You may have already had your computer, or some device you own get hacked. If you haven’t I’m sure you’ve read about, or a friend, or relative has told you about it happening to them. I’ve had it happen, and it’s a real bummer. If you don’t do these things you’re just being careless.
1) Everyone should turn on two-factor authentication now.
To get into most online accounts, you only need to dig up a single piece of data—a password. (The username on many services—including email accounts, Twitter, and Facebook—is your public handle, available to everyone.)
There was a time when passwords were enough (and you should follow my advice on how to create very strong, easy to remember passwords). But now we’ve all got so many online accounts protecting so much valuable information that we need something in addition to passwords.
Fortunately, that something exists. Unfortunately, very few people use it. It’s called “two-factor authentication”—a security system that requires two credentials to let you into an account. The first is something you know—your password. The second is something you have with you: a biometric marker (say, your fingerprint), an electronic key tag, or—easiest of all—a cellphone that can generate a unique code.
2) Seriously, sign up to a backup service. Do it now. What are you waiting for?
This one is easy: You should be backing everything up. There’s a good chance you’re not. Maybe you think doing so is difficult or expensive. Maybe you think nothing will happen to you. Maybe you’re just putting it off until your next free weekend.
But the perfect time to do it is now. Despite what you’ve heard, backing up is easy and cheap. Years ago, after testing out a few cloud backup services, I recommended that people use Mozy. Since then, I’ve switched to a service called CrashPlan—the cheapest, easiest way to back up all your data.
Here’s how to do it. Go to CrashPlan. Download the software. Choose the stuff on your computer you want to back up—your documents, photos, videos, music, etc. Then, let the program run. Over the next few days, depending on how much data you have and the speed of your broadband line, your data will first be encrypted and then sent over to CrashPlan’s servers, where it will be secured far better than you can secure it.
For all this, CrashPlan’s rates (after your 30-day free trial) are really great: You’ll pay as little as $1.50 a month for storing 10 GB of data from one computer, $3 a month for unlimited data from one computer, and $6 a month for unlimited data from up to 10 computers (in other words, for protecting all the devices in your house).
Whenever I recommend cloud backup services, people chime in with worries about storing stuff in the cloud—what if CrashPlan’s servers get destroyed or hacked? I think these worries are baseless (if CrashPlan gets hacked, your data there is encrypted anyway), but when it comes to backups, you can never be too safe. So if you want to supplement your cloud backup with a local backup on your own external drive, please do so. You can even use CrashPlan’s software to do that.
Does this read like an advertisement for CrashPlan? The company hasn’t paid me a dime to write this, but I’m not kidding when I say that CrashPlan is the most important, valuable add-on service that you can buy for yourself.
3) Remote wiping is unnecessary. Turn off “Find My Mac.” Instead, encrypt your data.
Being able to find your lost devices sounds great. You paid a lot for that tablet, phone, and laptop. Why wouldn’t you want to locate it if it’s gone? And if someone else has it, wouldn’t you want to delete your stuff remotely so that they can’t monkey with your data?
In theory, sure. But the way that Apple implements its “Find My” system isn’t very secure. If a hacker gets into your iCloud account, he doesn’t need any other credentials to find your devices and delete all your data. That’s what happened to Honan, and it could happen to you, too.
Until Apple figures out a better way to protect against others wiping your data (perhaps by requiring a second form of authentication for remote wipes), you should turn off Find My Mac.
But what happens if someone gets your computer—how will you prevent unauthorized access to your data if your computer gets into the wrong hands? It turns out there’s a better security system than remote delete: It’s called whole-disk encryption, and it’s built into the Mac and some versions of Windows. You just have to turn it on. (Here’s how to do so in Mac OS Lion, and here’s how to do so in the Ultimate or Enterprise versions of Windows 7.)
4) Password recovery is a menace. Make sure your accounts aren’t daisy-chained together.
Lastly, you should examine how your various online accounts are linked through forgotten password request services. In particular, look up your various important email accounts, financial accounts, social networks, and other services. Each of these accounts will ask you for an email address where your password requests should be sent.
If they’re all pointing to one another, a single hack could let an attacker get into everything else. For instance, if Gmail is set to send password resets to your Apple account, and your bank is sending requests to Gmail, then all the hacker needs to do to wreak havoc on your finances is steal your iTunes password (which is probably not very strong, because you hate typing out a tough password on a touchscreen to download apps). With your iTunes password, he can get into Gmail through a password request, and once inside Gmail, another password request will let him into your bank. This is exactly what happened to Honan.
What should you do about this? I would create a single, secret, ultra-secure email address that you designate as the one place to send all password resets. What do I mean by ultra-secure? I mean a new Gmail account—something like [email protected]—with a very strong password and two-factor authentication turned on. Now go to all your other accounts and have them send password requests to this secret address. It’s important that you don’t use this address for anything else—don’t send mail from it, don’t use it to sign up for newsletters, don’t let anyone know that it has anything to do with you. As long as it remains secret, any password resets that are sent its way should be safe.
Nothing online is perfectly secure—determined hackers can get into anything if they really put their minds to it. But the guy who attacked Honan wasn’t some mastermind. He was a kid who just wanted to wreak havoc, and he happened to know about a few key vulnerabilities at Apple, Amazon, and in the systems that govern our online lives. But a few simple steps would have made his attack much more difficult. The stuff I’m suggesting isn’t hard to do. You should do it now.
Read the full article at Slate.com
Houses come in all shapes and sizes these days. We've seen some pretty unique homes, however these homes you're about…
If you look at all the mass shooters over the last 20 years you will find one thing that almost all of them have in…
This is the first time I've ever talked about this subject, but I feel it's just as important as your physical…
Ready - Inform - Defend