USE DIFFERENT PASSWORDS
We're all guilty of using the
same password time and time again. While this makes things easier to remember,
it also makes it easier for hackers. If a company is attacked and
cybercriminals get away with lots of usernames, email addresses, and passwords,
this information is often sold online. The details can then be used to try and get access to other accounts.
If you've used the same password
everywhere, then this kind of attack can be very effective. To see how much
you're at risk of this, you can use haveibeenpwned.com. Simply type in your
email address, click the Pwned button and the site will tell you if you appear
in any of the discovered lists of stolen user data.
The single best way to protect your accounts is to use
unique and strong passwords for every service that you use. That way, even if
one account is breached, your other ones are safe because they use different
passwords.
You can do this manually by using long passwords for each site,
potentially recording each password in a book. However, we recommend paying for
a password manager, such as LastPass, which runs on Windows, macOS, iOS and
Android. The software can securely generate and store passwords for every
website and app you use. For desktop users, the software can generate passwords
when you create accounts, storing the results. It's more of a manual process on a smartphone, due to limitations in the
operating systems, and you have to open the password app, add a new entry and
then create the password. However, the hassle is worth it, as you get accounts
secure passwords synchronised across all your devices.
Just don't forget the
master password to your password manager, as you'll then be locked out of
everything: this one is worth writing down and storing somewhere safe
USE TWO-FACTOR AUTHENTICATION
As well as using a password,
use two-factor authentication on any account that supports it. This requires
you to enter not only your password but also a unique one-time code. This code
can be generated by an app, sent via text message or even emailed to you. The
advantage of this type of system is that if a criminal gets hold of your
password, they still can't access your account without providing the second
code thatß required.
Each site and service has a different setup routine to
enable two-factor authentication, so you'll need to follow the information
provided to add this extra protection.
The service that you use defines the
options that are available. The best ones, such as Google and Facebook, let you
use an app on your phone to generate your codes. The Google Authenticator app
is good, but if you have LastPass, you can use its Authenticator app to
synchronize your codes securely to the cloud. If you lose your phone, you can
get a new one and restore your code generators.
All sites that let you generate
a code will also give you several backup codes that you should download and
print out. You can use these in an emergency should you lose your phone and
need to get access.
For even more security, look out for sites that support the
YubiKey or other USB security key. These keys can be carried around with you
and plugged into a USB port. When a site or service asks for a code, you can
just use the button on the YubiKey to send the data. However, its worth having
a backup option, such as a code generator, just in case.
We use LastPass
protected by both a long and complicated password and a YubiKey: only this
combination will unlock our other passwords. Make sure that you never divulge a two-factor
code to anyone to prevent fraudulent access to your accounts.
WHAT TO DO IF
YOU'RE HACKED
So what happens if you're hacked, and how do you know? For the
latter, you may get an email from the company telling you Of a security breach
and that your details may be at risk. You may be told that your password is
secure.
However, in many cases, you don't get much information, bar some
warning signs. For example, we've had a few emails with two-factor codes come
in for an Old VPN account where the password had been breached. This tells us
that the password had been compromised but that our two-factor system had prevented further access. Look out for these emails or warnings
of suspicious activity, as they hint that your password has been compromised.
When you get any warnings, direct or otherwise, its wise
to go to the account in question, log in and create a new secure password using
a password manager. This will protect you against further problems.
If you've
used the same password on Other websites as well as the compromised account,
you'll need to log into these accounts too, and then change the password for
something more secure. If you use a password manager, it will warn you if
you've stored weak or repeated passwords for any websites. Take these warnings
seriously: you should update and replace Old, weak passwords and those that you
have used on multiple occasions. This could prevent you from having a bigger
problem in the future.
Comments
Post a Comment