Call me paranoid, but ...
Ok, take facebook or Google or twitter or some other popular website on the internet. They all require accounts using an id (usually your email address) and a password to get access to, right? So what happens when you forget your password on a certain website? You try several of your 'standard' passwords that you use for those sorts of websites, or you use your password that you use everywhere, or a variation of it until you exhaust all of your known variations, then you hit the "I forgot my password" link to have them email your password, right?
Well, let's say (just for argument's sake) that one of these sites monitors all of the password variations that you type into the password box when you get locked out of your account. They could build a list of all of your possible passwords for use later. They could have your id, email address and list of possible passwords to try to get into almost any other website! The one website that comes to mind eight off the top of my head is Google. They love to mine data and they love to get their greedy little hands on as much of it as they can. We've all forgotten our passwords to a website at one time or another. Google probably has a list of possible passwords that any one user uses on a variety of websites - plus through gmail, they could just snoop your email to see what your passwords are anyway, since they email you your password for just about every account you generate on the web not to mention the data that they could get access to and index if they could log in as people on websites... Let's forget about Google for now, since they're the obvious company that already knows everything about you that they need to know and if you're an avid gmail, gdocs, gchat user, probably hack into any of your accounts if they so desired and let's focus on a different major website - I could pick any, but facebook is super-huge, let's pick on them.
Facebook knows your location, education, friends, email address(es), hobbies, and possibly all of your online passwords. With this information, facebook could blackmail people, get into their bank accounts, their work accounts, ... Pretty much hack into any account on the internet that requires an id/pw combination and is protected by some sort of personal information to reset your password. Social sites know so much about you - the name of your dog, where you went to school, where you went on your honeymoon, ... Pretty much any question on that "I forgot my password" list of questions that you select a couple from to use as your password reset Q/A security step can be found on any social site today.
I love google and google apps. It would suck to go cold-google-turky and use desktop apps and not have the flexibility of using all of the Google tools that I come to rely on on a daily basis. I use Google Mail, Calendar, Reader, Docs, Voice, a personalized google search engine, and I'm sure that I'll be using Google Wave when it's available too. I'm a google junky and I also post stuff to facebook, twitter and other sites semi-regularly. I'm hooked-in and I don't want to un-hook if at all possible. So, what can I do about it?
The obvious choice: multiple password types. I have a Google-only password. I have a work-only password. I have an ebay/paypal-only password. I have a bank/finance-only password. I have a personal-machines-only password. I have several passwords and password variations for my online accounts that I don't care about. I need to add another one, a social-only password. Also, none of these passwords should be related or similar to each other in any way. Different phrases, different subjects, different number combinations.
This gives me 6 semi-secure passwords, and one 'pool' of crap passwords for sites I don't care about. It's hard to keep these passwords all sorted out, but I make the changes one at a time, and if I'm on a bank website, I know not to use any of my other passwords or password variations. Also, social sites don't get to even snoop in on my bank-only password attempts since I won't even be trying them in the password field at all if/when I forget my password.
Writing down passwords is a general security no-no. There are password-remembering tools that encrypt your passwords, Firefox and IE try to remember IDs and passwords for you as best that they can. There are password syncing utilities out there to keep your browsers in sync when you type something in at home and go to work and want the browser to remember it for you. Those are all fine, and I use them too mostly for convenience-sake, but I don't inherently trust them. Your browser can be used when you step away at work to use the restroom. Your encrypted password app can be lost if your OS crashes. Storing them online is just a bad idea.
When signing up for a bank account, or a 'serious' online service (your CC company, paypal, ...), don't use any of your online email accounts as an address. I'm lucky and I have my own email server, so I use it as my email address for those more serious accounts. This way, if I do have to hit the "I forgot my password" button, the new password gets sent to a known-secure email address that only I have access to.
So how can you remember your passwords? I tend to think that 'security through obscurity' is one of the best ways to go. If I build a website of my own and I'm worried about someone hacking it, I will write a custom website. I won't use drupal or wordpress or phpBB - those are sure to get hacked just a couple of months after I install them. The same thing goes for keeping your passwords safe. If you write them down, put them somewhere safe, I mean *REALLY* safe, like a safety deposit box or something - now that's a huge inconvenience if you just need to log into your bank and see your statement or something, but you see where I'm going. Generate a procedure that's not online, that is secure and has some sort of backup/redundancy to it. Then you'll be able to say without a doubt that you have a safe location for all of your passwords that will still be available if your home machine dies, if some sort of disaster happens, etc ...
Ok, enough ranting for today. Let me know below if you have any other ideas.
Recent comments
5 weeks 5 days ago
6 weeks 5 days ago
17 weeks 3 days ago
24 weeks 14 hours ago
24 weeks 15 hours ago
24 weeks 21 hours ago
24 weeks 22 hours ago
24 weeks 23 hours ago
24 weeks 1 day ago
24 weeks 1 day ago