|
So you write your passwords down (srsly, don’t do that), sometimes in an obvious way – there’s a (probably apocryphal) story of a senior healthcare professional who left their laptop (with lots of sensitive data on it, obviously) in a taxi… the standard disk encryption neatly foiled by a Postit note stuck to the lid with their username and password on it…
Corporate domain passwords will generally enforce a certain degree of complexity, frequency of changing, and may even add certificate or token based authentication that needs to be used in combination with other forms – so called secondary or multi-factor authentication (2FA/MFA. It’s getting pretty common now for web sites to offer or even force 2FA, achieved via texting a one-time login code, or using a mobile app to authenticate you. ToW #371 covered how to enable 2FA for your Microsoft Account (MSA) – you really should switch that on. For most people’s private credentials (used for logging into websites concerned with personal lives rather than work), usernames & passwords – with the odd secret question thrown in – are the main way they’ll access sensitive information from their phone or PC. And forcing the changing of passwords on a very regular basis can be a bad idea, too, as people are more likely to use easily-guessable passwords that are in turn easy for them to remember.
The average person, apparently, is many times more likely to fall victim to some sort of computer-related incident than a more traditional robbery. You might be hoodwinked yourself, or through your lax credentials, your account might be compromised and used to scam other unsuspecting punters – as happens regularly on eBay. The Man on the Clapham omnibus is also likely to use the same username & password for every website or other system they can, even though many know they shouldn’t. It’s easy to recall the same few sets of credentials, rather than having to go and look something up every time. Don’t do this. If you want to scare yourself into action, have a look on https://haveibeenpwned.com/ and see if your (consumer) email address is on there; chances are, it might have leaked from one of the many high-profile data breaches that have happened over the years. Try entering a common password you might use on https://haveibeenpwned.com/Passwords and it’ll tell you if that password has ever been leaked… and advise you never to use that password again. Password managers are a way to help combat the issue – so you could have a different password for each site, sometimes even a random password that the password manager itself will generate for you. Examples include 1Password, LastPass, KeePass, Dashlane, eWallet… many will be browser based or have extensions (even for Edge!), so you can log in easily despite the complexity of your passwords. If the password manager has a cloud-storage vault, make sure it’s encrypted and there’s no way it could be compromised … and make sure you use a suitably complex but easy to remember password to unlock the password manager vault. Quis custodiet ipsos custodes? If you use a password manager already, it may even have a report you can run to see how well protected you are…
Summary
|
