Password Security and Protecting Yourself Online

There is a 14 year old right now in their parents' basement on a computer. They don’t know your password, but with a little time and ingenuity they could get into your email account. Once they’re in your email account, it’s just a matter of time before they’re in your Amazon, Netflix, bank, and even Paypal. Heck, even public figures have learned the hard way that password reminder tools can hurt just as much as they can help.

That password that stands between you and chaos, can be a string of six alphanumerics or if you’re a real overachiever it might be 16 characters and substitute a $ for an S. Ohhhh, tricky.

The thing is, that pa5$w0rd helps spread a false perception that your online data is secure. These days, accounts are daisy chained together for your convenience, but it’s pretty convenient for a hacker too. How many sites are setup with your email address as your username? How many other sites are setup to login with your Facebook or Twitter account? Get one and you’ve got them all, and that’s not hard to do with some of your personal information that’s publicly available and easily found online.


Hackers compromise data every day, and it doesn’t always make the headlines. For every incident of Anonymous taking down the banks and government agencies in Israel that makes national news, there are countless others that don’t. Hospitals, schools, insurance agencies, NASA. If they can get in there, your little email account is no sweat.

The move to the cloud has been a slow one, so it’s no wonder that we’ve been lulled into complacency.  In the early days of the internet, the “cloud” was barely a vapor, so your passwords could reasonably serve their purpose as their were few avenues of mayhem that a hackers could follow.

Now though, your photos, documents, money, communications... they’re all in the cloud. They’re safe from physical destruction there. A fire, flood, or hurricane can’t compromise them, but as these online accounts have blossomed, online providers have acquiesced to the user desire for convenience and have created a system riddled with vulnerability. We’ve been told that our savior here is the password, but the notion of a “strong” password is a lollypop we’re given to cover up the bitter taste of inherent weaknesses in the system.

Passwords can be guessed, stolen, cracked, lifted, and reset. Yes, people still choose terrible passwords. Yes, people recycle usernames and passwords from site to site. Yes, criminals can be tricky and make you think you’re doing one thing when you’re really doing another. And yes, the bad guys can take much more nefarious levels of tricking you. Then end result is the same though.

So what can you do? I mean, this is all pretty bleak! Short of installing a usb retina scanner or moving to the hills and going off the grid, what are your options?

There are actions you can take. There are actions you should take. And now.

1. Two factor verification. 
Some sites use multiple factors to authenticate the user at login. These can be knowledge factors (something you know like a password or PIN), inherence factors (something you are like a biometric of some sort), and possession factors (something you have like a mobile device or IT card). 

If you’re using Google Apps, you can enable 2-step verification for your domain to add that extra layer of security. Once it’s been enabled for your domain, the user selects the method for receiving their verification code on their mobile device: text message, phone call, via the Authenticator app on smartphones. 

After the initial setup, at the next login the user will enter their username and password as usual, then on a second page they will be prompted to enter their verification code from their phone. 

This two factor authentication is just the start for the Google, who is looking into other methods of verification and is vigilant at watching the patterns of your account and letting you know if anything odd happens. 

What happens if a device is lost or stolen? Google Apps supports Mobile Device Management tools, and Android devices that are registered in the Account Admin Panel can be remotely wiped if they might be compromised. 

2. Lie to your security questions.
Trick ‘em. What city were you born in? Where did you honeymoon? What is your mother’s maiden name? The Sea of Tranquility, Xanadu, and Mad Max. If it’s something I can look up on your Facebook page, it’s not something that should be guarding you online. Make up answers and stop being so predictable. 

3. Create a new email account. 
Make a whole new email account that isn’t tied to your name, and use it only for your password resets. If you use a password manager like LastPass, tie that to this new email account as well. The key is to NOT have all of your eggs in one basket, and to stop daisy chaining everything together. 

4. Have some password savvy. 
Substituting numbers for letter is sooooo 2010.  Most hacking tools have these built into their tools now, so stop it. But don’t use dictionary words either, unless you’re using a string of them. Simplicity, length, and variance are all factors to consider when you’re choosing passwords. 

5. Erase the loose ends.
Head over to spokeo.com and search for yourself.
Freaked out yet? It’s easy to hop on sites like Spokeo, Pipl, or Whitepages and find out the basics to start an attack, but it’s also simple to preemptively go on those sites and have your listing removed. Do it. 

We didn’t want to bring you a bunch of doom and gloom to darken your day, but being on the cloud in this day and age means being vigilant in keeping your data as safe as you can. Luckily, if you’re using Google Apps, there are some extra measures you can easily take that will make you that much safer online.

Security training. Auditing. Two factor authorization. It can all be a little overwhelming. If you have any questions about online security tools, or how to incorporate them into your business, contact Newmind today. As always, we’re here to help.

You talked. We listened.

Teachers Have Great Ideas!

We love hearing from our customers, and we use your suggestions whenever we can to improve our services. A suggestion came up recently that has made us look at our Chromebooks packages and decide to make some changes.

The story goes like this. The purchasing agent for a school district in Texas placed an order for several of the original Samsung Series-5 Chromebooks back in April 2012. During implementation, the technology instructors found them to be great devices for their students and in September, 2012 the purchasing agent called Newmind up again to order a bunch more Chromebooks as well as some charging carts.

The catch? During the lapse between these two orders, Google had announced the much faster and sleeker Samsung 550 Chromebook, and it was these that the purchasing agent requested for the second order. What the purchasing agent didn’t know was that the tech instructors in the school district were consistently using the VGA dongles, included with every Samsung Series-5 Chromebook, to connect to powerpoint machines, etc., which Samsung had decided to not include with the new Samsung 550 Chromebook.

So, when the second order of Chromebooks arrived in early October, Vicki, the head of technology instructors for the district, called us up wondering where her dongles were. I explained that Samsung had discovered that most Chromebooks users had found them to be of little value so they were not being added to the 550 Chromebooks.

Needless to say Vicki was bummed by the news. We talked about it for a while and she completely agreed that having a VGA dongle for every Chromebook wasn’t really that useful and understood their decision. She did have an idea for us though.

Vicki’s suggestion? For every charging cart we sell, include one VGA dongle so that each “mobile Chromebooks lab” has a way for teachers to connect to their power point machines. This way, no matter if purchasing agents, teachers, principals, or others are the ones actually placing the orders, the folks in the classroom who end up using the Chromebooks will have the tools they need to be successful.

All of us on the Chromebooks team here at Newmind talked about Vicki’s idea. We all love it and have decided to implement it. In those larger organizations that have different people making the purchases than who end up using the devices, we want to be that stop-gap to make sure that the end-users have what they need to be successful.

A big thank you goes out to Vicki in Texas for helping us identify this way for us to better help our customers. For all you other Newmind clients out there, we’d love to hear what you think are good ideas to make us better at meeting your technology needs, so don’t hold back.