Speaker 1: Brought to you by the reinvented two thousand twelve Camray.
Speaker 1: It's ready. Are you get in touch with technology? With
Speaker 1: tech Stuff from how stuff works dot com. Hello again, everyone,
Speaker 1: Welcome to tech stuff. My name is Chris Poulett, and
Speaker 1: I'm an editor at house stuff works dot com. Sitting
Speaker 1: across to me, as is a typically the case, senior
Speaker 1: writer Jonathan Strickland. Hey there, you know, so I was
Speaker 1: thinking maybe after this we could I don't know, play
Speaker 1: game risk. What do you think I think we already are?
Speaker 1: That's funny. Uh. Yeah. Security has been in the news
Speaker 1: a lot lately as of the time we're recording this
Speaker 1: in late August two thousand and twelve, UM. And part
Speaker 1: of that is because, as we have touched on in
Speaker 1: a handful of times since, some of the big, more
Speaker 1: widely publicized cases have been making the news. That you know,
Speaker 1: hackers have been breaking into different accounts at major corporate
Speaker 1: rations online, stealing people's information. It's unclear whether people's credit
Speaker 1: card numbers were stolen, or if we have your home
Speaker 1: address or we know the name of your dog. There
Speaker 1: was the whole story of Matt Honan getting his entire
Speaker 1: digital life hacked because of a vulnerability between the systems
Speaker 1: of Amazon and Apple YEP, which clearly taken a loan,
Speaker 1: clearly were not obvious as problems, but when put together,
Speaker 1: post problems because they were the people who were doing
Speaker 1: the hacking game to the system and put them against
Speaker 1: one another to create a bigger picture that allowed them
Speaker 1: to get the information. Well, uh, you know, people have
Speaker 1: been saying that you need secure password please, and there
Speaker 1: are news reports about this too. People are still using
Speaker 1: password as their password or obvious terms one, two, three, four.
Speaker 1: That's the kind of thing an idiot puts on his luggage. Hey, so,
Speaker 1: uh yeah, I mean those kinds of things are still
Speaker 1: in practice, and of course you need to use more
Speaker 1: secure passwords, but it's it's it goes deeper than that.
Speaker 1: There's more information out there now about how even using
Speaker 1: stronger passwords alone isn't necessarily going to keep hackers from
Speaker 1: being able to get into your account. You know, think
Speaker 1: about what you're doing. There's there's several several things that
Speaker 1: you have to consider. One of those is the idea
Speaker 1: of linking accounts together, because that means that should one
Speaker 1: account become vulnerable, then those other linked accounts could also
Speaker 1: be vulnerable. That was the case with Matt Honan, right.
Speaker 1: So one of the many problems of his yes UM
Speaker 1: because more identifiable problems because once they got access to
Speaker 1: his Google account, then they were able to reset stuff
Speaker 1: all over the place, and then it turned out that
Speaker 1: all they really wanted was to access his Twitter account,
Speaker 1: which is I guess in a way he's fortunate, but
Speaker 1: it's still pretty crazy every that they managed to do
Speaker 1: in order to do that, and they caused quite a
Speaker 1: bit of damage along the way to matahone in anyway,
Speaker 1: not to mention to the the the public perception of
Speaker 1: security UM on the back end. So that's one thing
Speaker 1: is linking lots of accounts together holds a very specific danger.
Speaker 1: I mean, for one, thing like Facebook Connect or really
Speaker 1: any open i D approach, right, if that system is
Speaker 1: not secure, you have a single point that you can
Speaker 1: target that will give you access to lots of stuff.
Speaker 1: Now that's so sad because for us the consumer, that's
Speaker 1: so helpful having one account that you can log into
Speaker 1: and from there you can authenticate with multiple other services.
Speaker 1: You don't have to build out form after form after form. Uh,
Speaker 1: you know, it's nice. It is a very valu service now.
Speaker 1: And I'm not saying that that Facebook Connect or Open
Speaker 1: Idea or any of that is that they are not secure.
Speaker 1: They're putting they're putting lots of protections in place to
Speaker 1: try and keep user information as safe as possible. It's
Speaker 1: not it's not so much that it's inherently wrongs that
Speaker 1: if something does happen, it can cause serious problem. Right.
Speaker 1: So that's one issue. Another issue is the way that
Speaker 1: we create passwords as users. For those of us who
Speaker 1: are using either very common words or even names. Um,
Speaker 1: even if we think we're being clever by adding a
Speaker 1: few numbers to it, that's not really that secure. And
Speaker 1: if it becomes even more insecure if we're using those
Speaker 1: passwords at multiple accounts. So I think, uh, we we were.
Speaker 1: We both read an article from Ours Technica by Dan
Speaker 1: Gooden called why passwords have never been weaker and crackers
Speaker 1: have never been stronger. It's actually it's a fascinating read,
Speaker 1: and I do recommend you check it out if you
Speaker 1: find this episode interesting, or even if you don't, it's
Speaker 1: a good thing to know. And uh, it's it's typically
Speaker 1: our technically typically get into a more technical detail than
Speaker 1: than articles on how stuff works dot com. But if
Speaker 1: you're if you're really serious about it, there there's a
Speaker 1: lot of important information in there, and we can give
Speaker 1: you kind of the the layman approach to what is
Speaker 1: going on here. But part of that is that I
Speaker 1: remember reading, and it may not have been in this article,
Speaker 1: I do remember reading a statistic that the average user
Speaker 1: has something like six and a half passwords in the Okay,
Speaker 1: so they used six and a half pass And you know,
Speaker 1: of course this is an average. We're not saying someone
Speaker 1: out there's just putting, oh, you know what, I was
Speaker 1: gonna type in my whole password, which is typically password,
Speaker 1: and I'm just gonna type in pass for this one. No,
Speaker 1: that's not what it means sword, it's the average. So
Speaker 1: but that means that, you know, you think the average
Speaker 1: person has around twenty five accounts across the web, but
Speaker 1: they're using on average, six and a half passwords, So
Speaker 1: each password is being used around three times on average.
Speaker 1: I mean, that's again an average. You might have just
Speaker 1: one password that used twenty times and the other three
Speaker 1: used the other five. But I don't to use the
Speaker 1: same password on Google and yeah, who's so I'll use
Speaker 1: one for one and the other one for the other,
Speaker 1: and then I'll use the Google one again for interest, yeah, whatever,
Speaker 1: for Facebook, because they are those are disconnected enough where
Speaker 1: it's not gonna know. That's still a problem unless you
Speaker 1: think that I am a super genius, because I can
Speaker 1: say this, No, I I reused passwords from time to
Speaker 1: time too. I'm guilty of it, just as much as
Speaker 1: the planet. I was awful for a long time. Passwords
Speaker 1: among that that was pretty much mine too. I had
Speaker 1: about three passwords that I used for almost everything. That
Speaker 1: is no longer the case. People, I don't do that anymore. Well,
Speaker 1: I told you I didn't mean you erase all those
Speaker 1: accounts anyway. So that's that's another user behavior, and we'll
Speaker 1: get more into that in a minute. But then the
Speaker 1: third piece is how safe are those passwords within the
Speaker 1: databases of the companies that hold those passwords. So if
Speaker 1: you are a cracker, you know a hacker who is
Speaker 1: specifically trying to crack into security systems, and you have
Speaker 1: identified a potential target to try and get at their
Speaker 1: password database, then uh, if it's if it's one where
Speaker 1: the user base of that service or company also typically
Speaker 1: has accounts at other places you've managed to not just
Speaker 1: get the passwords for that one account, but knowing that
Speaker 1: people tend to reuse their passwords, you might actually have
Speaker 1: access to multiple services. Now, there are ways that companies
Speaker 1: can protect against this, not just by building a good
Speaker 1: security system that's hard to crack, but also by uh
Speaker 1: encrypting those passwords in the database, so that if you
Speaker 1: get that database, yes you've got a whole bunch of data,
Speaker 1: but it does not translate directly to the passwords because
Speaker 1: it's been put through a hashing algorithm. Yeah, and there's
Speaker 1: there are several sort of standard hashing algorithms, so basically
Speaker 1: it's a it's a little like uh email encryption too.
Speaker 1: So you have, let's just pick pass the four letter
Speaker 1: word pass um, you put it through the hashing algorithm,
Speaker 1: and on the other side of it, the letters and
Speaker 1: numbers that make up the encrypted information look nothing like that.
Speaker 1: And it might be that your four letter password has
Speaker 1: just become a thirty two letter encrypted string of characters. Yeah.
Speaker 1: So somebody seeing that written down, say on a piece
Speaker 1: of paper, is not going to have any idea what
Speaker 1: that is, and they're not really going to have any
Speaker 1: way to decipher it. And theoretically it's pretty well, uh,
Speaker 1: pretty well protected right theoretically. But here's the problem is
Speaker 1: that not first of all, not every company has historically
Speaker 1: encrypted all those passwords. And there have been cases where
Speaker 1: crackers have gotten access to a password database that was
Speaker 1: stored in plain text. That means that the password that
Speaker 1: you type in appears in that database as you typed it,
Speaker 1: so there's no hidden you know, code or anything. You've
Speaker 1: got those passwords, Well, that's very valuable to a cracker
Speaker 1: for more than just the fact that they now have
Speaker 1: access to your account. What's also valuable is that they
Speaker 1: now have a list of words that people use as passwords. So, uh,
Speaker 1: there's a there's a type of attack we should talk about,
Speaker 1: the brute force attack. A brute force attack is when
Speaker 1: a cracker tries to get access to a system by
Speaker 1: filling out the essentially filling out the password field multiple
Speaker 1: times until they get a positive result. And um, one
Speaker 1: way of doing a brute force attack, A very common
Speaker 1: way is to do what's called a dictionary attack, where
Speaker 1: you take you create a virtual dictionary of words that
Speaker 1: you use as the basis for passwords, knowing that a
Speaker 1: lot of people will pick a common dictionary word as
Speaker 1: the basis of their password hard wark antelope ant eater.
Speaker 1: You know, it just goes all the way through animals
Speaker 1: for some reason. But something else that they'll do as
Speaker 1: part of this dictionary attack what they'll start adding changing symbols.
Speaker 1: So let's say your your password is ard vark, but
Speaker 1: you're being clever and changing the a's symbols to add symbols.
Speaker 1: And uh, you know, let's say you pick a word
Speaker 1: with with ease in it and you change them to threes.
Speaker 1: They try those two, yeah, because those are very common approaches.
Speaker 1: And yes, you know, keeping in mind that most of
Speaker 1: us are using passwords that are easy for us to remember,
Speaker 1: and the more random ish or seemingly random these passwords get,
Speaker 1: the harder it is for us to recall them. So,
Speaker 1: knowing that's a weakness, the cracker can say, all right, well,
Speaker 1: let's go with all these words, and let's go with
Speaker 1: the various variations we would expect people to use with
Speaker 1: these words. And even if you've done stuff like just
Speaker 1: added a couple of numbers at the end, that's not
Speaker 1: always a tough thing either. They can start going through
Speaker 1: all of these different variations, adding various numbers at the end,
Speaker 1: if they know how many characters your password is, that
Speaker 1: already has given them a huge advantage. And the reason
Speaker 1: why this is possible is because we've got processors out
Speaker 1: there that can do these these calculations in parallel. You know,
Speaker 1: if you were to do them all one after the other,
Speaker 1: it may take you centuries to get through all the
Speaker 1: possibilities of a particular password, depending on how many characters
Speaker 1: there are within that password. In Hollywood, Hollywood computers can
Speaker 1: do a executive brute force attacking about twelve seconds. Yeah,
Speaker 1: well sometimes that can happen here too, but that's generally
Speaker 1: not the way it works. Well, that's that's one of
Speaker 1: the interesting things about this article is you learn from
Speaker 1: reading that UH an attack like this doesn't take very
Speaker 1: long at all at most, assuming that you're not following
Speaker 1: really really strong password particles. Um. Yeah, it turns out
Speaker 1: that it's like, because of this parallel processing, you've got
Speaker 1: a processor that's working on multiple UH approaches to this
Speaker 1: logan attempt. So we can go through all these different variations.
Speaker 1: Even when there are billions and billions, as Karl Sagan
Speaker 1: would say, of variations of passwords, the processor can go
Speaker 1: through so many so quickly. You know, each each thread
Speaker 1: in that parallel processing is moving at an incredible rate,
Speaker 1: and you've got multiple threads all going Uh. There are
Speaker 1: crackers who use graphics processing units g p used to
Speaker 1: do this. They because they GPUs are designed to be
Speaker 1: parallel processors. Yeah. Even even though they're designed primarily to
Speaker 1: handle graphics instructions and display them on your your monitor,
Speaker 1: GPUs can be uh pressed into service, let's say, by
Speaker 1: a program by a software that that can specifically UM
Speaker 1: send instructions to it. So what people do, UM, there
Speaker 1: are open source program ms that you can use to
Speaker 1: uh assign password cracking to your GPU. UM sad to say,
Speaker 1: and and one of the uh the interesting stories that
Speaker 1: are one of the the interesting bits that I read from
Speaker 1: this article too was UH that people have grown increasingly
Speaker 1: intelligent about the way they save cracked passwords. So they're
Speaker 1: saving up dictionary attack type information. And so if you
Speaker 1: use you know, password one is your password on one site, UM,
Speaker 1: and they want to hack in to your account at
Speaker 1: the House of Online Grapefruit, they might try they and
Speaker 1: they've got your information. They could try it there too,
Speaker 1: to see if you've used your password on more than
Speaker 1: one site. So that makes it increasingly dangerous for you
Speaker 1: to use the same password in multiple locations because there
Speaker 1: is a growing database of password information that that people
Speaker 1: are saving, not just throwing away once an attack is
Speaker 1: completely That database also means that they can look at
Speaker 1: things like frequencies, like how frequently are people using this
Speaker 1: specific word or variations of this word as a password.
Speaker 1: And the more people who use it, the more you're like,
Speaker 1: all right, well let's bump this up the list. It's
Speaker 1: more of a likely candidate for a password. So, you know,
Speaker 1: we like to think that the passwords we choose are unique,
Speaker 1: but that's if we're basing it off a name or
Speaker 1: a word. That's not the case. There are lots of
Speaker 1: people out there using lots of passwords, and there's a
Speaker 1: good chance that someone out there is using the same
Speaker 1: quote unquote unique password. You are. Just remember your unique
Speaker 1: just like everybody else. You know, when everybody is special,
Speaker 1: no one is. It's incredible. Um. The so yeah, the
Speaker 1: the the database can tell the cracker all right, Well,
Speaker 1: not only am I using a dictionary attack, but I'm
Speaker 1: using a curated dictionary attack in a way, because these
Speaker 1: are the known passwords that are floating out there and
Speaker 1: the world, and these are the ones that are really
Speaker 1: popular that lots of people use. So we'll go through
Speaker 1: all the variations of these first, and you just you
Speaker 1: tweak your cracking program to do that so that you
Speaker 1: can get the the largest number of results in the
Speaker 1: least amount of time. And another thing you can do
Speaker 1: is once you've figured out these passwords that are very popular,
Speaker 1: that helps you determine other things, Like there are only
Speaker 1: so many hashing algorithms that are really popular out there
Speaker 1: in the world of computer security, right, so if you
Speaker 1: know which hashing algorithm there the particular company is using,
Speaker 1: and you are able to get let's say you get
Speaker 1: access to their encrypted password database. So now you've got
Speaker 1: a list of passwords that are encrypted, so you cannot
Speaker 1: just look at them and know what the passwords are.
Speaker 1: If you are able to determine which security protocol they're
Speaker 1: using and you have this massive database of um of
Speaker 1: of of passwords that are really popular, you can run
Speaker 1: those passwords through the same encryption algorithm to look at
Speaker 1: the hashes that come out and then start matching them
Speaker 1: up with the stuff that was in the database. So
Speaker 1: you're still cracking the passwords. You're just going about in
Speaker 1: a different way as far as this brute force attack
Speaker 1: is concerned. It's still a brute force attack. It's just
Speaker 1: doing it in a kind of an odd roundabout way.
Speaker 1: Because you've got the you've got the hash of the password,
Speaker 1: you've got the security protocol that's being used. Now you're
Speaker 1: trying to guess the original word that created that hashed password.
Speaker 1: Once you're able to do that, that account is no
Speaker 1: longer secure. And if that again, if you're using that
Speaker 1: same password elsewhere, those accounts aren't secure. UM. So you
Speaker 1: might be asking yourself, hey, if there are crackers out
Speaker 1: there who have these really advanced tools that can either
Speaker 1: figure out a password or uh, you know, kind of
Speaker 1: work down a list so that the the passwords I
Speaker 1: use are vulnerable, how do I how do I protect myself?
Speaker 1: And there are a few things you can do. One
Speaker 1: is use a unique password for every service that you
Speaker 1: log into, which is incredibly difficult if you're doing it
Speaker 1: on your own, which is why I would suggest getting
Speaker 1: a password manager program. And there are a lot of
Speaker 1: them out there. There are some that are free, there's
Speaker 1: some that you pay for. Um, there's some that are
Speaker 1: in the cloud. There are some that are based on
Speaker 1: your system. Yeah. Uh, you use a password manager, right,
Speaker 1: I do as well, um, and I'll go ahead and
Speaker 1: say which one I use. I use dash Lane, which
Speaker 1: uh I tried out for the first time this year
Speaker 1: and I like it well enough. Um. It saves passwords
Speaker 1: and if you want, it will generate a password for you,
Speaker 1: so you don't have to just come up with a
Speaker 1: string of things. It'll it'll do it for you and
Speaker 1: save it to your account. You create a master password
Speaker 1: that is a strong password, meaning that there are upper
Speaker 1: and lower case letters. There's a numbers in there. Uh,
Speaker 1: and all you have to do is remember that one.
Speaker 1: Which that sounds tricky, but I'll give you a hint
Speaker 1: on how to do something like that if you want
Speaker 1: to try it yourself. You create a master password. Uh.
Speaker 1: Then when you log into your dash ling account in
Speaker 1: my case, you then have access to all the other
Speaker 1: passwords that are that that dash Lane generates. So I
Speaker 1: actually went in to all my accounts and used the
Speaker 1: dash Lane password generator program and it creates a ten
Speaker 1: character long strong password that's unique. So none of my
Speaker 1: accounts used the same ones anymore. They're all ten characters long,
Speaker 1: they are a mix of various characters and uh. When
Speaker 1: you get to about nine characters, and if it's a
Speaker 1: truly you know, or at least a seemingly random series
Speaker 1: of characters and numbers, uh, the difficulty of cracking that
Speaker 1: password escalates dramatically. So it might go from a matter
Speaker 1: of days, two weeks or months. And the harder you
Speaker 1: make it to crack, the more likely your information will
Speaker 1: be safe so or that it will just be difficult
Speaker 1: for anyone to guess. Um. So that's the purpose of
Speaker 1: creating these strong passwords and the purpose for the password managers,
Speaker 1: because strong passwords are hard to remember. Um, so all
Speaker 1: I have to do is remember my one master password.
Speaker 1: Here's the hint I was gonna make. So if you
Speaker 1: want to make a strong password, like a master strong password, uh,
Speaker 1: it's best that you come up with a phrase that
Speaker 1: you will not forget and it it's great if the
Speaker 1: phrase also has a proper noun somewhere after the first word,
Speaker 1: so that you have some capitals in there as well.
Speaker 1: And you need a number, like a four digit number
Speaker 1: is best. So for example, you might say Dad's first
Speaker 1: car was a eighteen fifty six Volkswagen bug. M all right,
Speaker 1: So then your password. You take the first letter off
Speaker 1: of each of those words and the number and you
Speaker 1: put them together and that becomes your password. So the
Speaker 1: first letter would be upper case D for Dad's and
Speaker 1: then first car, so it's upper case D, lower case F,
Speaker 1: lower case C, lower case W, lower case A. Then
Speaker 1: you have the one and then uppercase V upper case
Speaker 1: B for Volkswagen bug. That could be your master password.
Speaker 1: And when you look at it as just a string
Speaker 1: of letters and numbers, it looks meaningless. You know, there's
Speaker 1: no there's no phrase that's evident right there immediately unless
Speaker 1: you happen to have already known it. So don't tell
Speaker 1: people you're, oh, I gotta change my password. Yeah, but no,
Speaker 1: don't tell people what your phrases. But make it a
Speaker 1: phrase that is easy to remember and uh, and that
Speaker 1: could your master password, and don't use it again. Just
Speaker 1: use it for your master password, and then use the
Speaker 1: password generator or a password generator if you don't want
Speaker 1: to trust one thing with it. But it's it's easier
Speaker 1: to use a password managers onboard password generator because they
Speaker 1: can save it directly to your account. Otherwise you're gonna
Speaker 1: have to transfer that that password to whatever your manager
Speaker 1: is UM and then that way you've got a vault
Speaker 1: of passwords that are encrypted, that are ten characters, hopefully
Speaker 1: at least ten characters nine or ten characters at the
Speaker 1: very least, and are strong. It's funny. It's it's rather
Speaker 1: than coming up with a mnemonic device to remember your password,
Speaker 1: you start with them mnemonic device and from it from it. Yeah,
Speaker 1: I think that that's way easier, because that is I've
Speaker 1: used a password generator before that creates a random string
Speaker 1: of characters and then tells you it's easy to remember this.
Speaker 1: Just remember echo Bravos seven Delta delta bro. You know,
Speaker 1: I'm like, this is that? Where are you from? Where
Speaker 1: that is easy? How is how is remembering a random
Speaker 1: selection of echoes and Bravos and et cetera numbers easier
Speaker 1: than say, just remembering e e blah blah. You know, like,
Speaker 1: that's not easier to me. But this other method where
Speaker 1: you create a mnemonic device first and then convert that
Speaker 1: into a strong password, makes way more sense to me.
Speaker 1: And uh again, because you know, the output of it
Speaker 1: is a seemingly random string of letters and numbers. Uh,
Speaker 1: it's not something that's easy for a computer to guess. Yeah, well, um,
Speaker 1: I use one password by agile bits um, which is
Speaker 1: a you can get as a desktop application for Windows
Speaker 1: or Mac. UM also works on iOS and Android UM
Speaker 1: and uh you know it has a browser plug in
Speaker 1: too on the desktop so that you uh, say, you
Speaker 1: visit a site where you have a um an account,
Speaker 1: maybe a shopping site, maybe a banking site or something
Speaker 1: like that for example, So you have your log in
Speaker 1: and password, you have to log in and has a
Speaker 1: little button and you press the button in it you know,
Speaker 1: says what is your overall passwords? He is your master
Speaker 1: password in there, and then as soon as you uh
Speaker 1: log in, you'll be given an opportunity to log into
Speaker 1: the site and it submits the information for you. Yeah,
Speaker 1: this is important if you're using a someone else's computer
Speaker 1: and you are using a browser to navigate to something.
Speaker 1: And you know, again, if you've created these these strong passwords,
Speaker 1: remembering each one is going to be really hard. And
Speaker 1: if you and it's not like you're gonna go and
Speaker 1: install your you know, you don't want to install the
Speaker 1: desktop program on someone else's computer. I mean, that's not
Speaker 1: your job. It's their computer. Especially like let's say that
Speaker 1: you're at a library or something and you want to
Speaker 1: log in and check l but you've used one of
Speaker 1: these strong password vaults using something that has a web
Speaker 1: browser interface in it, so that you can log into
Speaker 1: the service and access those passwords and then log out
Speaker 1: and those passwords are no longer there. That's important. Yeah, yeah,
Speaker 1: and uh, it does give you a one password. Also
Speaker 1: gives you the opportunity to when you're creating a password, um,
Speaker 1: to make it as longer as short as you need
Speaker 1: to really so, or include symbols, or not to include symbols.
Speaker 1: So one of the important tips that this article that
Speaker 1: that Jonathan and I read points out is that eight
Speaker 1: digit or eight character passwords are easier to crack than
Speaker 1: longer ones. So if you're you're presented with a a website,
Speaker 1: you're you're filling out the information for the account, it says, oh, well,
Speaker 1: your password needs to be six characters are longer. Don't
Speaker 1: pick a six character password? Is the is the simple
Speaker 1: thing for that, whether it's your own or one that
Speaker 1: uh one of many many very capable password generators. Um. Yeah,
Speaker 1: As Jonathan said, these are the two that we picked,
Speaker 1: but there are lots of them out They're great. There
Speaker 1: are a lot of them, and they all like you
Speaker 1: can read reviews of them and uh. And you know,
Speaker 1: these are companies that their reputation is completely built upon
Speaker 1: how reliable they are and that and how upfront and
Speaker 1: transparent they are in the sense of they're not using
Speaker 1: data themselves to get access to stuff. In fact, most
Speaker 1: of these companies have the information encrypted so that they
Speaker 1: don't have any idea what passwords you are using. Because
Speaker 1: it's just like we were talking about with the the
Speaker 1: password databases, where all they are encrypted passwords, same sort
Speaker 1: of thing. They they have no way of knowing what
Speaker 1: you chose as your various passwords. They just provide the
Speaker 1: hard the world the software that that lets you do it.
Speaker 1: So yeah, if you can, if you can choose a
Speaker 1: password manager that allow you to create longer passwords and
Speaker 1: to save them automatically in the in your database, that's
Speaker 1: a good thing, especially if your database is encrypted wherever
Speaker 1: it is, whether it's on the cloud or on your
Speaker 1: your hard drive or your phone. UM. You know those
Speaker 1: that's important to know. UM. Also, one of the interesting things,
Speaker 1: and this is one of those things that companies, do
Speaker 1: that make your security less uh more open. Let's say
Speaker 1: to to being cracked is uh people who for their
Speaker 1: accounts have their email address UM as their user name.
Speaker 1: Because these are this is sort of the equivalent of
Speaker 1: of linking accounts. So you know, anybody, Let's say somebody
Speaker 1: hacks into UM an account like they did with that
Speaker 1: large shopping provider, the one that had all the uh
Speaker 1: loyalty programs or cards. Uh. If they if they say, well,
Speaker 1: all they got was people's email addresses, Well that's an
Speaker 1: important part of the equation. So maybe they'll start using
Speaker 1: that email address that they got from those loyalty cards
Speaker 1: in accounts with Amazon and Facebook and Google and all
Speaker 1: these other places. They may start figuring out where your
Speaker 1: accounts are. If they can figure out, you know, using
Speaker 1: that user name and they identify one of the passwords,
Speaker 1: then the dominoes start to fall. So uh, using multiple
Speaker 1: user names and especially not your email address, you can
Speaker 1: arrange that. That's very helpful as well. UM. You wouldn't
Speaker 1: necessarily think it right off the shelf, but when you
Speaker 1: think that these these people are putting together databases of
Speaker 1: this information, it makes it clear that varying as much
Speaker 1: information as possible is a good idea. Also, changing your
Speaker 1: passwords regularly. Let's say you do have a banking site. Um,
Speaker 1: you have a fifteen character password. It's got four different
Speaker 1: symbols in a upper and lower case letters and numbers.
Speaker 1: That's pretty secure. You should probably change it every few months,
Speaker 1: just to be on the safe side. This is your
Speaker 1: financial information we're talking about. It's a good idea to
Speaker 1: swap it out. And you know, another nice thing is
Speaker 1: a lot of those password managers will even have a
Speaker 1: you know, you can set a reminder on many of
Speaker 1: them that you know they'll they'll keep a track of
Speaker 1: when you established a particular password and let you know
Speaker 1: when it's time you should change it up. And again,
Speaker 1: if you're using one of these that has a password
Speaker 1: generator is part of it, then all it takes is
Speaker 1: logging in and uh often it'll go ahead and fill
Speaker 1: out the forms that you need already and then you
Speaker 1: just press a little button to generate a new password.
Speaker 1: It will save the new password to your account. So
Speaker 1: I mean it's something that takes five seconds once you've
Speaker 1: set up the first time, and uh, you know, five
Speaker 1: seconds of effort to keep crackers at bay is not
Speaker 1: a bad idea. Uh. And keep in mind also that
Speaker 1: as GPUs become more sophisticated, um, as software gets more sophisticated,
Speaker 1: as as these algorithms get more sophisticated, it's gonna get
Speaker 1: harder and harder to protect the password. You know, you
Speaker 1: can play the game of adding more characters, which does
Speaker 1: uh increase the difficulties significantly to get the positive hit.
Speaker 1: So uh, you know, we we can stay ahead just
Speaker 1: by adding longer and longer passwords as we go along.
Speaker 1: But you know that's a game that ultimately we're gonna
Speaker 1: have to sit there and say we need to find
Speaker 1: a new way to protect stuff. Because that's the problem
Speaker 1: is that you know, you're, you're you're just playing a
Speaker 1: game of cat and mouse at that point. And you know,
Speaker 1: we talked about quantum computers a few times. One of
Speaker 1: the potential things a quantum computer could be very good
Speaker 1: at is cracking codes. Because a quantum computer is is
Speaker 1: also really well equipped for parallel processing um. So that's
Speaker 1: something else to think about, is that now. Granted, right now,
Speaker 1: quantum computers are still largely theoretical. There are a few
Speaker 1: working examples, but they're notoriously difficult to design and even
Speaker 1: more difficult to maintain because you know, the slightest alteration
Speaker 1: and they there the whole coherence problem becomes apparent. Yeah,
Speaker 1: either it is or it isn't toward maybe, Um. Yeah,
Speaker 1: and uh I also read another article on on Ours
Speaker 1: Technica by the same author actually, where they had discovered
Speaker 1: that in versions of Windows seven and eight, Um, it's
Speaker 1: possible to get hold of people's security questions. Uh. Now
Speaker 1: that sounds I think it's easy to come off with
Speaker 1: a negative. That seems like it's a negative against Microsoft,
Speaker 1: and I guess in a way it is. But it
Speaker 1: assumes first that the person has the person's computer. You
Speaker 1: would actually have to have their computer to get it,
Speaker 1: and you'd also have and now how to retrieve that information.
Speaker 1: But that goes back to our discussion of Matt Honan too,
Speaker 1: because if uh, you know a lot of these security
Speaker 1: words that you set up to talk to people on
Speaker 1: the phone about your account, or you set them up online.
Speaker 1: You know, what's the name of your first pet, you know,
Speaker 1: and you put in your first dog's name, and then
Speaker 1: you use that in multiple places, then want that was
Speaker 1: what enabled them to get hold of that information? If
Speaker 1: this person got hold of your computer was able to
Speaker 1: pull that out from the log in help. They could
Speaker 1: use that on your accounts too, So it might be
Speaker 1: a little good to use some reverse social engineering. And
Speaker 1: when someone asks you what who what you're uh the
Speaker 1: name of your first dog was or first pet was,
Speaker 1: you put your favorite uh form of salad dressing in
Speaker 1: there instead something something unusual that they wouldn't be able
Speaker 1: to pick. So that, which, by the way, obvious, is
Speaker 1: a blast when you have to call has you've forgotten
Speaker 1: your passwords stuff, and you call in and then they're like, so,
Speaker 1: what's your favorite pets name? Paul Newman's Thousand Island dressing. Yeah,
Speaker 1: that's right. Well I'll tell you that this is and
Speaker 1: anybody who's frustrated by this conversation and will tell you
Speaker 1: that using these super secure passwords and obviously a fustutory
Speaker 1: material here is a pain in the neck because you know,
Speaker 1: if you don't have to have your password manager with
Speaker 1: you when you're on a friends computer logging in to
Speaker 1: check your mail and it's got some kind of thirty
Speaker 1: two character weird password and you don't remember it, and
Speaker 1: you're going, man, I know, no one's ever going to
Speaker 1: crack into this computer. It's a friends computer. I'm fairly saying, well, yeah,
Speaker 1: you probably are fairly safe, but it's probably worth a
Speaker 1: frustration then, more so than it will be having to
Speaker 1: put out all the fires of all the account information
Speaker 1: that you could be giving up otherwise. And it's not
Speaker 1: so much worrying about your friends computer as it is
Speaker 1: worrying about that database that's on the other end of
Speaker 1: this password system. Because, uh, the more passwords a company accumulates,
Speaker 1: as more and more people use its service, the more
Speaker 1: attractive it is as a target to crackers. And they're
Speaker 1: doing you know, that's that's what they do. They look
Speaker 1: at systems and try and find ways of of penetrating it.
Speaker 1: So it's you know, they're not they're not worried about
Speaker 1: getting your your buddy bills computer. They're looking at you know,
Speaker 1: like Mega core that has all those passwords in it.
Speaker 1: That's what they want. So you know, using that easy password,
Speaker 1: while it's convenient, is also ultimately a dangerous thing. And
Speaker 1: you know, I gotta I gotta admit, like, for the
Speaker 1: very long time, I had pretty poor password protection, and
Speaker 1: I just I was just I did not I was
Speaker 1: not very good about it at all. Even as we
Speaker 1: were telling people change your passwords, still wasn't doing as
Speaker 1: as good a job as I should have. But you
Speaker 1: don't back up your hard drive regularly? Oh yes I do,
Speaker 1: I do good. I got well the MAC hard drive,
Speaker 1: my my PC hard drive. I do not back up
Speaker 1: as regularly as I should which really I need to
Speaker 1: start doing that. But the in the neck. But but
Speaker 1: cloud services have made that really a lot better too,
Speaker 1: now you know. Cloud of course has its own set
Speaker 1: of problems, which we've talked about in previous podcasts. But
Speaker 1: everything technological has its own set of problems. You just
Speaker 1: have to decide which ones are the most acceptable set
Speaker 1: of problems for you. So, but I have I have switched.
Speaker 1: I mean I am now I am wholeheartedly in this.
Speaker 1: Let's protect our passwords, especially after saying what happened to Honan.
Speaker 1: I mean, you and I are in the public eye.
Speaker 1: We're not celebrities by any stretch of the imagination. But
Speaker 1: it's not that far, um, it's not. It's not all
Speaker 1: the realm of possibility that someone at some point could say,
Speaker 1: you know what would be funny? Well, and and it
Speaker 1: just really takes somebody getting ahold of your name. Yeah,
Speaker 1: that's why they tell people to shred when you have
Speaker 1: a junk mail or something with your name on it,
Speaker 1: to shred that information. Because I've got one of those two.
Speaker 1: You never know when somebody's gonna go and you know,
Speaker 1: say Jonathan's chickline. I bet there's a bunch of people
Speaker 1: named that. Actually there are. So one of them got
Speaker 1: booked in North Atlanta for something a couple of weeks ago,
Speaker 1: but wasn't me. I won't ask how you know that
Speaker 1: I'm on the lamp because I've got a Google alert
Speaker 1: said to my name, because because how many egomaniac I'm
Speaker 1: an egomaniac, I have a Google alert said to my name.
Speaker 1: I saw a Google alert. I went and I said,
Speaker 1: someone named me was arrested. But it's not me, because
Speaker 1: I'm looking at the picture and that's not me. So
Speaker 1: I am comforted to know I am not currently under arrest.
Speaker 1: That's good to know. It was good to know the
Speaker 1: police wanted a few words with me earlier, and you
Speaker 1: know I can tell him the truth. I gotta go alright, guys,
Speaker 1: if you have any suggestions for future topics on tech stuff,
Speaker 1: um biometrics that earning perhaps like what's it like the
Speaker 1: podcast Out of the Penitentiary. Let us know. You can
Speaker 1: send us email our addresses tech stuff at Discovery dot com,
Speaker 1: or contact us on Facebook or Twitter. Are handled. There
Speaker 1: is tech stuff hsw and Chris will talk to you soon.
Speaker 1: I'll talk to you in ten to twenty for more
Speaker 1: on this and thousands of other topics. Is it how
Speaker 1: staff works dot com? See, guys, I told you we
Speaker 1: talked to you again. Really soon. That really soon is
Speaker 1: right now. I'm just reminding you that we have our
Speaker 1: photo upload widget live on the site at www dot
Speaker 1: how stuff works dot com. Slash upgrade your tech Toyota
Speaker 1: is giving us the chance to let you share your creativity.
Speaker 1: So send us those pictures of your modifications, your tech ideas,
Speaker 1: those gadgets that you've created, all those hacks. If you're
Speaker 1: steampunking everything in sight, put on your goggles and show
Speaker 1: that to us. We can't wait to see them. Brought
Speaker 1: to you by the reinvented thousand twelve camera. It's ready,
Speaker 1: are you