PPP's Tip of the Week

What Makes a Password Stronger by Stu Woo provided by


With concern about hackers, tools for remembering so many codes; no more pet names or 123456.

For all its benefits, the Internet can be a hassle when it comes to remembering passwords for email, banking, social networking and shopping.

Many people use just a single password across the Web. That's a bad idea, say online-security experts.

"Having the same password for everything is like having the same key for your house, your car, your gym locker, your office," says Michael Barrett, chief information-security officer for online-payments service PayPal, a unit of eBay Inc.

Mr. Barrett has different passwords for his email and Facebook accounts -- and that's just for starters. He has a third password for financial websites he uses, such as for banks and credit cards, and a fourth for major shopping sites such as Amazon.com (Nasdaq: AMZN - News). He created a fifth password for websites he visits infrequently or doesn't trust, such as blogs and an online store that sells gardening tools.

A spate of recent attacks underscores how hackers are spending more time trying to crack into big databases to obtain passwords, security officials say. In April, for instance, hackers obtained passwords and other information of 77 million users in Sony Corp.'s (NYSE: SNE - News) PlayStation Network, while Google Inc. (Nasdaq: GOOG - News) said this month that hackers broke into its email system and gained passwords of U.S. government officials.

So-called brute force attacks, by which hackers try to guess individual passwords, also appear to be on the rise, Mr. Barrett says.

PayPal says two out of three people use just one or two passwords across all sites, with Web users averaging 25 online accounts. A 2009 survey in the U.K. by security-software company PC Tools found men to be particularly bad offenders, with 47% using just one password, compared with 26% of women.

Another PC Tools survey last year showed that 28% of young Australians from 18 to 38 years old had passwords that were easily guessed, such as a name of a loved one or pet, which criminals can easily find on Facebook or other public sites. Other passwords can be easily guessed, too. Hackers last year posted a list of the most popular passwords of Gawker Media users, including "password," "123456," "qwerty," "letmein" and "baseball."

"If your password is on that list, please change it," says Brandon Sterne, security manager at Mozilla Corp., which makes the Firefox browser and other software. Hackers "will take the first 100 passwords on the list and go through the entire user base" of a website to crack a few accounts, he says.

People typically start changing online passwords after they've been hacked, says Dave Cole, general manager of PC Tools. However, "after a relatively short time, all but the most paranoid users regress to previous behaviors prior to the security breach," he says. He and other security experts recommend people change or rotate passwords a few times a year.

To come up with a strong password, some security officials recommend taking a memorable phrase and using the first letter of each word. For example, "to be or not to be, that is the question," becomes "tbontbtitq." Others mash an unlikely pair of words together. The longer the password -- at least eight characters, experts say -- the safer it is.

Once people figure out a phrase for their password, they can make it more complex by replacing letters with special characters or numbers. They can also capitalize, say, the second character of every password for added security. Hence "tbontbtitq" becomes "tB0ntbtitq."

No matter how good a password is, it is unsafe to use just one. Mr. Barrett recommends following his lead and having strong ones for four different kinds of sites -- email, social networks, financial institutions and e-commerce sites -- and a fifth for infrequently visited or untrustworthy sites.

Even the strongest passwords, however, are useless if criminals install so-called malware on computers that allow them to track a person's keystrokes. Security experts say people can avoid this by keeping their antivirus and antispyware software updated and by avoiding downloading files from unknown websites and email senders.

Some security experts recommend slightly modifying passwords within each category of site. Companies such as Microsoft Corp. (Nasdaq: MSFT - News) offer free password-strength checkers, but users shouldn't rely on them wholly because such strength tests don't gauge whether a password contains easily found personal information, such as a birthday or a pet's name.

It's especially important to have a separate password for an email account, says Mozilla's Mr. Sterne. Many sites have "Forgot my password" buttons that, when clicked, initiate a password-recovery process by email. Hackers who break into an email account can then intercept those emails and take control of each account registered using that address.

Some websites, such as Google and Facebook, now let people register a phone number along with their account. If a person forgets his passwords, the sites reset the passwords by calling or sending a text message to that person.

Mr. Barrett says people should be able to remember four or five good passwords. If not, they can write them down on a piece of paper and stick it in their wallet, and then throw the cheat sheet away once all the passwords are memorized.

People who still struggle to remember them all can use a password manager. Several, such as LastPass, are free. LastPass prompts users to create a master password and then generates and stores random passwords for different sites. Some security experts warn against using managers that store passwords remotely, but LastPass Chief Executive Joe Siegrist says hackers can't access the passwords because all data is encrypted.

The worst thing that people can do after creating their different passwords: Put it on a sticky note by their monitor. "That defeats the entire purpose," says Mr. Sterne.

Heather O'Neill, a 27-year-old tech-company employee in San Francisco, had her Google email account broken into earlier this year. She says she used the same password for several sites, and that it was a weak one. "I can't have one password for everything," she says. "Everything is going to be different."

Pumps, Purses & Positivity
Real Life, Real Talk, Real Women

PPP's Tip of the Week

Email Breach: 8 Ways to Protect Yourself by Jane Bryant Quinn courtesy of

Opt out of marketing data bases! Do it now! And don't give out any personal information in response to an email, even if it appears to come from your bank or favorite store.

Another major hacker attack last week exposed the names and emails of millions of consumers to cyber criminals — and you might be on the list. As a practical matter, you can't get out of all of the massive data banks that hold your personal data. Even the names of people who opted out might be retained. But you can do your best to minimize your risk.

The latest breach occurred at a company called Epsilon, a division of Alliance Data Systems Corp. Epsilon holds the names, email addresses, marital status, credit data, and other personal information of 235 million people. It mines the names for personal shopping habits, interests, life changes such as marriage or moving, and credit capacity, and sends out targeted marketing pitches. If you get a 30 percent discount offer from Target, to take just one example, it probably came from Epsilon. The company broadcasts 40 billion email messages annually, to consumers it considers most likely to buy.

So much of your personal data is swirling around the world that you cannot fully protect yourself. But here are some steps you can take to lower your risk:

1. Get out of marketing data bases. They all allow you to opt out, if you can find them. For example, you can block your name from being used by any of Epsilon's clients, including catalog marketers and retailers. One big problem: The database company might retain your name and just block it from being used. If a thief hacks in, he gets the blocked names, too.

The Privacy Rights Clearing House lists 135 data brokers who are selling your name to all comers, and tells you whether or not they have opt-out policies. If they do, you have to go to the brokers' websites and suppress your name yourself. I checked some of the sites and the opt-out screens are hard to find. One likely place is the broker's Privacy Policy, usually shown in small print at the bottom of the page.

2. Opt out, or unsubscribe, from every commercial email list you're on. "They're required to give you that option," says Greg Aaron, director of domain security for Afilias, an Internet infrastructure company. If you opt out at the source, your name should be removed from the large, pooled data bases.

3. Stop most direct mail. The Direct Mail Association provides a website, letting you opt out of various types of promotional mail from its members: credit offers, catalogs, magazine offers, requests for donations, and others. That should stop mail from national companies you haven't done business with before. Your opt-out lasts for five years. After than you have to sign up again.

The DMA opt-out won't stop mail from non-members, such as local businesses, charities, or mail from a company where you've shopped. You will have to contact those mailers directly and in writing (phone calls don't work). Be sure to tell them you don't want your name shared with other companies, such as Epsilon, for marketing purposes.

4. Stop your bank from sharing your name. Under the Fair Credit Reporting Act (FCRA), you can tell your bank not to give your name to any of its affiliates for marketing purposes, as well as to outside marketing firms. You have to give notice in writing, citing your rights under FCRA. Ask for a written acknowledgment that you've been taken off the list. These opt-outs, too, might last for just five years.

5. Stop sharing personal information on your Facebook, LinkedIn, or MySpace pages with the general public. Or, share only what you wouldn't mind seeing in a database, and leave off banking identifiers such as your mother's name. Social networks can be mined, using your email address.

6. Stop phone calls from telemarketers, by signing up with the National Do Not Call registry. When the registry began, you could stop these calls for only a limited number of years. Since 2008, however, you've been able to block them permanently.

7. Opt out of credit card offers. You can stop receiving them by signing up with the OptOutPreScreen, run by the consumer credit reporting industry.

8. Don't be fooled. Never open an email telling you that you've won something, or that you have an unclaimed package, or that there's a problem with your tax return or bank account. Just by opening it, you might introduce malware into your machine, which searches for passwords to financial accounts. If your bank or credit card company apparently sends you an email, asking you to make corrections in your account, delete. It's a cheat. Or call the institution to see if it's legit, before entering any information. With the Epsilon break-in, you might get phony phishing messages from familiar retailers, too. For more tips, check the Privacy Rights Clearinghouse and APWG, an industry organization that fights online fraud.

To read the complete article please click here

Pumps, Purses & Positivity
Real Life, Real Talk, Real Women