Ask for password") as you feel appropriate. Setting it to "Every time needed", the default setting, will probably drive you mad, an hour is good. Finally make sure to check the box for "Use master password to protect saved passwords". If you don't, the master password only applies to client certificates.

 As I said, Firefox and Opera's password manager are only marginally better than Chrome's even with the master password, so a third-party password manager is still best as the encryption is many times better. If you do use them, at least think twice about giving them important passwords for things like your bank account. Please consider one of these good password managers instead.

The Good Password Managers

KeePass 2: KeePass 2 is a Password manager for Windows. That said, it is becoming easier and easier to install on Linux and Mac OS X so long as you don't mind Mono being installed as well to the point it is pretty much cross-platform (just no official releases for Mac OS X or Linux are made). Mac OS X users can head here for an installer and Debian/Ubuntu users have it in the software repos or via PPA. Alternatively there is KeePassX which is fully cross-platform, but it only works with 1.0 databases and doesn't work with browser extensions such as KeeFox, ChromeIPass, or PassIFox. You give it a master password, and, optionally, you can create a keyfile (this is known as two-factor authentication. See "Important Definitions" at beginning of post). Now you only need to remember one password and all your passwords are secure.

 As mentioned there are various plugins for browser integration with KeePass to make entering passwords even simpler than it already is. This includes KeeFox (probably the best integration, but Mac OS X and Linux installs are tricky/beta-ish), PassIFox (not as good as KeeFox in my opinion, but works on Mac OS X and Linux as well as Windows), and ChromeIPass (which is the Google Chrome/Chromium option and also works on Mac OS X and Linux as well as Windows). Of course KeePass works with all browsers and pretty much all applications through an auto-type feature + a keyboard shortcut (default: Left-Ctrl+Alt+A but easily changeable to your preference) so you don't have to worry about a plugin if you don't want to. There is also a portable version available, so you can run it on the go from any Windows computer.

 Finally, in the modern world where smart phones are of great importance, there are programs compatible with KeePass available on all major smartphone platforms: KeePassDroid for Android, 7Pass for Windows Phone, and either MiniKeePass (free) or one of a few paid versions that exist on iOS.

 Pros: Open Source, you control it, portable, highly secure, will tell you the strength of your passwords, can generate random passwords, works with pretty much any program. Works on Android/Windows Phone/iPhone too.
 Cons: The auto-type feature takes a little getting used to, while it works with any pretty much program the overall integration suffers to allow this (Except in Firefox/Chrome where KeeFox/PassIFox/ChromeIPass creates seamless integration).

Password Safe: Password Safe is a password manager created by crypto legend Bruce Schneier. It's a simple program with a single goal: creating a digital safe for your passwords. It was later open sourced and has a derivative project Password Gorilla. Password Safe is Windows-only whereas Password Gorilla is fully cross-platform and that's basically the only difference between the two. Many other derivative projects have been done as well, including many command-line tools. There exists both an iOS app and an Android app, but I don't know of a Windows Phone app.

 Pros: Open source, you control it, highly secure, does one thing and it does it well. command-line versions for command-line junkies.
 Cons: Not as feature-rich, extensible, or simple as KeePass, lacks Windows Phone support.

LastPass: LastPass is a cloud-based password manager that works in all major browsers and the browser version is cross-platform. There is a desktop version for application passwords and whatnot, but it currently only works on Windows and requires a Premium (paid) account. It also does not appear to have a keyboard shortcut auto-type feature like KeePass. You can find more information about the Desktop version for applications on their website helpdesk. Likewise for smartphone use, you need a Premium (paid) account; apps for all major smartphone platforms exist. Offline access to your passwords is possible through a cross-platform program called LastPass Pocket and is available with a free account. They also offer One-time Passwords for use on untrusted computers that instantly expire (which reduces the risk of your master password being compromised). There are also many options you can enable to make LastPass even more helpful and secure, and it'll even alert you when it detects an account tied to your email address has been leaked.

 Pros: always with you so long as you have Internet Access, instantly syncs, highly integrated, audits your passwords, can generate random passwords, one-time passwords, very secure (before you ask: It's been verified that LastPass NEVER gets your encryption key -- see here)
 Cons: You must trust that they will stay around, have to pay for use on your phone, if your Master LastPass password is compromised, all your passwords are compromised*

 *Note: LastPass Premium offers USB-based two-factor authentication (see here). More recently, LastPass added Google Authenticator two-factor authentication for free. The Free version also has grid authentication, which I don't quite consider unique enough of "something you have" to be two-factor authentication, as if someone knows what your card looks like, they can access your account without actually having your card, but still a significant security boost. One-time Passwords also lower the risk of your master password being compromised.

DashLane: DashLane is a newcomer and competitor to LastPass. It offered some features before LastPass like and securly sharing notes and passwords with friends and securly sharing notes and passwords with friends. It specializes in autofill, and does a very good job at form detection (hence the name: it dashes you through the checkout lane for online orders) and doesn't seem to miss a beat security-wise, keeping up with LastPass. As an added bonus, basic smartphone support is included for free (though you don't get all the benefits on the phone or note sharing unless you go premium). It also enforces a basic two-factor authentication before allowing you to install it on new devices.

 Pros: Always with you any where you have Internet access, instantly syncs, highly integrated, very secure, free basic phone support.
 Cons: You must trust that they stay around, gotta pay for the premium and full features, if your master DashLane password is stolen, all your accounts are compromised.

Keeping a list always on you: Obviously no software is involved, you just simply keep a list on you at all times, say in your wallet (or anywhere else, so long as you always remember to keep it on you). This method, while once frowned upon, has been gaining popularity in recent years among security experts*. Why? Because it is always on you, so you know it is safe. If it isn't on you, then you know it is time to change all your passwords. For extra security you can do a trick to the list that only you know. For example: inject a random number in every password at a specific spot (or in a pattern that you know). If the list falls into the wrong hands, they can't tell those numbers aren't part of the actual password and as such cannot use your passwords right away or at all. This gives you more than enough time to verify you didn't just leave the list at home and to change your passwords to something secure again.

 Pros: Pretty secure, you are instantly aware if your password database is compromised since it is always on your persons. Always with you in all circumstances
 Cons: You must diligently keep it always on you for the security aspect, obviously if you do no trick and lose the list, all your passwords are potentially compromised, likewise it is obviously 100% manual. Just don't leave them in the usual spots.

 *Bruce Schneier on writing down your passwords(Source under "Safe Personal Computing"):

Passwords. You can't memorize good enough passwords any more, so don't bother. Create long random passwords, and write them down. Store them in your wallet, or in a program like Password Safe. Guard them as you would your cash. Don't let Web browsers store passwords for you. Don't transmit passwords (or PINs) in unencrypted e-mail and Web forms. Assume that all PINs can be easily broken, and plan accordingly.

Encrypted Digital Password List: To some, a digital password list would be preferred to a normal one. There are risks to leaving your passwords just in plain text on your computer through (some malware looks for things like passwords.txt and whatnot and uploads them to some far-off place), so encryption is a must. The advantage of a digital list is it's easy to back up, lowering the risk of you losing it as well as allow you to synchronize the file onto multiple computers (though it begs the question: why not just use a password manager?). A simple and effective cross-platform encryption program is TrueCrypt. TrueCrypt is an on-the-fly encryption tool and allows you to create encrypted file containers in which you can store your password list.

 Pros: Extremely secure. Truecrypt in particular offers many options for creating your encrypted file container (including a hidden volume).
 Cons: Obviously not integrated at all with any application, so you must do everything manually. Must use a third-party program to synchronize the file across computers.

 Some Mac OS X-specific Password Managers:

 1Password -- It's also available on Windows, iOS, and Android, but I'd only recommend it if you don't want to deal with KeePass 2 with Mono and Mac OS X is your primary OS. It's free only for 20 or fewer passwords, otherwise you have to pay, and it's on the expensive side ($50 for one license for one desktop platform, $70 for a license for both desktop platforms, $100 for 5 licenses for both desktop platforms). Still, it's very user-friendly on Mac OS X.

 Keychain -- Keychain is the default password manager for Mac OS X, but it's not without flaws that have come up over the years (usually patched though). It can be integrated with both Safari, Google Chrome (uses it by default), and Firefox, but it's not easily synchronized across your computers and definitely not cross-platform or portable.

 And of course the 4 password managers listed above all work on Mac OS X.

 Two-Factor Authentication

 The need for two-factor authentication is becoming more and more prevalent every day. Luckily, it is also becoming more and more widespread every day and easier to implement. Two-factor authentication can make it so even if your password is compromised, your account isn't. It would have stopped Mat Honan (see below) from having his life destroyed by a hacker. By far the easiest to achieve implementation of two-factor authentication is through the Google Authenticator platform, which is open source and has derivative implementations. What makes it great is that you don't need to buy an expensive security token like RSA SecureID, just need a supported device. This is most commonly done through a smartphone using the Google Authenticator app, but as the Wikipedia Article shows, there are other implementations of Google Authenticator you could use. Many services that support Google Authenticator will also allow you to sign up for two-factor authentication through SMS messages, so you can even use it with a regular phone.

 Debunking Myths of two-factor authentication | List of places you can enable two-factor authentication

 Pros: VASTLY increases your security.
 Cons: does make logging in sometimes a bit harder, but with Google Authenticator, it's pretty easy. I would suggest printing out the offline one-time use codes through, just to be safe.

What you can't Protect Against

 Strong passwords won't protect you against everything: you have no control over how a website handles security. Mat Honan is all too familiar with this.. This shouldn't be discouraging, though. You just need to do the best you can do. In the event a site you use is compromised the best advice is to change the password ASAP. Changing your password will nullify any danger after a compromise. Most services are kind enough to alert you after a breach, but not all. There are some other steps you can take as well: Oftentimes when a hack is done, the hacked database is released and can be downloaded if you know where to look (sometimes it's free, other times it isn't depending on the purpose of the hack). Services like PwnedList will look for your email address in leaked databases and alert you of matches. If you use either LastPass or DashLane, you can use this feature through their services too (they partnered with PwnedList).

Passwords - the remaining stuff

 To note, there are other methods for creating secure passwords. Popular ones include using phrases from a book or song, and recently just stringing together 4 random funny words, popularized by an XKCD comic strip. If these methods work for you, that's great, but personally I see them as relying too much on human memory, which is too easily fallible. There's no way I'd be able to keep track of all 100+ of my passwords by using different strings of 4 random words or remembering which phrases from a book go with which sites. I see these methods, in the long run, as encouraging password reuse. Password reuse is the enemy to be stopped at all costs, as password databases get compromised, and once you start repeating password -- no matter how strong, you run the risk of multiple accounts being compromised from a single password leak. Still, if you only have a handful of passwords, these methods can create strong passwords provided you can remember them.

 At this point your passwords are nice and complex, secure, and easy to remember/access, but that is not all there is to say on password security. Remember those password hints and pesky security questions you set up for most services? Those can be an Achilles heel to your accounts if you are not careful.

 For password hints there are a few things you can do: You can do away with them completely, typing in gibberish when forced to have one (what I currently do), or you can use things you know you know to help you remember the pattern you use for your passwords. Along the lines of "That place where I put that thing that time" - It means absolutely nothing to anyone but you. In all cases you should be careful here and any hint you give should use word associations or have a meaning that only you would understand relying on your personality or life.

 Security questions are similarly a dangerous thing, much more dangerous than password hints as they can reset your password. Weak questions mean your strong password is worthless. If you are confident in your passwords to the point you are certain they will never be forgotten, once again you can make these complete gibberish so they are impossible to break into. Security questions have two pitfalls: 1. They are susceptible to social engineering since they are questions about you. Make sure you NEVER post your answers to your security question anywhere ESPECIALLY social network sites like Facebook and Myspace. If you do that, then all your security efforts go down the drain. 2. is security questions are often just a word or name, making them HIGHLY susceptible to dictionary attacks if the security questions don't have a lock-out. To combat this make your answers always at least two words, and maybe throw in a special character at the end or the beginning that is your "trick" for them. One thing growing in popularity that does a good job to combat both, is to create a pattern to your security questions that does not answer them and only you know -- ([url="http://www.zephoria.org/thoughts/archives/2007/11/15/algorithms_for.html"]see here). My advice is to do that, but also make sure to include a special character or two.

 Over the last year, I've seen comments on GPU password cracking coming up more and more frequently. I see this as missing the point. GPU cracking only applies with offline password hashes/databases. It's not something you need to worry about as a threat to your online accounts. In the event your passwords get leaked by a website getting hacked, having strong passwords is your best defense for you having time to change your password before it is cracked using GPU cracking. So my advice is: don't worry about it, and just change your password as soon as you find out a site's been hacked.

 You'll see some people recommend you change your password periodically. It's also a common enforced policy in some offices/for some services. I personally don't subscribe to this train of thought. After a password is compromised, it'll instantly be exploited. the probability of you changing a password due to some 90 day password change policy actually stopping someone from using your compromised account is slim to virtually zero. Now there's nothing wrong with occasionally changing your passwords, and it's a good way to maintain them, but something being a good idea for maintenance and something adding real security are two different things. Takeaway: Don't feel pressured to change your passwords frequently, but the occasional password change isn't a bad thing.

 If you follow through with everything, your passwords will be very secure and any backdoors effectively shut to anyone but you.

Read More