zoiaorg

by Roberto Zoia

How to Prevent Hackers from Accessing Your Mail and Other Online Services

Posted by on | ∞ Link to this article

Online security is more relevant than ever. News from hackers breaching massive number of user accounts from an online service no longer surprises anyone.

Two important things that you should do today to improve the security of your online accounts are setting up two-factor authentication and using a password manager.

Two-factor Authentication

Two-factor authentication means that each time you log into an online service, before you can get access to your account, you’ll be asked to enter an additional code after you enter your password. This code is generated by an app on your phone1, or sent to you by SMS, and changes every 30 seconds. With two-factor authentication enabled, even if your password is compromised, a hacker cannot log in into your account.

Ideally, security is based on three things: something you know, something you have, and something you are. Almost everybody uses usernames and passwords. That’s something you know. But as security experts point out, “passwords have outlived their usefulness as a serious security device”. Adding something you have to the login process, like an additional code generated by an app in your phone, greatly enhances security.

If you are required to use your fingerprint to unlock your phone, then you’ve introduced a third factor: something you are. This is probably the best scenario you can get without resorting to professional-level security.

Authy

There are several authenticator apps on the market, perhaps the most well-known are Google Authenticator and Authy. Microsoft also offers an app. My personal favorite is Authy, because it syncs across devices so you can generate tokens from your phone or laptop. (Authy’s webpage offers a handful of guides on how to activate two-factor authentication on popular services. Check, for example, their guide for Gmail.)

What if your mail service provider doesn’t offer two-factor authentication? Don’t hesitate, change to a provider that does.

Use a Password Manager

The second most important thing is to use a password manager. Writing down your passwords on a stick-it note or in your iPhone’s Notes app is not only inefficient but insecure.

Companies that require their employees to change their passwords every 30 days, and don’t provide them with a password manager, are simply encouraging their employees to use weak, easy to guess passwords, or to write them down in a note they stick to their laptops.

With a password manager, you only need to remember one password: the one for the password manager itself. The app takes care of storing the usernames and passwords for every online service you use. Thanks to browser extensions, they recognize which webpage you are visiting and fill in the proper credentials. It also keeps you passwords synchronized between devices. (And yes, you can enable two-factor authentication for the password manager itself.)

Passwords and hashes

To understand why password length and complexity is important, we need to dive into how online services store passwords, and what hackers do when they steal user’s credentials from a server.

When an online service asks you to enter a password to create your account, the password is not stored as-is in the company’s servers. Instead, the server generates a hash code for the password. This hash code, and not the actual password, is stored along with your username and other data on the server2.

A hash is a mathematical function that takes a string of data as an argument, and produces a fixed-size series of numbers, which is call a hash code. Different passwords will produce different hash codes, and it is nearly impossible to deduce the original password from the hash code.

To verify your identity, the online service asks for your password, generates a hash code for the characters you typed in, and compares it to the hash code it generated when you created your account (or last changed your password). If both hash codes are equal, it means that the password you just typed and the password registered on the server are the same. You are granted access to your account.

Now and then, hackers break into an online service’s servers and steal data: email addresses, and password hashes, among other data. These stolen databases are sold in the black market for money3.

As computer processing power becomes cheaper, it is possible to try a brute-force attack against a stolen database and succesfully recover part of the original passwords from the hash codes. Brute-force means that the hacker will use a program to generate, systematically, passwords with every combination of characters, and compare their hash codes with the hash codes in the stolen database4. For every match, the attacker now knows he or she’s got the password for a given account.

To protect you from this kind of attack, password managers allow you to generate long and random passwords for each new service you sign in. If you are inventing passwords by yourself, then your passwords are probably not long or complex enough. A long enough password ensures that a hacker won’t be able to crack it for several years from today.

This comic by xkcd’s Randall Munroe illustrates the point.

If the hacker get’s to know your username and password, chances are he or she will try to use them to access your accounts on popular services: Gmail, Facebook, Dropbox, Instagram, LinkedIn, etc. Once he’s got access to your email, he can request a password reset from other services, which will send a link to for resetting your password to your now-compromised email account. (That’s another reason to enable two-factor authentication.)

Which password manager should you use? I can recommend 1Password, which I’ve been using for several years now. Also, LastPass has excellent reviews.

Two-factor authentication and using a password manager are the most important things you should do today to improve online safety and protect your accounts from being hacked.


Photo by Dayne Topkin on Unsplash

  1. These apps are called, among other names, two-factor authentication or 2FA apps, authenticator apps, one-time password or OTP apps. ↩
  2. There are some online services that store their customer’s passwords as-is, which is a terrible practice. You can detect such services when you forget your password and click on the ‘Forgot your password?’ link: they’ll send you your password by email, instead of generating a new one or sending a link to reset it. ↩
  3. There are pages that will tell you if your email has been compromised in a data breach. Check, for example, \<https://haveibeenpwned.com>. ↩
  4. The attacker doesn’t even have to be an expert hacker to do this. For $10, you can get a very good book explaining how to do it. ↩

The urge to write

Posted by on | ∞ Link to this article

Cory Doctorow and the urge to write:

I’m the coeditor and co-owner of a website called Boing Boing, and I’ve spent the past ten years writing about ten blog posts a day, every day. I often find myself unable to think about anything in any depth without writing a blog post about it to check whether I understand it sufficiently to convey it to someone else.

— Cory Doctorow, Information Doesn”t Want to Be Free

Neal Stephenson on Deep Work

Posted by on | ∞ Link to this article

Neal Stephenson writes speculative fiction. In his books, he explores subjects such as mathematics, cryptography, linguistics, philosophy, currency, and the history of science.

Writing novels is hard, and requires vast, unbroken slabs of time. Four quiet hours is a resource that I can put to good use. Two slabs of time, each two hours long, might add up to the same four hours, but are not nearly as productive as an unbroken four. If I know that I am going to be interrupted, I can’t concentrate, and if I suspect that I might be interrupted, I can’t do anything at all. Likewise, several consecutive days with four-hour time-slabs in them give me a stretch of time in which I can write a decent book chapter, but the same number of hours spread out across a few weeks, with interruptions in between them, are nearly useless.

— Neal Stephenson, Why I am a bad correspondent

Designate someone to represent your audience

Posted by on | ∞ Link to this article

Stephen King advises that you designate someone you know, you trust, and whom you think represents the audience of your work to act as “The Reader.” Then, write for that person. They don’t even have to know that you’re doing this. In his case, it’s his wife, and she eventually does read his drafts, but he always keeps her in mind when writing and directs everything he creates at her.

— Gareth Branwyn, How to Be a Better Writer

Social Networks’s behavioral addiction

Posted by on | ∞ Link to this article

Cal Newport, in his book Digital Minimalisn, explains that there are two forces that encourage behavioural addiction when using social networks.

The first force, intermittent positive reinforcement, exploits the fact that rewards delivered unpredictably are more enticing than those delivered with a known pattern. The expectation of likes/hearts/retweets after posting online is comparable to gambling.

The second force is the the drive for social approval. Social media is tuned to offer us a rich stream of information about how much (or how little) our friends are thinking about us at the moment.

We didn’t sign up for the digital lives we now lead. They were instead, to a large extent, crafted in boardrooms to serve the interests of a select group of technology investors.

— Cal Newport, Digital Minimalism

A quick test to see how deep these two forces have taken hold of your behavior: delete your Facebook and Instagram apps from your phone for just one day, and see if you show signs of abstinence syndrome. You can always reinstall the apps later if you want.

Maybe it’s time to let the old ways die

Posted by on | ∞ Link to this article

A difficult aspect of facing technological innovation is the decision to change your business model in ways that disrupts your current business. It’s not easy to leave the safe shores of what works and is known.

NiemanLab published this interesting article about the L.A. Times and its difficulties competing in the digital business once the advantage of physical distribution of newspaper that gave them market power disappeared. Among other things, the L.A. Times is late in the game. The New York Times launched its first try at digital subscriptions in 2011, eight years ago. The table below, extracted from the article, shows the results.

“In every era, traditional media channels will diminish, dismiss and ignore the new ones. They do this at the very same time that they are supplanted by the new ones. While they will occasionally spend some time or money testing a new medium, they rarely leap.1”

An important exercise is to write down a list of the current technology trends, and consider how they could affect your business. The difficult part is not falling in a blind spot, dismissing things as ‘hyped’ or ‘not serious’.

Take, for example, Artificial Intelligence (AI). If you follow some kind of business trends, you’ll read news every day of companies applying AI to some part of their operation. The insight here is that there are a small fraction that are actually applying advanced AI. But there is a significant number of companies that are going through ruthless automation of everything task-related, applying automation to every process possible. Call it ‘basic AI’ if you want. In a couple of years, thanks to their lower costs and operational efficiencies (and the insight they can get from their data), these companies will be in a significantly better poisition to compete than companies that are dismissing AI as just ‘hype’.

Hint: If you can’t identify a technology trend that could disrupt your current business model, you’re doing your analysis wrong.

Photo by Austin Chan on Unsplash.

  1. cfr Seth Goding, The old media/new media chasm. ↩