Ten Ways to Protect Your Accounts with Strong Passwords

Recently, many of us have been receiving messages that some of our passwords have been compromised. I have written about passwords before but I want to give you another dose of rules, tools, and suggestions to keep you as digitally safe as possible. I have been sitting down with friends and relatives recently and asking them to evaluate both their passwords and how they store and create them. 

Here are some suggestions, rules, and tools:

1. Don’t use the same password for more than one login. If one of those sites has a breach, someone now has your email (or user name) and password. You can be sure they will try it on other sites! 

2. Make passwords long and complex. Use numbers, capital and small letters, and symbols (if the site allows). 

3. Do not, do not, do not, do not keep a list of your passwords on a post-it note on your computer. While a piece of paper in a file might have some degree of security and practicality there are better ways to do this. On Apple products, you can create a password protected note, which is better than having a slip in your wallet – but there are better methods. 

4. I recommend everyone use a password manager. I use 1Password, but there are many others. Apple offers Keychain built into the Apple ecosystem. The main benefit of a password manager is that it stores all your passwords securely and you don’t have to remember all of them. All you have to remember is how to get into the manager (thus the one I use is called 1Password because I only have to remember the password that lets me into my password manager). I STRONGLY suggest looking at a dedicated password manager that is not a locked note, Keychain, or the password saver built into your web browser. 

5. Another benefit of a password manager is that it can autofill your usernames and passwords when you go to a website. It will also remember your password when you use it on a new website (and even offer to create a strong and complex password for you). 

6. A side benefit of this is that, if my password manager does NOT offer me my password on a website that LOOKS LIKE it is my bank, for instances, it is a warning that I might be on a fake website and about to give away my username and password to a hacker! If my password manager doesn’t recognize the website, I need to find out why. 

7. Consider trying passkeys instead of passwords. Passkeys are when you use another device instead of a password. You might use your fingerprint or other biometrics. A website might ping your phone, watch, or other device. You can even purchase an actual digital key that plugs into your computer and lets websites know that it is really you! 

8. Many websites now use one-time password codes instead of passwords. You log in with your email and they send you a code. This is great – as long as you have control over the means of getting that code. If a hacker gets control of your email or phone number, you will be unable to receive these one-time password codes.

9. For this reason (and others), it is critical that you use secure passwords with your high-priority assets: your email account, financial institutions, any website where you have stored a credit card (Amazon), social media accounts (Facebook, Instagram, TikTok, etc), and of course, work-related websites. All of these should be protected with long, complex, and unique passwords – so long and complex that you could never ever remember them. Thus, storing them using a secure password manager would be a good idea (there is a theme here – get it?). 

10. Always, always, always take advantage of two-part authentication when it is available. This is when you get a code sent via text or email or through an authenticator app when you log on to a site for the first time on a new device or browser. This is not foolproof. If someone has your phone, they might be able to use this to reset a password. However, if you receive a message with a code when you haven’t logged in to that website, you know someone else is trying to. 

The scammers are getting more and more clever and devious, as I have written about before. We have to help each other stay safe and protected! While a warning that you have a compromised password may or may not be true, we all could improve our password security. Be safe out there! 

Feeding Two Birds From One Feeder: How Our Language Reveals Us

Have you ever scrutinized someone’s words? Did you ever pour over a text message or email wondering if the message was intended sarcastically? Were you ever bothered by the way someone said something or their particular word choices? 

Our language matters. The words we choose and the way we communicate them reveal a great deal about our thoughts, feelings, and intentions. How we speak, the way we organize our thoughts, and the tone that accompanies them are as much a part of our message as the semantic meanings of the words themselves. 

One of the most famous examples of this is the quotation from the late President Regan: “Mistakes were made.” The statement neither takes responsibility for these mistakes nor tells us who made them. The statement is in the passive voice; the action is not with the speaker. It is a perfect statement for a politician. The president doesn’t say, “I made mistakes.” The president doesn’t make any judgment about the mistakes. They were just made – by someone, somehow. 

Many years ago, my school was looking for a new administrator, and focus groups were created so different groups could talk about what they wanted in that job. The person in charge of my group said to us, “I want teachers to feel like they are part of the process.” I looked at him and said, “I want to be part of the process.” There is a difference. The person running the meeting looked at me and said, “You know what I mean.” There is a big difference between “feeling like part of the process” and actually having an effect! 

When talking to parents of students, language tells me a great deal. Parents who use “we” when discussing their children’s activities are sending a clear message. We are applying to college. We studied for a test. We are going to practice. The truth is that the parent is not doing any of those things: the child is. 

The tone of parent emails is another place where parents reveal, intentionally or unintentionally, their relationships with their children and their children’s teachers. A parent whom I have never met or with whom I have no personal relationship should never address me by my first name. I have lost time track of the number of times I have received parent emails that read as if they are ordering products from a store or food from McDonald’s. The tone is one of a customer ordering a salesperson to deliver a product. Do parents sending nasty emails realize how insulting and hurtful they are? When speaking with them on the phone after receiving these emails, I realize that their tone has clearly communicated who they are and what is going on in their home. 

Perhaps the most striking and disturbing example of this is the way some media outlets described the people that Jeffrey Epstein was accused of harming. Was he trafficking in underage women or raping girls? “Underage women” is a euphemism for something far more disturbing – why don’t they write that? 

Similarly, the Civil War was not just a war between the states. Although we say the two sides were the Confederacy and the Union, the Union was the United States Army! People were not killed in the Holocaust, they were murdered. There is a big difference. 

Our language reveals and shapes the way we see the world and ourselves. It communicates far more than just the denotative meanings of the words. The whole is far more powerful than the sum of the syllables. Sticks and stones may break my bones, but words can shape our thinking. We must carefully consider which words we choose, how we weave them together, and the tone we use when communicating – not to trick or evade or cover – but to honestly, effectively, and clearly communicate. 

Reading for Treasure: Protecting Your Information and Privacy

Reading for Treasure is my list of articles (and other readings) that are worth your attention. Click here for an introduction.

Once again, here are some articles to keep you safe as you use your technology. Specifically, how to thwart being tracked or scammed by devices, websites, advertisers, and others. 

This video from CNN includes a password tip that is genius and I have never heard of before. I am not going to list it here, but listen for the word “salt” in the video: "Here's how to keep your passwords safe, according to a hacker.” 

Wired provided a simple and common sense list of “6 Things You Need to Do to Prevent Getting Hacked.” Read the article, but I’ll list them here: Use multifactor authentication, get a password manager, learn how to spot a phishing attack, update everything, encrypt everything, and wipe your digital footprint. If any of those terms are foreign to you, take it as a sign you need this article. 

A great compliment to the above article, Propublica’s article, “A Former Hacker’s Guide to Boosting Your Online Security.” provides a straight forward and simple list of ten things to preventing stolen data, identity theft, and other online hazards. Again, I’ll list them here, but read the article for more: stop reusing passwords, delete unused accounts, use multifactor authentication, manage your privacy settings, think before you click, keep your software up to date, limit what you’re sharing online, security your SIM, freeze your credit reports, and back up your data! 

Lifehacker is also a great source for digital safety. Here a short and simple article that lets you know “How to Tell Which Apps Can See Your Private iPhone Data.” It is an older article, but still worth reading. 

This somewhat scary article from The Conversation via Inverse is a good overview of how your use of technology may put your privacy at risk: “Here’s exactly how tech companies and apps conspire to track you 24/7.”

Yes, emails can snitch on you. Many emails report back to their senders if you opened them, when you opened them, and even for how long you engaged with them. Want to stop this? Read this article from Wired: “How to Tell Which Emails Quietly Track You.” If you use Apple devices, this Lifehacker article, “How to Stop Email Trackers on Your iPhone, iPad, and Mac” will help you with this issue and more. 

A new form of hacking is to use free USB charging stations. Apple Insider discusses, “What juicejacking and trustjacking are, and how to protect yourself.” The basic piece of advice here is, if your phone asks you “Do you trust this computer?” or “Allow this device to access.. and you are not connected to your home computer, say, NO! 

How many of us have lost our phones or have had our phones stolen?  We may feel safe because our phone is locked with a passcode, fingerprint, or our face. Lifehacker says, “Your iPhone Is Still Vulnerable When It Is Locked” and then helps you secure it! 

And it is worse than that: Lifehacker provides instructions on how to use screen time on the iPhone to prevent a stolen phone from becoming a stolen Apple account or worse: "How Screen Time Can Save You When Your iPhone is Stolen." 

I am currently reading The Paper Menagerie and Other Stories by Ken Liu

The Tone of Gesture

Did anyone in your family watch the old PBS children’s show, Barney- the show with the purple dinosaur who said he loved you and you loved him? Whatever you thought of the costumed title character, few people fondly remember the children on the show. There is a good reason. They were horrible over-actors. Their behavior was exaggerated and overblown. If my children brought a friend home who acted like these children, I would have been extremely concerned about their wellbeing. When I taught theatre class, I used these Barney children as examples of overacting. 

However, in the past three years, we have all become overacting Barney kids. When I am on Zoom, I find that I am often moving my arms and head to complement my words. When I speak, I gesture even more than I normally do (and I am a very expressive and physical speaker). I use Zoom backgrounds to communicate as well. Similarly, when I am wearing a mask, I compensate with the rest of my body. I work hard to “smize” and use my eyes to convey my emotions. Again, I find that I am using broad and exaggerated arm and hand gestures. My entire body tries to complement my eyes and communicate more than the semantic definitions of my words but their emotional meaning. 

While the pandemic has not turned many of us into over-emoters like those kids on children’s television, it has also given us insight into their motives. I have been placed in this tiny box and all you can see is a piece of me. Half my face is covered and you don’t know if I am being sarcastic, simple, or mean. So I need to supplement my language with large gestures. 

Our tone of voice often communicates a layer of meaning that our words alone cannot express. A mask muffles and obscures this. Zoom shrinks this. Thus, we need physical gestures to make sure that the most important meanings, the ones that are more powerful than mere denotation, to make it through these COVID-created barriers. 

Has this turned us all into cheerleaders, spelling out each affirmation and encouragement? Not quite. Has this made us more aware of the limits of language and how easy it is to misinterpret and confuse? Certainly! 

I’ll bet that most of us aren’t even aware that we are compensating this way. Like players of Charades, we are acting out the words and ideas in order to leap the linguistic, technological, and safety barriers. We want to be understood – really understood – in a way we took for granted just a few years ago.  

Bring understood means clearly communicating through not only what we say, but also how we say it. We all know that people can say things that are complementary and positive if we read them, but can be brutal and cruel when spoken in a certain tone of voice. The reverse is also true. Some of us struggle to make sense of this kind of sarcasm. Gestures, facial expressions, and vocal tone are the keys to communicating it. 

Communication that is only typed text lacks this context. There is no gesture or voice to a text or email. We add emojis or initialized shortcuts to indicate that we are just kidding (JK), rolling on the floor laughing (ROFL), or shaking our head (SMH). We instinctively know that our written words inadequately communicate important parts of our message and our reader needs help to comprehend all the levels of our meaning. 

This is also why we can find emails or text messages so problematic when the sender fails to recognize their tone and context. People take offense at texts that the sender thought were merely informational. Emails make the recipient feel horrible when the sender thought they were just being factual. 

How we communicate is at the very least as important as what we communicate –probably it is more important. We cannot help but embed our emotions as we connect with each other, even if it is accidentally. 

I do not like wearing a mask. I prefer to share a room IRL (in real life) with people rather than be placed in a Brady Bunch box on the screen. However, over the past three years, COVID has forced us to be more thoughtful about our communication, hone our nonverbal skills, and heightened our awareness of the meanings behind the words: the tone created by the intersection of our words and the physical gestures that accompany them. 

Reading for Treasure: Scamdemic!

Reading for Treasure is my list of articles (and other readings) that are worth your attention. Click here for an introduction!

I have written about scams before and my most recent post deals with some thinking strategies to help us sift through the overwhelming mounds of information (and disinformation) in order to evaluate them well. However, the evil fraudsters are taking advantage of the current crisis to trick people into giving away their money, information, or more; thus here are some articles to help you protect yourself and your loved ones from the evildoers who would trick you. 

CNN’s article, “6 coronavirus vaccine scams that target your money and personal information - and what to do about them” is a short and very clear listing of possible scenarios. It is worth sharing with family-  especially elders! 

Wired has a good review of “How to Avoid Phishing Emails and Scams.” I have also written about this issue, but the fraudsters are getting more and more sophisticated. I also want to note that this article recommends the use of a password manager – and so do I (see below). 

Scamming can pop up in all sorts of places. Lifehacker’s article “Beware of These Creative Online Dating Scams” reminds us that people are trying to trick you even when love is what you are searching for! 

Another way to foil scammers is to improve your security. You must have a password manager if you are going to use complex effective passwords. Since LassPass changed its options, Bitwarden is a good choice if you want a free option. Lifehacker’s article about Bitwarden is worth a read if you want to taste test a password manager: “Bitwarden is Now the Best Free Alternative to LassPass.”

One more Lifehacker article reminds us, “Don't Trust Phone Calls From 'Venmo' or Any Other Service.” When your bank, utility, or other service calls, hang up and call back using the number you would regularly use to reach them – not the number from which the possible fraudster called you! 

Google has created a new feature to help you figure out if the sources that appears in your search are credible and trustworthy. Engadget lays out how to use this feature so you can evaluate sources and be sure you are getting the best information possible: “Google search results can tell you more about a site before you visit it.”

Currently, I am rereading Foundation by Isaac Asimov

Reading For Treasure: An End of the Year Digital Grab Bag!

Reading for Treasure is my list of articles (and other readings) that are worth your attention. Click here for an introduction!

Since we are all sending so much time on our digital devices, here is a grab bag of articles to make both your online and offline life safer, healthier, and better.

If you use an iPhone, it is time to retire those old “in case of emergency” designations in favor of the phone’s built-in emergency contacts. You can make any contact an emergency contact by editing it and selecting “emergency contact.” In addition, this article from Apple World goes one step further and explains “How to Send Your Medical ID to First Responders in an iPhone Emergency Call.” During a pandemic, this seems like a feature to activate. 

Many of us are spending hours and hours on our devices. If these devices break or lose our data, we may have significant problems. That is why it is critical to back up everything – and I mean everything. Wired Magazine has a good overview of this: “How to Back Up Your Digital Life.” If your answer to “what would happen if your computer crashed?” Is that you would be up the creek, consider reading this and backing up everything! Remember, you probably want to back up your phone, too! 

Often the weakest link in your digital armor is your password. Some of us use the same password all the time. Some of our passwords are easy to guess, even if you don’t know us well. Some of us have answered quizzes or done those Facebook questionnaires and shared the answers to every possible security question with the world. The key to good passwords is making them long and complex, but that means they are difficult to remember (and to crack). The key to making long passwords usable is a good password manager. I use 1Password, but there are many to choose from. Here is an Engadget article to get help you start using one: “It’s time to start using a password manager: Here’s how”

Finally, two good pieces from one of my favorites, Lifehacker. First and most important, “Never Email Your Social Security Number, I Am Begging You.” The title says it all, but I will add this: please think of any unencrypted email (which is probably all of our emails) as a postcard, not a letter. There is no envelope and anyone on all the systems it passes through (and there are many) could look at it. 

Finally, since we are sitting in front of screens all the time, we need to protect our necks, backs, wrists, eyes, and the rest of our bodies. Lifehacker also provided a good guide to make sure that you are not making yourself sick by the way you are using your computer: “How to Ergonomically Optimize Your Workspace”

I am currently reading The Peripheral by William Gibson

Reading for Treasure: February

Reading for Treasure is my list of articles that are worth your attention. Click here for an introduction! Here are some articles to read discussing how we can both mentally and physically protect our children and ourselves:

10 Reasons Teens Have So Much Anxiety Today: This quick article from Psychology Today lists specific reasons that teens today may be much more anxious than we were at their age. It is a good checklist for parents!

Teach Your Kids To Value Empathy Over Tenacity: Years ago, my congregational rabbi’s High Holiday sermon asked, “Would you rather your children be successful or good?” Kids know what we really value by our behavior, even if our actions don’t always match. This short Lifehacker article provides a good example of why empathy should be higher on most parents’ lists.

Encourage Teens to ‘Speak Before You Send’: This Lifehacker article is a great companion to the one above. I think we hear language very differently than we see it. When I just read my text or email in my head, it sounds fine. When I read it aloud, I hear it very differently. This is makes reading aloud a great editing tool – not only for writing skills but for empathy as well.

Bicyclists Should Be Shamed Into Wearing Helmets: This Chicago Tribune column takes a humorous angle on a very simple message: wear a helmet when riding a bike. I love the old man voice in this article. When my kids were growing up, we always said that you only needed to wear a helmet if you had something to protect…

10 quick thoughts on mobile phones in schools: This quick list from Dangerously Irrelevant really says that the problem is not phones. There are other issues and classroom phone struggles are really about teaching, the structure of schools, and the use of technology for learning. I agree!

I’m currently reading The Fated Sky by Mary Robinette Kowal

Don’t Reply All Rant

Don’t hit reply all. Don’t! Don’t! Don’t!

I’d like to tell you to never use reply all, but there may be legitimate reasons to reply all even if I can’t think of any of them. So consider my thesis to be: don’t use reply all ever!

While there may be a few times when replying to all is appropriate, I hereby give you permission to mess up by failing to reply all rather than replying to all inappropriately, which is far more likely.

It is like using effect as a verb. There are times when it is correct, but this occurs so rarely that using affect all the time is far less likely to get you in trouble. Reply all has that effect (which is not using effect as a verb).

Reply to the sender of the email only. S/he is the person who started the conversation in the first place. If the sender asks a question of ten people and they all hit reply all, you now have ten emails – and a possible reply from the sender to make number eleven. Just what you want - more emails!

What if each person sent a reply back to the sender and the sender sent a summary? Instead of ten emails, you have one. One. Only one. One that it is relevant to you. Do I really need to know that you can’t make the meeting because your daughter is getting her ears pierced or you are bringing gluten free doughnuts?

I know that some people can’t help themselves. Some are using phones with buttons so small that they hit the wrong choice. Some still get confused by the options. Some don’t understand the difference between reply and reply all. Some really want me to know that their spouse has strep.

There is an easy solution to this problem: When sending an email to a group of people, put the addresses in the BCC field. BCC stands for blind carbon copy. This means that those who receive the email cannot see the list of recipients, no matter how long. Putting the recipient list in the BCC field not only protects their privacy but also makes the email easier to read because it will not have the long list of addresses at the beginning, which is especially nice for those reading it on tiny screens. It also prevents anyone from using this list for other purposes. I love that people feel free to share my email address with large numbers of strangers.

If the long list is in the BCC field, the only person who will receive a reply is the sender, no matter how befuddled the recipient may be. No one’s email is shared at all! Problem solved.

Don’t use reply all. When sending emails to groups, put the list in the BCC field. Yes, you can leave the TO or CC fields blank, it will still send.

I will have to compose myself to write about group text messages, but we'll save that for another time. 

End of rant.

Prevent the Hack Attack!

Been hacked lately? Received an email containing a strange link? Seen people tagged as shoes on Facebook? Friends stuck in a foreign country and need money? If you don’t take precautions, your accounts could be hacked.

Everyday, people lose control of important online accounts. There are three simple ways to prevent this: better passwords, a password manager, and a security system called two part authentication.

Better Passwords: The first step is to make your passwords harder to crack. Don’t make your password a simple word or phrase; the longer the password, the better; include numbers, capital letters, and punctuation marks; don’t use the same password for everything.

One way to make a stronger password is to base it on a phrase. For example, the first few lines of Browning’s famous poem:

“How do I love thee? Let me count the ways.
I love thee to the depth and breadth and height
My soul can reach,”

This can turn into a password by using the first letters of each word (or some version of them): “HdIlt?Lm123tw.Ilt2td&hMscr,”.

This is a much better password than any single or combination of words –and I will be able to remember it!

Password Managers: Remembering passwords is difficult, but there is a good tool to help you: a password manager program. These programs store all of your passwords securely. Instead of a list of your passwords in a text file or on a scrawled piece hidden under your keyboard, these programs collect and enter passwords in your browser, and even help you to create more complex passwords. So my password can be “eKHnqjnqJCL98bUwrF” because I don’t need to remember it. When I need to use it, my password manager will fill it in for me. I only need to remember the password to that program! I only need one password!

Two popular password manager programs are LassPass and 1Password. Both offer apps for your phones so you can have your passwords in your pocket.

Two Part Authentication: Beyond making your password more secure, the other precaution you should consider is two-part authentication. Two part authentication means that your password is only one part of logging into a site like Facebook, Google, or iCloud. The second part is a code sent to your phone.

Yes, this means revealing your cell phone number. While that may make you nervous, I have not encountered any problems with it and the benefit is additional online security.

After signing up for two-part authentication, the first time you sign back on to your account, you will be asked for your password. After you put it in, a code will be sent to your phone. After you enter the code, you will have access to your account. You don’t need to do this every time you log on. You can indicate that you want to authorize a computer and the system will remember it. However, when you are logging on using a friend’s machine or any other “foreign” computer, you do not click that box, and even if someone gets your password, your account is still safe.

In order to log into your account, a hacker needs your password and the code sent to your phone. A person might hack your password, but will not have your phone. If a hacker is trying to get into your account, you will get a text message with a code. Didn’t request one? You know what is going on: change that password, and stay ahead of the hacker!

Here are links that show you how to set up two-part authentication for Facebook, Google, and iCloud.

Better passwords and two-part authentication will make your accounts less vulnerable to hackers. They are not perfect of fool proof, but why not put secure locks on your valuables? 

Subject: Your Emails To Your Teachers

Dear Students,

Your emails need improvement. They are unclear, grammatically incorrect, and far too informal. One important lesson you must learn in school is to how to communicate well. Here are some important tips on writing formal emails to teachers, professors, employers (current or potential) and anyone other than your friends or family:  

Use formal salutations and titles. You don’t call your teachers by their first names, you don’t address them with “hey,” and you don’t just dive into the conversation. Close your emails appropriately using a closing salutation like “Sincerely,” “Yours,” “Thank you,” or even “See you in class.”

Use the subject line to clearly state the purpose of your email. Don’t leave it blank or simply put your name in it. You may include your name and class, but you should also briefly state the main point of your communication.

Use formal language and a respectful tone. Don’t address your teacher as you would a friend. Your email should not read like a text message. You should have clear sentences, paragraphs, and employ good grammar and correct spelling. Be sure to spell your teacher’s name correctly. It is helpful to bold important lines and make each point an individual paragraph.

Do not ask, “Did I miss anything?” when you are not in class. “What did I miss?” is no better. It is unreasonable to ask a teacher to capture an entire lesson in an email. Do your homework if you miss class; contact a classmate, look at the website, and do your best to find out what you missed on your own. Then email the teacher to ask questions, make an appointment, or arrange to make up missed work.

Do read over your email before you send it. Before you press that send key, give a second look at what you have written. Do use the spell checker. It might help to type the email in a word processor and then copy it to your email. If it helps, read it aloud to make sure you are communicating clearly and correctly.

Do check for your teacher’s reply. Students frequently ask, “Did you get my email.” Teachers often reply, “Yes, did you get mine?” If you aren’t going to read your teacher’s reply, don’t send the email at all.

Your email communicates far more than the words themselves. The messages you send tell people about who you are, what you know, and how you treat people. Your emails can enhance and strengthen your relationships or they can leave a lasting poor impression. It is worth taking the time and thought to use them well.

Please consider these ideas when you are emailing your teachers or communicating with anyone with whom you have a formal relationship. 

Sincerely Yours,

Mr. Hirsch