Review on "Favourite passwords used online"

First of all, this post is for a review on a blog entry made here So here goes. As a summary, this post posted on Feb 18 is mainly about a short statistics of what is the most frequently used passwords online. It was stated that 16% likes to use their name as their password, 14% used numbers in order... meaning 1234 or 12345678 and another 4% uses the word "password". The other usages are like qwerty, iloveyou, and others.




To say the truth, I am very much not surprised by these choices of combination as passwords. These passwords are easy to remember, simple, easy to type, or in other words "good for the brains". One would definitely NOT forget it (forgetting it is simply.... unacceptable...), so the good thing is, you wouldn't lose access to the destination you are heading to. Sounds good doesn't it... so the reason to use these passwords are pretty much obvious. In fact, this problem does not only occur on the net, it also occurs on the ATM machine. Most people prefer to use their IC number, birthdates, or numbers on their ATM card as their pin codes. The reason to this is also the same 3 words which is "easy to remember" However, the consequences of using these passwords are at the same time disastrous. People who don't even know you can simply hack into your account and manipulate your information. And for those who use their name or IC number as passwords, the people who KNOWS you can simply hack into your account. (So yes, I'm saying look out for the people around you). There has been many cases whereby friends had stolen ATM cards and withdrew the money without much hassle at all.

Of course when such problem arrises, many people have somewhat came up with a "solution" or suggestion to curb this problem. One of the examples given in the post was "choose a password that is longer than 8 characters with one capital letter and one symbol". Other suggestions are usually "include numbers and symbol in your password", "use words that doesn't bring any meaning as your password". More methods to keep your passwords safe are explain here. All of these suggestions seem pretty much useful to avoid people from knowing what is your password. The bad side? Even you yourself cannot remember what's your own password! In order to solve this problem, most people started writing notes and keep them under their desktop, keyboard, sticking it at somewhere(like the picture on the left) and so on.



As far as my own experience, I've lost my password, I cannot remember what it was, and usually when you are trying to retrieve your password they have this "question" thing asking things like what is your favourite food/pet's name/ etc, and I can't even remember what I wrote for the question. And the conclusion is I totally lost access to that website. Solution? Start new account...

So yes, I totally agree that creating difficult passwords such as aS^hlo$54 is a super good password but that only happens if and only IF you can remember it without having to refer it from other places. Simple? Think again, I can hardly even remember which password i use for different website access, what more a wonderful password which is made up with symbols and capital letters...

Alert!! Online Security Threat!

Hackers nowadays are genius! Planting trojans, worms/keyloggers, hacking into computers and stealing information becomes their number ONE hobby in their life! Some do it out of fun and some with nasty intentions.

The worried ones always find ways to stop hackers from intruding into their private information and destroying their data. They go from anti-virus programs such as AVG, Norton Antivirus, Kaspersky and lots more anti-virus programs. As technology upgrades, the threat level increases too.

WiseGeek shares the TOP 10 Online Security Threat which are:

1. Web servers and services
2. Workstation Service
3. Windows Remote Access Services
4. Microsoft SQL Servers (MSSQL)
   
5. Windows Authentication
6. Web Browsers
7. File Sharing Applications
8. Local Security Authority Subsystem (LSAS) Exposures
9. Mail Client
10. Instant Messaging

Are our data still safe?? How to mitigate these threats?
In my opinion, mitigation is almost impossible. However to avoid, there are ways such as:

Installing firewalls

Lots of software developers have created firewalls. Then firewall works similar as a police traffic, checking network traffics and block unauthorized passages and only permitted ones. However, I personally find firewall sometimes quite annoying and a waste of time. Especially in stress and tensed moments when you need to access into a site urgently and then there comes the firewall message stating whether to allow access or not. It can be a little irritating at times. But to protect from harmful threats, firewall comes to the rescue! However, sometimes it didn't really work because our "itchy" fingers might click and authorized the access of harmful sites.

Encryption

For example when using Paypal, while transferring information, people can tap into the line in which the data is transferring and steal it.When Computer1(C1) is sending to Computer2(C2), and before it reaches C2, the hacker can tap into the line to steal the data. Usually before sending a data or important information out, it is advisable to encrypt your data. In case if someone did tap into the line and steal the data, he will not be able to understand what he had stolen unless he has a program which can decrypt it.Otherwise, in Paypal for example, if the hacker succeeds in stealing your number and passwords, he may finish up your money on any online transactions. Last time it is not safe to use ATM and online transactions but nowadays, if people want to transfer money from one account to another, they will receive an SMS to confirm the transaction. Upon confirming the transaction with sms, then it will proceed in transferring the money. But! not to worry~ Lately Microsoft and other online transaction has already performed data encrypting in order to save and ensure customer's data is safe.

Protect Your Data with IP Security
Can data be protected using IP Security? Of course it can be done! IP Security can protect your data when it's in transit provided both the sending and receiving systems have to support it. Windows 2000 and later Microsoft operating systems have built-in support for IP security. Worry not, because IP security operates at a lower level of the networking model. There is this program called Encapsulating Security Payload (ESP) which IPsec uses to encrypt data that are sensitive and confidential. It can operate in tunnel mode, for gateway-to-gateway protection, or in transport mode, for end-to-end protection. Therefore, we can be assured that our data is quite safe through IP Security.

Password Protected Documents

Microsoft Office and Adobe Reader provide such functions allowing user to set passwords on confidential documents. With the availability of these functions, our data can be deemed to be safe. However, keyloggers can be embedded in spyware allowing private information to be transmitted to an unknown third party. A keylogger is a program that runs in the background, recording all the keystrokes. Once keystrokes are logged, they are hidden in the machine for later retrieval, or shipped raw to the attacker. The attacker then scrutinize them carefully in the hoping to find passwords, or possibly other useful information that could be used to compromise the system. This leaves our data not safe anymore.

All in all, as much as developers has become smarter to develop more programs to save us, the hackers have also became smarter to creating ways to continue stealing data. It's a battle of who is improving faster than the other to outsmart them.

How to Safeguard Our Personal and Financial Data?

Finally, PTPTN loan released...... This time I decided to pay the student bill through Public Bank E-banking service. The next day after class, I entered the computer lab, at the moment when I was accsessing Public Bank website to make online payment, my friend stopped me... He advised me to make such online transaction by using own's laptop as to keep my personal data from being tracked and stole by unknown party. I puzzled and thought to myself, "How come I have never thought of this issue?" Readers, have you ever thought about that?

In this E-century, information technology has become more and more advanced. It is very important for us to focus our attention on safeguard measures when using online transaction, who knows somebody who has evil motive is keeping an eye on your credit card information and might steal it?

There are several ways to safeguard online transactions:

1. Keep your firewall or any security software up-to-date to ensure no information to be seen by unauthorized people as we usually would not be able to know how safe the transaction processing is.
   
   
2. If you were to use credit card for online transaction, use the one which has the lowest limit, so that even if unfortunately, the credit card is being stolen, we loss only a small amount.
   


3. Try not to keep all your log in information in the computer, instead record the information in daily notebook or paper and keep it in a secret place.
   


4. When signing up for the online transaction account, create a longer or more complex password (e.g.: a password with both alphebets and numbers) to strengthen your data security.


5. Be cautious when your come to the payment stage, calculate the amount that you need to pay beforre you click on the "ok" button for payment as the bad motive person would catch your uncautiousness and change the figure of amount you need to pay. For instance, suppose you have to pay only RM 699.00, someone who has bad intention may change it to RM 969.00.




6. Make sure that you send your payment information to a right and secure site. Legitimite website will always come with "https' instead of "http". Besides, there will be a padlock symbol at the bottom of the screen.
   
   
   
7. At the top of the webpages, most of the time there will be a "pop up" bar requesting you to send some personal information through email. Bear in mind that not to trust such instruction.



8. Choose to conduct online transaction with those websites or company that have good reputation and have strong security policy to ensure customers' personal information are confidential.
   

In my personal point of view, Public Bank is practicing a good online security policy whereby all information of customers are encrypted using the 128-bit Secure Socket Layer (SSL) from MSC TrustGate Certificate Authority. In addition, the registration procedures of first time users are thorough. Users have to register e-banking service via Public Bank's Automated Teller Machine(ATM), which is to get a pin number as the first time log in password. The password can be changed when logging in to the website later on. PBeBank.com Authentication Code (PAC) will be sent through sms whenever payment were to be made. PAC is a 6 digits authentication code acts as additional security on our transactions and update our personal information.

In 25 June 2008, Kotak Security Limited also introduced similar "security key" to safeguard online transaction.

Related Links:

1. http://www.prlog.org/10083168-kotak-securities-introduces-security-key-to-safeguard-online-transactions.html
2. http://www.ehow.com/how_4880323_keep-online-transactions-safe.html
3. http://www.pbebank.com/en/en_content/info/security.html
4. http://www.pbebank.com/en/en_content/info/pac.html

Phishing: Examples and its prevention methods

Nowadays, Internet brings us a lots of convenience, especially buying online products, making online transactions, etc. We do not need to drive out anymore to spend our car fuel and energy. However, everything is not perfect. Knife can made out a good dishes, but also misuse to kill somebody. What i going to discuss now, is PHISHING.

Phishing is a process of luring users to acquire sensitive information such as usernames, password and credit card details by putting on a deceptive appearance as a trustworthy entity in an electronic communication. It is usually carried out by sending an e-mail and the e-mail will direct the user to visit a Website where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is fake whose look and feel alike, is a set up only to steal the user's information.

Example of Phishing methods















Sometimes, the phisher will use another tricks to cheat by sending e-mail with promotion package, discount affair, low price to bait so that we might give out our personal information in order to 'buy' these products & services. Human being easily be tempted when come to financial benefits. What we have to do is, THINK CAREFULLY before we made a decision.

There are several simple actions and reminders to tackle and avoid those phishing acts:-

1. Be suspicious of any email with urgent requests for personal financial information.(they typically ask for the personal informations such as username, password, credit card numbers, etc.)
   
   
   
   
2. Don't use the links in an email, instant message, or chat to get to any web page if you suspect the message might not be authentic or you don't know the sender or user.


3. Avoid filling out forms in email messages that ask for personal financial information.


4. Always ensure that you're using a secure website when submitting credit card or other sensitive information via your Web browser.


5. Remember not all scam sites will try to show the "https://" and/or the security lock. Get in the habit of looking at the address line, too.





6. Consider installing a Web browser tool bar to help protect you from known fraudulent websites. These toolbars match where you are going with lists of known phisher Web sites and will alert you.



7. Always update your web browser to latest version. Latest version usually come with stronger phishing filter and other features. Beside that, ensure that the phishing filter always activated.



8. Regularly log into your online accounts. (Don't leave your account too long to login and check, one week once is enough.)