World Password Day: Recycling is a must, but why would you reuse your password?

World Password Day, celebrated on the first Thursday of every May, is a timely reminder of the fact that our passwords are the key to a wealth of personal information about us. However, poor password practices, including the use of the same password to access multiple accounts, can create serious risks and undermine our privacy and cybersecurity.

It would be nice to imagine that if the various contenders for “inventor of the password” had known how much of a hassle its computer variety would end up posing centuries later, they would never have bothered. Or maybe that inventor – perhaps a Gileadite or Roman soldier – just didn't care about the tradeoff between security and convenience that would plague us in the internet era. Either way, the legacy of the military watchword is here to stay.

Quipping aside, the routine works like this: you sign up with your username and password that only you know, and you’re golden. To log in again, you just need to recall and input your login credentials. Of course you knew this would happen, so you took some “precautions”: you set up the account with an easy-to-remember password.

And therein lies the problem. “Easy-to-remember” most often equates to short and simple, as well as easy to guess. That’s especially true for password-cracking software doing the bidding of an operator intent on brute-forcing his way into your account. Such software can open the trove of treasures just as magically as the phrase “Open Sesame!” does with the mouth of a cave in a well-known folk story.

On the flip side, a password that is long, complex and random is harder to crack, but also harder to remember. And therein lies the problem (yes, again!). Recalling many impossible-to-guess passwords and being able to remember to which particular online service each belongs is just too much of a tall order, unless you have the memory of an elephant.

Indeed, passphrases – say it with me, “I LOVE to Read WeLiveSecurity!” – may help both in terms of security and convenience (the latter being simply a proxy for memorability). However, is it reasonable to expect every user to remember a distinct passphrase or password for each and every online account?

Something’s got to give

What many people do – at least those who are not elephants – is skimp on their security, use an atrocious password (“123456”, anyone?) and go on their merry way. Until their accounts are hacked and their online personas are compromised or, worse, their identities and money are stolen. After all, it is human nature to disregard risk until disaster strikes.

Indeed, it feels like you can’t have it all; that is, many online accounts, each of which has a supremely strong, unique and memorable password or passphrase. It is little wonder that our patience wears thin and we take mental shortcuts. Enter another coping strategy that greases the wheels of hacking – password reuse.

While being antithetical to userland security, you can bet your last dollar that password recycling is invariably right up there with all the other most frequent and ill-advised offenses committed by users in the realm of authentication. Passwords created with another oft-used strategy, which involves slightly modifying the password for each account (“partial reuse”), tend to be predictable and, thus, just as easy to crack.

Why is password reuse so risky?

The neighborhood that is the internet can be rather less than neighborly in many ways, doubly so when data breaches are a reality of our age. The breaches often expose login details that – if you use them to access multiple accounts – can be successfully exploited for attacks known as credential stuffing. This becomes particularly troubling when an attacker uses stolen or leaked access credentials that belong to one account in order to break into another – often higher-value – account. Thanks to frequent password dumps, user/password combinations are easy to come by, and often at little-to-no cost at that.

If a breach hits and the credentials aren’t stored with advanced salted-hash functions (think, for example, a hack against Adobe in 2013), a strong password, or even a passphrase, may not be enough to thwart an account-takeover attack if you use that password to access multiple online services.

Factoring in another factor

Many account-takeover attempts can be foiled with two-factor authentication (2FA). An added authentication factor provides an extra layer of defense beyond the simple passcode/password/passphrase and, in a way, fixes some of the inherent human foibles that are routinely exposed by our poor password choices.

So far so good. However, many online service providers have yet to implement 2FA into their authentication schemes. (You can check the status of various websites vis-à-vis 2FA here: https://twofactorauth.org/.) Additionally, as shown by a recent report about the adoption rate of 2FA among active Google accounts (lower than 10 percent), even if such an option has been available for years, most users simply don’t take advantage of it, be it that they’re unaware of it or apparently have bigger fish to fry.

There are other forms of authentication, of course, that may take some of the weight off our shoulders (and brains), be it biometrics (e.g. fingerprint or iris recognition) or algorithms to measure behavioral characteristics (e.g. typing rhythm) or others. Their availability and, by extension, adoption are nowhere near widespread, however.

Is there another way, then?

Well, yes, although it actually flies in the face of much advice dispensed by security folks. In 2014, Microsoft Research released a paper that suggested a different tack. In thinking of various online accounts as somewhat of a continuum, the paper averred that some degree of password reuse is inevitable, but that it should be reserved for low-risk, low-value services. Put differently, the reasoning went that all accounts are not born equal and should, therefore, be divided into groups according to value. ESET Senior Research Fellow David Harley weighed in on this approach, while hinting at its potential pitfalls, in this insightful piece.

On a different note, chances are that you won’t cull your online accounts all the way down to whatever number you can manage easily with unique and strong passwords or passphrases. Nor will you probably be willing to engage in some serious mnemonics or aspire to eligibility for a memory competition.

With that in mind, the easiest thing to do is, arguably, to put all of your passwords (strong and unique, of course) into a kind of digital safe. That vault is dedicated password management software that, ideally, encrypts and stores all of your passwords locally and offline.

Indeed, password managers are all the rage in password security and, intuitively, it is hard to deny their merits. In addition, recent research found that password managers benefit both password strength and uniqueness, although apparently this strategy works only if the passwords are generated by the software.

Either way, assuming that you trust the implementation of your password manager – and you wouldn’t use it if you did not, right? – then its security is largely determined by the robustness of your master password. That’s doubly relevant if you consider that you’re effectively putting all your eggs, including some made of gold, into a single basket. That basket could, in fact, become a single point of failure.

They shall not pass

To be sure, passwords are flawed. Except that, in our internet era, there’s no other ubiquitous method of user authentication. Having their impending demise predicted back in 2004, passwords may well have outstayed their welcome. However, it appears that it will still be some time before they go the way of the dinosaurs.

All told, some things in computer security are beyond the control of a regular user, but why not go and fix those that are? In a way, the persistently poor password practices of many other people give you a chance to be ahead of the pack. What’s not to like?

WiFi or Ethernet: Which is faster and which is safer?

Lucas Paus

There is a lot of debate about WiFi speeds and whether they can offer higher potential speeds than a cable connection, but in practice Ethernet connections turn out to be not only faster but also safer.

The era of technology we exist in leads us (and in some cases forces us) to be connected at all times. One of the consequences of this connectivity can be clearly seen in communications and in how we have gotten used to things happening instantly. Nowadays, we, as users of technology, see it as only natural to be able to obtain information or communicate with another person immediately.

In this context, for the most part we have two options for getting online: The first is wireless, via WiFi, and the second is through a network cable, commonly known as Ethernet. Let’s analyze these two options to see the differences between them and also take a closer look at the belief that network cables are always the best option.

Accessing the Internet via a network cable: Is it faster?

Naturally, the arrival of wireless connectivity was a great benefit as it allows us to keep our physical space tidier and avoid the need for lengths of cable between connected devices. But besides the convenience offered by wireless, when it comes to pure speed, a debate has been raging for some time now leading to a lot of disagreement: Which is faster, WiFi or network cables? The answer is straightforward, though: cable. Although WiFi is a newer protocol, there are a lot of factors in play (in fact we will only look at a few in this article) that influence whether one connection can be faster than another. Perhaps the main issue is the saturation of channels and the large number of default connections, which makes data transmission speeds less stable and generally lower.

Added to this is the effect of building structures, for example, concrete walls, swimming pools, and other building materials which cause a loss of signal and a reduction in performance, which affects the speeds achievable from a WiFi connection. Generally speaking, the higher the frequency, the larger the rate of absorption by walls and floors.

Of course, it is almost impossible to notice these slight, almost imperceptible variations during normal browsing. However, the differences in performance are more obvious when it comes to activities like playing an online game, sharing files on the network, or streaming ultraHD content.

To summarize, we can say that while there are different norms and standards for each type of connection, in general, a correctly installed network cable connection ends up being faster than a WiFi connection. When we look at the speeds offered by each protocol, for example the 802.11ac standard,  we need to understand that its stated speed of 6.5 Gb/s is the maximum theoretical speed (which is faster than Ethernet 2.5 at 6 Gb/s), but that in most cases it cannot actually reach its maximum potential as it is affected by the obstacles we just mentioned. For their part, Ethernet connections offer a more stable performance, as they are not affected by these issues or other external factors. To finish off, it is worth highlighting that a couple years ago the Cat.8 Ethernet protocol was launched. Its use isn’t widespread due to its high costs, but it can reach speeds as high as 40 Gb/s.

Accessing the Internet via Ethernet is more secure than by WiFi

If we think in terms of secure communications, the argument in support of wireless connections loses immediately if we compare it to Ethernet. Numerous kinds of attacks can be carried out remotely, such as deauthenticating a device, or cracking the encryption key to get into the network. Furthermore, in the past year we have seen the emergence of vulnerabilities like KRACK, which affects WPA2 (one of the most robust and widespread protocols), and which was likely the trigger that led to the development of the new WPA3, although this has not yet been launched. As well as this, an attacker could also block wireless communications, with greater or lesser degrees of success, through the famous signal-blocking jammers.

Lastly, another very common type of attack is one which uses fake access points, whereby the victim connects to an open network which was created by the attacker, who then spies on the user’s traffic and steals their data. Of course, these attacks are impossible to carry out remotely through an Ethernet network, as an attacker would need physical access to do so. For these reasons, cable connections are more secure than wireless, or, in other words, they offer a lower risk of incidents if you do not make great efforts to apply some of the various security measures available.

So, more cables and less WiFi?

Having read this far, you may have started to think about whether to update your network architecture and connect everything via Ethernet. Of course, for devices like smartwatches, tablets, cell phones and smart lighting, this option is out of reach.

To conclude, it is logical that the best way to transfer files between devices at maximum speed is via an Ethernet cable. It is important to clarify that the Internet speed you agreed on in your contract with your ISP makes no difference in this case.

Clearly, the need for mobility will have an impact on our decision, as will the number of ports available in our router. If you use a laptop and are constantly moving from one desk to another within the range covered by your WiFi, it may be impractical to restrict yourself to a cable, which would force you to stay in the same spot. With a desktop, though, things are different. While desktops can be fitted with a wireless card, this is only recommended when connecting an Ethernet cable between the desktop and the router is not possible. For network sharing devices and media players, cable connections are also best.

While the dream of cable-free devices is already possible, in many cases it is not the best option if you love high speeds. In the end, then, it all comes down to a question of priorities.

https://www.welivesecurity.com/2018/05/02/wifi-ethernet-faster-safer/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

This test will tell you how likely you are to fall for fraud

Tomáš Foltýn

The questionnaire measures a range of personality traits to distinguish people who are more prone to taking the bait than others.

Researchers have devised a test that gauges a person’s susceptibility to falling for online scams and other types of internet crime.

The freely available questionnaire – called “Susceptibility to Persuasion – II” (StP-II) and developed by scientists at the Universities of Cambridge and Helsinki – asks the participants a series of questions that reveal how likely they are to succumb to persuasive techniques.

The test’s first version, StP-I, was actually released five years ago. The new version has been described as “far more comprehensive and robust” than StP-I, however. The nuts and bolts of the new test are described in an aptly-called paper, “We will make you like our research: The development of a susceptibility-to-persuasion scale”.

The test revolves around ten categories that are used as predictors of “scam compliance”, i.e. one’s falling for fraud. The attributes measure various personality traits due to which some people may be more prone to falling victim to con artists than others.

The categories include premeditation, consistency, sensation seeking, self-control, social influence, similarity, risk preferences, attitudes towards advertising, need for cognition, and uniqueness. Each of them has been proven to be a factor in one’s susceptibility to persuasion, obviously in varying degrees and at various stages during the process. Of all the variables, however, the failure to envisage the possible consequences of one’s actions has been found to be the strongest predictor of scam compliance.

Upon completion, the questionnaire taker receives an automated interpretation of the results.

The researchers noted that there is generally a three-step pattern in scams. First, the victim views the offer as believable, then he or she interacts with the scammer and, in the end, the victim loses something of value to the fraudster.

According to the researchers, their “generalized modular psychometric tool” could also be useful for recruitment in specific professions, for the screening of military personnel, or for establishing the psychological profile of cybercriminals.

“While there is a commonly held belief that an individual can either be a victim of a scam or not, there is a growing amount of evidence that this is perhaps too simplistic,” the researchers said.

https://www.welivesecurity.com/2018/04/30/test-likelihood-victim-scam/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29