Wednesday, December 16, 2009

Maddie247

I used to be carefree and footloose with my passwords. I used the same password for almost everything. It was pretty easy to guess, and if you did, you had access to just about my entire online life.

Then one day my Twitter account got phished, and, while that in itself is not very dangerous, I started thinking about all my other accounts with that password and decided it was time to get serious.

There are password guessing programs out there that mash through thousands upon millions of guesses so efficiently and powerfully, even passwords like My_checking-account247 fall easily to it. It knows all the tricks, the strung together words, the hyphens, the 365 and 247 add-ons, everything.

And failing that, passwords can often be gleaned from the data left behind by your computer, via software cracking algorithms. These programs check data in RAM and on disks to tease out cached copies of remembered passwords.

Password stealing is big, big business. Just think about what someone could do with access to your bank accounts, credit card numbers (with expiration date and that silly code on the back too), 401k account, email, Facebook, and everything else you do online. It makes me shiver.

So what to do? Well, if you know me, you know that when confronted with a problem I often go to extreme measures to solve it. I pulled out the big guns this time. I got something called 1Password that is designed to generate, hide, and maintain incredibly complex, essentially unguessable and uncrackable passwords. They are stored in a highly encrypted vault that is like a Fort Knox of logins. It's also got built-in anti-phishing and anti-keylogging protection. My passwords are now about as safe as they can be. A typical password of mine now looks something like this:

k5!#ON<3rbslGi:6C!MTS5pXn25VBqibzoA[u#3T?L.hOV

Go ahead and try to guess one like that. No pet names or anniversary dates in these bad boys! Even a CIA supercomputer would choke on this evil thing.

This software doesn't cache passwords anywhere. They are inserted at login on your command and then they vanish like dust in the wind. You can tell your browser and all sites to "not remember you", giving you another big security boost.

1Password generates such powerful passwords that I have run into several sites than can't even handle them. One site couldn't do special characters and many limit password length. Fortunately you can tone your passwords down in cases like that.

If you are like I was, please get some kind of plan for increasing the security of your passwords. Until we have optical retina ID scanners in use everywhere, this is your best bet.

2 comments:

Alisa said...

Mine's just "Bosco."

wildmary said...

i don't get it, where is it kept? Surely you don't know them.