Protecting your online identity - Managing your passwords

Editor's Notes

• #5: We have been awarded Best Protection..
• #6: But why should you use F-Secure to protect your customers?We have been endorsed by Forrester….
• #7: Let’s look at the detail of our security offering…
• #9: Lee Miles, deputy head of the National Cyber Crime Unit, says: "The NCA are actively pursuing organized crime groups committing this type of crime. We are working in co-operation with industry and international partners to identify and bring to justice those responsible and reduce the risk to the public."
• #16: 2012 – LinkedIn – 6.5 million passwordsThe stolen passwords, which were in an encrypted format, were decrypted and posted on a Russian password decryption forum later on that day. By the morning of June 6, passwords for thousands of accounts were available online in plain text.The attack occurred between April 17 and April 19, 2011,forcing Sony to turn off the PlayStation Network on April 20. On May 4 Sony confirmed that personally identifiable information from each of the 77 million accounts appeared to have been stolen. Credit card data was encrypted, but Sony admitted that other user information was not encrypted at the time of the intrusion (including passwords)
• #17: 123456 - 5% of the passwords
• #19: Basic Encryption - The problem is, the key is often stored on the very same server that the passwords are, so if the servers get hacked, a hacker doesn't have to do much work to decrypt all the passwords, which means this method is still wildly insecure.unlike encryption, hashing is a one way street: If you have the hash, you can't run the algorithm backwards to get the original password. However, you can try different paswords until the hashes match. Rainbow tables are made up of passwords that have already been tested against hashes, which means the really weak ones will be cracked very quickly. Their biggest weakness, however, isn't complexity, but length. You're better off using a very long password rather than a short, complex one (like kj$fsDl#). Salt - It uses a different salt for each password, and even if the salts are stored on the same servers, it will make it very hard to find those salted hashes in the rainbow tables, since each one is long, complex, and unique. LinkedIn is famous for not using salted hashes, which brought them under a lot of scrutiny after their recent hack—had they used salts, their users would have been safer. Adding a salt in itself does not make hacking harder. Instead, it makes the procedure longer.Slow hash. Bcrypt - By using a slower hash—like the bcrypt algorithm—brute force attacks take much, much longer, since each password takes more time to compute.
• #24: Google Authenticator, text message or email.Apple – Find my iPhone NotificationMicrosoft covers the Xbox
• #28: Freedome – Android first,ioS 7 coming, PC and MacWindows Phone doesn’t support VPN