Speaker 1: Welcome to tech Stuff, a production of I Heart Radios
Speaker 1: How Stuff Works. Hey there, and welcome to tech Stuff.
Speaker 1: I'm your host, Jonathan Strickland. I'm an executive producer with
Speaker 1: How Stuff Works in my Heart Radio, and I love
Speaker 1: all things tech. I decided to deliver it that way
Speaker 1: because Tary was going to lipstick it with me otherwise.
Speaker 1: I am here to give you a classic episode of
Speaker 1: tech Stuff, and I thought for a while that I
Speaker 1: should re enact the entire thing and do all the
Speaker 1: voices for me and for Chris, but Sary reminded me
Speaker 1: that I also want to get home today, so instead,
Speaker 1: we're just gonna play this classic episode for you. It
Speaker 1: is called tech Stuff looks at Password Security, and it
Speaker 1: dates from September nineteen, two thousand twelve. Enjoy Security has
Speaker 1: been in the news a lot lately as of the
Speaker 1: time we're recording this in lead August two thousand twelve, UM,
Speaker 1: and part of that is because, as we have touched
Speaker 1: on an a handful of times since some of the big,
Speaker 1: more widely publicized cases have been making the news that
Speaker 1: you know, hackers have been breaking into different accounts at
Speaker 1: major corporations online, stealing people's information. It's unclear whether people's
Speaker 1: credit card numbers were stolen or if we have your
Speaker 1: home address or we know the name of your dog.
Speaker 1: There was a whole story of Matt Honan getting his
Speaker 1: entire digital life hacked because of a vulnerability between the
Speaker 1: systems of Amazon and Apple, which clearly taken a loan,
Speaker 1: clearly were not obvious as problems, but when put together,
Speaker 1: post problems because they were the people who were doing
Speaker 1: the hacking game to the system and put them against
Speaker 1: one another to create a bigger picture that allowed them
Speaker 1: to get the information. Well, uh, you know, people have
Speaker 1: been saying that you need secure password please, and there
Speaker 1: are news reports about this too. People are still using
Speaker 1: password as password or obvious terms one, two, three, four.
Speaker 1: That's the kind of thing an idiot puts on his luggage. Hey, so,
Speaker 1: uh yeah, I mean those kinds of things are still
Speaker 1: in practice, and of course you need to use more
Speaker 1: secure passwords, but it's it's it goes deeper than that.
Speaker 1: There's more information out there now about how even using
Speaker 1: stronger passwords alone isn't necessarily going to keep hackers from
Speaker 1: being able to get into your account. So think about
Speaker 1: what you're doing. There's there's several several things that you
Speaker 1: have to consider. One of those is the idea of
Speaker 1: linking accounts together, because that means that should one account
Speaker 1: become vulnerable, then those other linked accounts could also be vulnerable.
Speaker 1: That was the case with Matt Honan, right. So one
Speaker 1: of the many problems of his yes UM because more
Speaker 1: identifiable problems because once they got to access to his
Speaker 1: Google account, then they were able to reset stuff all
Speaker 1: over the place. And then it turned out that all
Speaker 1: they really wanted was to access his Twitter account, which
Speaker 1: is I guess in a way he's fortunate, but it's
Speaker 1: still pretty crazy everything that they managed to do in
Speaker 1: order to do that, and they caused quite a bit
Speaker 1: of damage along the way to mattahone in anyway not
Speaker 1: to mention to the the the public perception of security
Speaker 1: UM on the back end. So that's one thing is
Speaker 1: linking lots of accounts together holds a very specific danger.
Speaker 1: I mean, for one thing like Facebook Connect or really
Speaker 1: any open i D approach, right, if that system is
Speaker 1: not secure, you have a single point that you can
Speaker 1: target that will give you access to lots of stuff.
Speaker 1: Now that's so sad because for us, the consumer that's
Speaker 1: so helpful. Yeah, having one account that you can log
Speaker 1: into and from there you can authenticate with multiple other services.
Speaker 1: You don't have to form after form after form. Uh,
Speaker 1: you know, it's it is a very valuable service now.
Speaker 1: And I'm not saying that that Facebook Connect or Open
Speaker 1: Idea or any of that is that they are not secure.
Speaker 1: They're putting they're putting lots of protections in place to
Speaker 1: try and keep user information as safe as possible. It's not. Yeah,
Speaker 1: it's not so much that it's inherently wrong, as that
Speaker 1: if something does happen, it can cause serious problems. Right.
Speaker 1: So that's one issue. Another issue is the way that
Speaker 1: we create passwords as users for those of us who
Speaker 1: are using either very common words or even names. Um,
Speaker 1: even if we think we're being clever by adding a
Speaker 1: few numbers to it, that's not really that secure. And
Speaker 1: if it becomes even more insecure if we're using those
Speaker 1: passwords at multiple accounts. So I think, uh, we we were.
Speaker 1: We both read an article from Ours Technical by Dan
Speaker 1: Gooden called why passwords have never been weaker and crackers
Speaker 1: have never been stronger. It's actually it's a fascinating read,
Speaker 1: and I do recommend you check it out if you
Speaker 1: find this episode interesting, where even if you don't, it's
Speaker 1: a good thing to know. And uh, it's it's typically
Speaker 1: our technical typically get into more technical detail than than
Speaker 1: articles on how stuff works dot com. But if you're
Speaker 1: if you're really serious about it, there there's a lot
Speaker 1: of important information in there, and we can give you
Speaker 1: kind of the layman approach to what is going on here.
Speaker 1: But part of that is that I remember reading, and
Speaker 1: it may not have been in this article, I do
Speaker 1: remember reading a statistic that the average user has something
Speaker 1: like six and a half passwords. That's in there. Okay,
Speaker 1: so they use six and a half past and you know,
Speaker 1: of course this is an average. We're not saying someone
Speaker 1: out there's just putting, you know what, I was gonna
Speaker 1: type in my whole password, which is typically password, and
Speaker 1: I'm just gonna type in pass for this one. No,
Speaker 1: that's not what it means sword, it's the average. So
Speaker 1: but that means that, you know, you think the average
Speaker 1: person has around twenty five accounts across the web, but
Speaker 1: they're using on average six and a half passwords, so
Speaker 1: each password is being used for around three times on average.
Speaker 1: I mean that's again an average. You might have just
Speaker 1: one password that used twenty times and the other three
Speaker 1: used the other five. Well, I don't want to use
Speaker 1: the same password on Google, and yeah, who's so I'll
Speaker 1: use one for one and the other one for the other,
Speaker 1: and then I'll use the Google one again for pest
Speaker 1: or whatever one for Facebook because they are those are
Speaker 1: disconnected enough where it's not gonna know. That's still a
Speaker 1: problem unless you think that I am a super genius,
Speaker 1: because I can say this, no, I I reused passwords
Speaker 1: from time to time too. I'm guilty of it, just
Speaker 1: as much as the planet. I was awful for a
Speaker 1: long time. Passwords among Yeah there were that was pretty
Speaker 1: much mine too. I had about three passwords that I
Speaker 1: used for almost everything. That is no longer the case. People,
Speaker 1: I don't do that anymore. Well, I told you I
Speaker 1: didn't mean you erase all those accounts anyway. So that's
Speaker 1: that's another user behavior, and we'll get more into that
Speaker 1: in a minute. But then the third piece is how
Speaker 1: safe are those passwords within the databases of the companies
Speaker 1: that hold those passwords. So if you are a cracker,
Speaker 1: you know a hacker who is specifically trying to crack
Speaker 1: into security systems, and you have identified a potential target
Speaker 1: to try and get at their password database, then uh,
Speaker 1: if it's if it's one where the user base of
Speaker 1: that service or company also typically has accounts at other places.
Speaker 1: You've managed to not just get the passwords for that
Speaker 1: one account, but knowing that people tend to reuse their passwords,
Speaker 1: you might actually have access to multiple services. Now, there
Speaker 1: are ways that companies can protect against this, not just
Speaker 1: by building a good security system that's hard to crack,
Speaker 1: but also by uh encrypting those passwords in the database
Speaker 1: that if you get that database, yes you've got a
Speaker 1: whole bunch of data, but it does not translate directly
Speaker 1: to the passwords because it's been put through a hashing algorithm. Yeah,
Speaker 1: and there's there are several sort of standard hashing algorithms.
Speaker 1: So basically it's a it's a little like email encryption too.
Speaker 1: So you have, let's just pick pass the four letter
Speaker 1: word pass um, you put it through the hashing algorithm,
Speaker 1: and on the other side of that, it the letters
Speaker 1: and numbers that make up the encrypted information look nothing
Speaker 1: like that. And it might be that your four letter
Speaker 1: password has just become a thirty two letter encrypted string
Speaker 1: of characters. Yeah, so somebody seeing that written down, say
Speaker 1: on a piece of paper, is not going to have
Speaker 1: any idea what that is, and they're not really going
Speaker 1: to have any way to decipher it. And theoretically it's
Speaker 1: pretty well, uh, pretty well protected, right theoretically, But here's
Speaker 1: the problem is that not first of all, not every
Speaker 1: company has historically encrypted all those passwords. And there have
Speaker 1: been cases where crackers have gotten access to a password
Speaker 1: database that was stored in plain text. That means that
Speaker 1: the password that you type in appears in that database
Speaker 1: as you typed it, so there's no hidden you know,
Speaker 1: code or anything. You've got those passwords, Well, that's very
Speaker 1: valuable to a cracker for more than just the fact
Speaker 1: that they now have access to your account. What's also
Speaker 1: valuable is that they now have a list of words
Speaker 1: that people use as passwords. So, uh, there's a there's
Speaker 1: a type of attack we should talk about, the brute
Speaker 1: force attack. A brute force attack is when a cracker
Speaker 1: tries to get access to a system by filling out
Speaker 1: the essentially filling out the password field multiple times until
Speaker 1: they get a positive result. And um, one way of
Speaker 1: doing a brute force attack. A very common way is
Speaker 1: to do what's called a dictionary at at where you take.
Speaker 1: You create a virtual dictionary of words that you use
Speaker 1: as the basis for passwords. Knowing that a lot of
Speaker 1: people will pick a common dictionary word as the basis
Speaker 1: of their password hard wark, antelope, ant eater, you know,
Speaker 1: and it just goes all the way through to pick
Speaker 1: animals for some reason. But something else that they'll do
Speaker 1: as part of this dictionary attack what they'll start adding
Speaker 1: changing symbols. So let's say your your password is hardwark,
Speaker 1: but you're being clever and changing the a's symbols at
Speaker 1: symbols and uh, you know, let's see you pick a
Speaker 1: word with with ease in it and you change them
Speaker 1: to threes. They try those two, Yeah, because those are
Speaker 1: very common approaches. And yes, you know, keeping in mind
Speaker 1: that most of us are using passwords that are easy
Speaker 1: for us to remember, and the more random ish or
Speaker 1: seemingly random these passwords get, the harder it is for
Speaker 1: us to recall them. So, knowing that's a weakness, the
Speaker 1: racker can say, all right, well, let's go with all
Speaker 1: these words, and let's go with the various variations we
Speaker 1: would expect people to use with these words. And even
Speaker 1: if you've done stuff like just added a couple of
Speaker 1: numbers at the end, that's not always a tough thing either.
Speaker 1: They can start going through all of these different variations
Speaker 1: adding various numbers at the end. If they know how
Speaker 1: many characters your password is, that already has given them
Speaker 1: a huge advantage. And the reason why this is possible
Speaker 1: is because we've got processors out there that can do
Speaker 1: these these calculations in parallel. You know, if you were
Speaker 1: to do them all one after the other, it may
Speaker 1: take you centuries to get through all the possibilities of
Speaker 1: a particular password, depending on how many characters there are
Speaker 1: within that password. Hey guys, it's Jonathan from two thousand nineteen.
Speaker 1: I just hacked into this classic episode because the password
Speaker 1: protection was laughable. It was just palette one to three.
Speaker 1: So I'm gonna mess around with some stuff. But let's
Speaker 1: take a quick break while I do that. In Hollywood,
Speaker 1: Hollywood computers can do an executive brute force attack in
Speaker 1: about twelve seconds. Yeah, well, sometimes that can happen here too,
Speaker 1: but that's generally not the way it works. Well, that's
Speaker 1: that's one of the interesting things about this article is
Speaker 1: you learn from reading that UH an attack like this
Speaker 1: doesn't take very long at all, that at most, assuming
Speaker 1: that you're not following really really strong password particles. UM. Yeah,
Speaker 1: it turns out that it's like, because of this parallel processing,
Speaker 1: you've got a processor that's working on multiple UH approaches
Speaker 1: to this logan attempt. So we can go through all
Speaker 1: these different variations, even when there are billions and billions,
Speaker 1: as Karl Sagan would say, variations of passwords, the processor
Speaker 1: can go through so many so quickly. You know, each
Speaker 1: each thread in that parallel processing is movie got an
Speaker 1: incredible rate, and you've got multiple threads all going UH.
Speaker 1: There are crackers who use graphics processing units GPUs to
Speaker 1: do this. They because the GPUs are designed to be
Speaker 1: parallel processors. Yeah. Even even though they're designed primarily to
Speaker 1: handle graphics instructions and display them on your your monitor,
Speaker 1: GPUs can be UH pressed into service, let's say, by
Speaker 1: a program by a software that that can specifically UM
Speaker 1: send instructions to it. So what people do, UM, there
Speaker 1: are open source programs that you can use to UH
Speaker 1: assign password cracking to your GPU. UM sad to say,
Speaker 1: and and one of the uh, the interesting stories that
Speaker 1: are One of the interesting bits that I read from
Speaker 1: this article too was uh that people have grown increasingly
Speaker 1: intelligent about the way they save cracked passwords. So they're
Speaker 1: saving up dictionary attack type information. And so if you
Speaker 1: use you know, password one, is your password on one site, um,
Speaker 1: and they want to hack in to your account at
Speaker 1: the House of online Grapefruit, they might try they and
Speaker 1: they've got your information. They could try it there too,
Speaker 1: to see if you've used your password on more than
Speaker 1: one site. So that makes it increasingly dangerous for you
Speaker 1: to use the same password in multiple locations because there
Speaker 1: is a growing database of password information that that people
Speaker 1: are saving and not just throwing away once an attack
Speaker 1: is completely That database also means that they can look
Speaker 1: at things like frequencies like how frequently are people using
Speaker 1: the specific word or variations of this word as a password.
Speaker 1: And the more people who use it, the more you're like,
Speaker 1: all right, well let's bump this up the list. It's
Speaker 1: more of a likely candidate for a password. So, you know,
Speaker 1: we like to think that the passwords we choose are unique,
Speaker 1: but that's if we're basing it off a name or
Speaker 1: a word. That's not the case. Are lots of people
Speaker 1: out there using lots of passwords, and there's a good
Speaker 1: chance that someone out there is using the same quote
Speaker 1: unquote unique password. You are. Just remember your unique just
Speaker 1: like everybody else. You know, when everybody is special, no
Speaker 1: one is. It's incredible. Um. The so yeah, the the
Speaker 1: the database can tell the cracker all right, Well, not
Speaker 1: only am I using a dictionary attack, but I'm using
Speaker 1: a curated dictionary attack in a way, because these are
Speaker 1: the known passwords that are floating out there in the world,
Speaker 1: and these are the ones that are really popular that
Speaker 1: lots of people use. So we'll go through all the
Speaker 1: variations of these first, and you just you tweak your
Speaker 1: cracking program to do that so that you can get
Speaker 1: the the largest number of results in the least amount
Speaker 1: of time. And another thing you can do is once
Speaker 1: you've figured out these passwords that are very popular, that
Speaker 1: helps you determine other things, like there are only so
Speaker 1: many hashing algorithms that are really popular out there in
Speaker 1: the world of computer security, right, so if you know
Speaker 1: which hashing algorithm there the particular company is using, and
Speaker 1: you are able to get let's say you get access
Speaker 1: to their encrypted password database. So now you've got a
Speaker 1: list of passwords that are encrypted, so you cannot just
Speaker 1: look at them and know what the passwords are. If
Speaker 1: you are able to determine which security protocol they're using,
Speaker 1: and you have this massive database of um of of
Speaker 1: of passwords that are really popular, you can run those
Speaker 1: passwords through the same encryption algorithm to look at the
Speaker 1: hashes that come out and then start matching them up
Speaker 1: with the stuff that was in the database. So you're
Speaker 1: still cracking the passwords, you're just going about in a
Speaker 1: different way as far as this brute force attack is concerned.
Speaker 1: It's still a brute force attack. It's just doing it
Speaker 1: in a kind of an odd roundabout way because you've
Speaker 1: got the you've got the hash of the password, you've
Speaker 1: got the security protocol that's being used. Now you're trying
Speaker 1: to yes the original word that created that hashed password.
Speaker 1: Once you're able to do that, that account is no
Speaker 1: longer secure. And if that again, if you're using that
Speaker 1: same password elsewhere, those accounts aren't secure. Um, So you
Speaker 1: might be asking yourself, hey, if there are crackers out
Speaker 1: there who have these really advanced tools that can either
Speaker 1: figure out a password or uh, you know, kind of
Speaker 1: worked on a list so that the passwords I use
Speaker 1: are vulnerable. How do I how do I protect myself?
Speaker 1: And there are a few things you can do. One
Speaker 1: is use a unique password for every service that you
Speaker 1: log into, which is incredibly difficult if you're doing it
Speaker 1: on your own, which is why I would suggest getting
Speaker 1: a password manager program. And there are a lot of
Speaker 1: them out there. There are some that are free, there's
Speaker 1: some that you pay for. Um, there's some that are
Speaker 1: in the cloud. There are some that are based on
Speaker 1: your system. Yeah. Uh, you use a password manager, right,
Speaker 1: I do as well. UM, I'll go ahead and say
Speaker 1: which one I use. I use dash Lane, which I
Speaker 1: tried out for the first time this year and I
Speaker 1: like it well enough. Um. It saves passwords and if
Speaker 1: you want, it will generate a password for you, so
Speaker 1: you don't have to just come up with a string
Speaker 1: of things. It'll it'll do it for you and save
Speaker 1: it to your account. You create a master password that
Speaker 1: is a strong password, meaning that there are upper and
Speaker 1: lower case letters. There's also numbers in there. Uh, and
Speaker 1: all you have to do is remember that one. Which
Speaker 1: that sounds tricky, but I'll give you a hint on
Speaker 1: how to do something like that. If you want to
Speaker 1: try it yourself, you create a master password. Uh. Then
Speaker 1: when you log into your dash Ling account in my case,
Speaker 1: you then have access to all the other passwords that
Speaker 1: are that that dash Lane generates. So I actually went
Speaker 1: in to all my accounts and use the dash Lane
Speaker 1: password generator program, and it creates a ten character long
Speaker 1: strong password that's unique. So none of my accounts used
Speaker 1: the same ones anymore. They're all ten characters long. They
Speaker 1: are a mix of various characters and uh. When you
Speaker 1: get to about nine characters, and if it's a truly
Speaker 1: you know at least a seemingly random series of characters
Speaker 1: and numbers. Uh. The difficulty of cracking that password escalates dramatically,
Speaker 1: So I might go from a matter of days, two
Speaker 1: weeks or months. And the harder you make it to crack,
Speaker 1: the more likely your information will be safe so or
Speaker 1: that it will just be difficult for anyone to guess. Um.
Speaker 1: So that's the purpose of creating these strong passwords and
Speaker 1: the purpose for the password managers, because strong passwords are
Speaker 1: hard to remember. Um, So all I have to do
Speaker 1: is remember my one master password here's the hint I
Speaker 1: was gonna make. So if you want to make a
Speaker 1: strong password, like a master strong password, uh, it's best
Speaker 1: that you come up with a phrase that you will
Speaker 1: not forget and it it's great if the phrase also
Speaker 1: has a proper noun somewhere after the first word, so
Speaker 1: that you have some capitals in there as well. And
Speaker 1: you need a number, like a four digit number is best.
Speaker 1: So for example, you might say Dad's first car was
Speaker 1: a nineteen fifty six Volkswagen Bug. M all right, So
Speaker 1: then your password. You take the first letter off of
Speaker 1: each of those words and the number and you put
Speaker 1: them together and that becomes your password. So the first
Speaker 1: letter would be upper case D for Dad's then first car,
Speaker 1: so it's upper case D, lower case F, lower case C,
Speaker 1: lower case W, lower case A. Then you have the
Speaker 1: one X and then percase v U percase B for
Speaker 1: Volkswagen Bug. That could be your master password. And when
Speaker 1: you look at it as just a string of letters
Speaker 1: and numbers, it looks meaningless. You know, there's no there's
Speaker 1: no phrase that's evident right there immediately unless you happen
Speaker 1: to have already known it. So don't tell people you're oh,
Speaker 1: I gotta change my password. Yeah, but no, don't tell
Speaker 1: people what your phrases, but make it a phrase that
Speaker 1: is easy to remember. And uh and that could be
Speaker 1: your master password, and don't use it again. Just use
Speaker 1: it for your master password and then use the password
Speaker 1: generator or a password generator if you don't want to
Speaker 1: trust one thing with it. But it's it's easier to
Speaker 1: use a password managers on board password generator because it
Speaker 1: can save it directly to your account. Otherwise you're gonna
Speaker 1: have to transfer that that password to whatever your manager
Speaker 1: is UM and then that way you've got a vault
Speaker 1: of passwords that are encrypted that are ten characters, hopefully
Speaker 1: at least ten characters nine or ten characters at the
Speaker 1: very least, and are strong. It's funny. It's it's rather
Speaker 1: than coming up with a mnemonic device to remember your password,
Speaker 1: you start with them mnemonic device and from it from it. Yeah,
Speaker 1: I think that that's way easier because that is I've
Speaker 1: used a password generator before that creates a random string
Speaker 1: of characters and then tells you it's easy to remember this.
Speaker 1: Just remember echo bravos seven delta delta bro. You know,
Speaker 1: I'm like, this is that where are you from where
Speaker 1: that is easy? How is how is remembering a random
Speaker 1: selection of echoes and Bravos and etcetera and numbers easier
Speaker 1: than say, just remembering e e blah blah. You know,
Speaker 1: like that's not easier to me. But this other method
Speaker 1: where you create a pmneumonic device first and then convert
Speaker 1: that into a strong password makes way more sense to me.
Speaker 1: And uh again because you know the output of it
Speaker 1: is a seemingly random string of letters and numbers. Uh,
Speaker 1: it's not something that's easy for a computer to guess. Hi, guys,
Speaker 1: it's Jeamvan twenty nineteen. Chris called me up and he
Speaker 1: yelled at me. So I've updated the password. And while
Speaker 1: I'm doing that, we're just, uh, we're gonna take another
Speaker 1: quick break. Well, um, I use one password by agile
Speaker 1: bits um, which is a you can get as a
Speaker 1: desktop application for Windows or Mac. UM also works on
Speaker 1: iOS and Android. UM and uh, you know it has
Speaker 1: a browser plug in too on the desktop, so that
Speaker 1: you uh, say, you visit a site where you have
Speaker 1: a um an account, maybe a shopping site, maybe a
Speaker 1: banking site or something like that for example, so you
Speaker 1: have your log in and password, you have to log
Speaker 1: in and has a little button and you press the
Speaker 1: button in it, you know, says what is your overall passwords?
Speaker 1: He is your master password in there, and then as
Speaker 1: soon as you uh log in, you'll be given an
Speaker 1: opportunity to log into the site and it submits the
Speaker 1: information for you. Yeah, this is important if you're using
Speaker 1: a someone else's computer and you are using a browser
Speaker 1: to navigate to something. And you know, again, if you've
Speaker 1: created these these strong passwords, remembering each one is going
Speaker 1: to be really hard. And if you and it's not
Speaker 1: like you're going to go and install your you know,
Speaker 1: you don't want to install the desktop program on someone
Speaker 1: else's computer. I mean, that's not your job, it's their computer.
Speaker 1: Especially like let's say that you're at a library or
Speaker 1: something and you want to log in and check email,
Speaker 1: but you've used one of these strong password vaults using
Speaker 1: something that has a web browser interface in it, so
Speaker 1: that you can log into the service and access those
Speaker 1: passwords and then log out and those passwords are no
Speaker 1: longer there. That's important. Yeah, yeah, and uh, it does
Speaker 1: give you a one password. Also gives you the opportunity
Speaker 1: to when you're creating a password, UM, to make it
Speaker 1: as longer as short as you need to really so,
Speaker 1: or include symbols, or not to include symbols. So one
Speaker 1: of the important tips that this article that that Jonathan
Speaker 1: and I read points out is that eight digit or
Speaker 1: eight character uh passwords are easier to crack than longer ones.
Speaker 1: So if you're you're presented with a a website, you're
Speaker 1: you're filling out the information for the account, it says, oh, well,
Speaker 1: your password needs to be six characters are longer. Don't
Speaker 1: pick a six character password? Is the is the simple
Speaker 1: thing for that, whether it's your own or one that uh,
Speaker 1: one of many, many very capable password generators. Um, yeah,
Speaker 1: it was. As Jonathan said, these are the two that
Speaker 1: we picked, but there are lots of them out that
Speaker 1: they're great. There are a lot of them and they
Speaker 1: all like you can read reviews of them and uh,
Speaker 1: and you know, these are companies that their reputation is
Speaker 1: completely built upon how reliable they are and that and
Speaker 1: how upfront and transparent they are in the sense of
Speaker 1: they're not using data themselves to get access to stuff.
Speaker 1: In fact, most of these companies have the information encrypted
Speaker 1: so that they don't have any idea what passwords you
Speaker 1: are using. Because it's just like we were talking about
Speaker 1: with the the password databases, where all they are encrypted passwords,
Speaker 1: same sort of thing. They have no way of knowing
Speaker 1: what you chose as your various passwords. They just provide
Speaker 1: the hard the world the software that that lets you
Speaker 1: do it. So yeah, if you can, if you can
Speaker 1: choose a password manager that allow you to create longer
Speaker 1: passwords and to save them automatically in the in your database,
Speaker 1: that's a good thing, especially if your database is encrypted
Speaker 1: wherever it is, whether it's on the cloud or on
Speaker 1: your your hard drive or your phone. UM, you know
Speaker 1: those that's important to know. UM. Also one of the
Speaker 1: interesting things, and this is one of those things that
Speaker 1: companies do that make your security less uh more open.
Speaker 1: Let's say to to being cracked is people who for
Speaker 1: their accounts have their email address UM as their user name.
Speaker 1: Because these are this is sort of the equivalent of
Speaker 1: of linking accounts. So you know, anybody, Let's say somebody
Speaker 1: hacks into UM an account like they did with that
Speaker 1: large shopping provider, the one that had all the uh
Speaker 1: loyalty programs or cards. Uh. If they if they say, well,
Speaker 1: all they got was people's email addresses. Well, that's an
Speaker 1: important part of the equation. So maybe they'll start using
Speaker 1: that email address that they got from those loyalty cards
Speaker 1: in accounts with Amazon and Facebook, Google and all these
Speaker 1: other places. They may start figuring out where your accounts are.
Speaker 1: If they can figure out, you know, using that user
Speaker 1: name and they identify one of the passwords, then the
Speaker 1: dominoes start to fall. So uh, using multiple user names
Speaker 1: and especially not your email address, you can arrange that.
Speaker 1: That's very helpful as well. Um, you wouldn't necessarily think
Speaker 1: it right off the shelf, but when you think that
Speaker 1: these these people are putting together databases of this information,
Speaker 1: it makes it clear that varying as much information as
Speaker 1: possible is a good idea. Also, changing your passwords regularly.
Speaker 1: Let's say you do have a banking site. Um, you
Speaker 1: have a fifteen character password. It's got four different symbols
Speaker 1: in a upper and lower case letters and numbers. That's
Speaker 1: pretty secure. You should probably change it every few months,
Speaker 1: just to be on the safe side. This is your
Speaker 1: financial information we're talking about. It's a good idea to
Speaker 1: swap it out, and you know, another night sings. A
Speaker 1: lot of those password managers will even have a you know,
Speaker 1: you can set a reminder on many of them that
Speaker 1: you know they'll they'll keep a track of when you
Speaker 1: established a particular password and let you know when it's
Speaker 1: time you should change it up. And again, if you're
Speaker 1: using one of these that has a password generator is
Speaker 1: part of it, then all it takes is logging in
Speaker 1: and uh often it'll go ahead and fill out the
Speaker 1: forms that you need already and then you just press
Speaker 1: a little button to generate a new password. It will
Speaker 1: save the new password to your account. So I mean
Speaker 1: it's something that takes five seconds once you've set up
Speaker 1: the first time. And uh, you know, five seconds of
Speaker 1: effort to keep crackers at bay is not a bad idea. Uh.
Speaker 1: And keep in mind also that as GPUs become more sophisticated,
Speaker 1: um as software gets more sophisticated, as as these algorithms
Speaker 1: get more sophisticated, it's gonna get harder and harder to
Speaker 1: protect the password. You know, you can play the game
Speaker 1: of adding more care actors, which does uh increase the
Speaker 1: difficulties significantly to get the positive hit. So uh, you know,
Speaker 1: we we can stay ahead just by adding longer and
Speaker 1: longer passwords as we go along. But you know, that's
Speaker 1: a game that ultimately we're gonna have to sit there
Speaker 1: and say we need to find a new way to
Speaker 1: protect stuff, because that's the problem is that you know, you're, you're,
Speaker 1: you're just playing a game of cat and mouse at
Speaker 1: that point. And you know, we talked about quantum computers
Speaker 1: a few times. One of the potential things the quantum
Speaker 1: computer could be very good at is cracking codes. Because
Speaker 1: a quantum computer is is also really well equipped for
Speaker 1: parallel processing. Um. So that's something else to think about.
Speaker 1: Is that now? Granted, right now, quantum computers are still
Speaker 1: largely theoretical. There are a few working examples, but they're
Speaker 1: horriously difficult to design and even more difficult to maintain
Speaker 1: because you know, the slightest alteration and they there the
Speaker 1: whole coherence problem becomes apparent. Yeah, either it is or
Speaker 1: it isn't torn maybe somewhere in between. Um. Yeah, and uh.
Speaker 1: I also read another article on on Ours Technica by
Speaker 1: the same author actually, where they had discovered that in
Speaker 1: versions of Windows seven and eight, um, it's possible to
Speaker 1: get hold of people's security questions. Uh. Now, uh, that
Speaker 1: sounds I think it's easy to come off with a
Speaker 1: negative that seems like it's a negative against Microsoft, and
Speaker 1: I guess in a way it is. But it assumes
Speaker 1: first that the person has the person's computer. You would
Speaker 1: actually have to have their computer to get it, and
Speaker 1: you'd also have to know how to retrieve that information.
Speaker 1: But that goes back to our discussion of Matt Honan too,
Speaker 1: because if you know a lot of these security words
Speaker 1: that you set up to talk to people on the
Speaker 1: phone about your accounts or you set them up online.
Speaker 1: You know, what's the name of your first pet? You know,
Speaker 1: and you put in your first dog's name, and then
Speaker 1: you use that in multiple places. Then want that was
Speaker 1: what enabled them to get hold of that information. If
Speaker 1: this person got hold of your computer was able to
Speaker 1: pull that out from the log in help, they could
Speaker 1: use that on your accounts too. So it might be
Speaker 1: a little good to use some reverse social engineering. And
Speaker 1: when someone asks you what who what you're uh the
Speaker 1: name of your first dog was or first pet was,
Speaker 1: you put your favorite UH form of salad dressing in
Speaker 1: there instead something something unusual that they wouldn't be able
Speaker 1: to pick. So that which by the way obvious, is
Speaker 1: a blast when you have to call as you've forgotten
Speaker 1: your passwords stuff, and you call in and then they're like, so,
Speaker 1: what's your favorite pets name? Paul Newman's Thousand Island dressing. Yeah,
Speaker 1: that's right. Well I'll tell you that this is and
Speaker 1: anybody who's frustrated by this conversation and will tell you
Speaker 1: that using these super secure passwords and obviously a fustutory
Speaker 1: material here is a pain in the neck because you know,
Speaker 1: if you don't have to have your password manager with
Speaker 1: you when you're on a friends computer logging in to
Speaker 1: check your mail and it's got some kind of thirty
Speaker 1: two character weird password and you don't remember it, and
Speaker 1: you're going, man, I know no one's ever going to
Speaker 1: crack into this computer. It's a friends computer. I'm fairly saying, well, yeah,
Speaker 1: you probably are fairly safe. But it's probably worth a
Speaker 1: frustration then, more so than it will be having to
Speaker 1: put out all the fires of all the account information
Speaker 1: that you could be giving up otherwise. And it's not
Speaker 1: so much worrying about your friends computer as it is
Speaker 1: worrying about that database that's on the other end of
Speaker 1: this password system, because uh, the more passwords a company
Speaker 1: accumulates as more and more people use its service, the
Speaker 1: more attractive it is as a target to crackers. And
Speaker 1: they're doing you know, that's that's what they do. They
Speaker 1: look at systems and try and find ways of penetrating it.
Speaker 1: So it's you know, they're not they're not worried about
Speaker 1: getting your your buddy bills computer. They're looking at you know,
Speaker 1: like Mega core that has all those passwords in it.
Speaker 1: That's what they want. So you know, using that easy password,
Speaker 1: while it's convenient, is also ultimately a dangerous thing. And
Speaker 1: you know, I gotta I gotta admit, like, for the
Speaker 1: very long time, I had pretty poor password protection. I
Speaker 1: mean I just I was just I did not. I
Speaker 1: was not very good about it at all. Even as
Speaker 1: we were telling people change your passwords. Still wasn't doing
Speaker 1: as as good a job as I should have. Don't
Speaker 1: back up your hard drive regularly? Oh yes, I do,
Speaker 1: I do good. I got well the Mac hard drive,
Speaker 1: my my PC hard drive. I do not back up
Speaker 1: as regularly as I should, which really I need to
Speaker 1: start doing that. But the thing in the neck. But
Speaker 1: but cloud services have made that really a lot better too, now,
Speaker 1: you know cloud hell of course, has its own set
Speaker 1: of problems, which we've talked about in previous podcasts. But
Speaker 1: everything technological has its own set of problems. You just
Speaker 1: have to decide which ones are the most acceptable setup
Speaker 1: problems for you. So, but I have I have switched.
Speaker 1: I mean, I am now, I am wholeheartedly in this.
Speaker 1: Let's protect our passwords, especially after seeing what happened to Honan.
Speaker 1: I mean, you and I are in the public eye.
Speaker 1: We're not celebrities by any stretch of the imagination. But
Speaker 1: it's not that far um, it's not it's not all
Speaker 1: the realm of possibility that someone at some point could say,
Speaker 1: you know what would be funny? Well, and and it
Speaker 1: just really takes somebody getting a hold of your name.
Speaker 1: That's why they tell people to shred when you have
Speaker 1: a junk mail or something with your name on it,
Speaker 1: to shred that information. Because I've got one of those two.
Speaker 1: You never know when somebody's gonna go and you know,
Speaker 1: say Jonathan Strickline. I think there's a bunch of people
Speaker 1: named that, actually there are so one of them got
Speaker 1: booked in North Atlanta for something a couple of weeks ago,
Speaker 1: but wasn't me. I want to ask how you know
Speaker 1: that I'm on the lamb because I've got a Google
Speaker 1: alert said to my name. All right, that wraps up
Speaker 1: another classic episode. I think we've all learned a valuable lesson.
Speaker 1: I know I have. I know I learned that Chris
Speaker 1: remembers my phone number for example. Well, I hope you
Speaker 1: guys enjoyed it. If you have any suggestions for future
Speaker 1: episodes of tech Stuff, reach out to me. The address
Speaker 1: is tech stuff at how stuff works dot com, or
Speaker 1: pop on over to our website that's tech stuff podcast
Speaker 1: dot com. You'll find links to our presence on social media.
Speaker 1: You'll find an archive of all of our past episodes.
Speaker 1: You'll find a link to our online store where you
Speaker 1: can buy tech Stuff merch. Get some tech stuff swag
Speaker 1: handed out like it's Christmas. Please, because every purchase you
Speaker 1: make goes to help the show. We greatly appreciate it,
Speaker 1: and I will talk to you again really soon. YEA
Speaker 1: text Stuff is a production of I Heart Radio's How
Speaker 1: Stuff Works. For more podcasts from my heart Radio, visit
Speaker 1: the i heart Radio app, Apple Podcasts, or wherever you
Speaker 1: listen to your favorite shows.