No Matter How Diligent You Are...

Today, I got an email from a service provider I have only rarely used stating that they had been the victim of a successful hacking attempt. They reassured me that they didn't store any credit card details but I should change my password as soon as possible.

This is the second time this has happened in the past year and both sites are fairly insignificant in the grand scheme of things. They aren't, for example, financial services sites so I shouldn't panic unduly.

I have no changed my password on the offending website so all's well, right?

Wrong!

Whoever hacked this site may now have my name, address, email address and a password they know I have used in the past. Matching this password and email address may grant them access to other services I use online. That's not an unreasonable assumption on the part of the hacker, of course. How many people reuse their "favourite" password on each service they sign up to?

I think of myself as fairly diligent, though. I do have a "favourite" password. In fact, I have 3/4 "favourite" passwords! But NONE of them are used for my mission critical services: banking, being one!

However, I should now consider that one of my "favourite" passwords has been compromised and should be decommissioned. That now means I should take a look through my password safe and change the password on those services that make use of this now redundant password. What a pain!

The personal damage has been contained somewhat. My mission critical services are still safe. (In fact, I have no idea what the password is for these services and have no intention of ever "learning" what I have them set to!) If only everyone else behaved as responsibly. In fact, if only I behaved even more responsibly by having a separate password for every service I use!

My tips for the day, then, are:

• Even if you have a high-quality password, always consider it vulnerable as you have no idea how your service provider stores your password
• Try to create a different password for each of the services that you use (and avoid prefixing or suffixing your "favourite" password with the service details - passw0rdebay and passw0rdfacebook are stupid passwords)
• If you still feel confident reusing your "favourite" password, avoid the temptation to use it for your banking services
• Re-evaluate what a mission-critical service is. Banking is definitely mission-critical, but your reputation is also critical and having your Facebook or Twitter accounts compromised because of a slack password policy isn't clever either
• Invest in a password management tool - even something as simple as Password Safe ought to do the trick and it is free!

Identity Theft

It's New Year's Eve (or Old Year's Night as we like to call it) and yet my thoughts are focussed on Identity Fraud/Theft. Why?

Yesterday, a credit card statement turned up - post Christmas credit card statements are grim! Stuffed into the envelope was a leaflet informing me of the growing problem of identity theft. Of course there were the usual helpful tips on keeping your identity safe: shred your statements & use different passwords for each of the websites you visit. It was a gripping read.

But I also got a letter addressed to my 2 year old daughter from another financial institution advising her that Identity Theft was on the rise. It too had similar hints and tips for Identity Theft prevention.

The two institutions that sent these leaflets were purpoting to be eager to help my daughter and I the combat against Identity Theft. Of course, this assistance would be provided for a small monthly charge - what cost your identity after all. I must admit, though, that I struggled to see what these companies were actually doing for the money that they were demanding.

Of course, these companies are relying on our fears and perpetuating the notion that the world is a dangerous place. Of course it is... but one of the safest places to be is in an electronic world. I feel quite safe purchasing goods with a credit card via the wonder of the internet with reputable suppliers. I feel quite safe looking after my financial affairs online. And I still believe that if someone is going to steal my identity, they won't necessarily do it online - they will do it the old-fashioned way.

"The old-fashioned way?" I hear some of you say, "surely identity theft is a new phenomonen?"

Of course it isn't and the online world hasn't made it that much easier really. Those that fall foul of phishing attacks are likely to be the same people that fall foul of more traditional cons. (To understand the traditional cons, "The Real Hustle" on the BBC is a very good series showing how it is done).

So will I be parting with my hard earned cash in order to protect my identity? Nope... I'll look after my identity myself by being vigilant.

Happy New Year....