Ten Ways to Protect Your Accounts with Strong Passwords

Recently, many of us have been receiving messages that some of our passwords have been compromised. I have written about passwords before but I want to give you another dose of rules, tools, and suggestions to keep you as digitally safe as possible. I have been sitting down with friends and relatives recently and asking them to evaluate both their passwords and how they store and create them. 

Here are some suggestions, rules, and tools:

1. Don’t use the same password for more than one login. If one of those sites has a breach, someone now has your email (or user name) and password. You can be sure they will try it on other sites! 

2. Make passwords long and complex. Use numbers, capital and small letters, and symbols (if the site allows). 

3. Do not, do not, do not, do not keep a list of your passwords on a post-it note on your computer. While a piece of paper in a file might have some degree of security and practicality there are better ways to do this. On Apple products, you can create a password protected note, which is better than having a slip in your wallet – but there are better methods. 

4. I recommend everyone use a password manager. I use 1Password, but there are many others. Apple offers Keychain built into the Apple ecosystem. The main benefit of a password manager is that it stores all your passwords securely and you don’t have to remember all of them. All you have to remember is how to get into the manager (thus the one I use is called 1Password because I only have to remember the password that lets me into my password manager). I STRONGLY suggest looking at a dedicated password manager that is not a locked note, Keychain, or the password saver built into your web browser. 

5. Another benefit of a password manager is that it can autofill your usernames and passwords when you go to a website. It will also remember your password when you use it on a new website (and even offer to create a strong and complex password for you). 

6. A side benefit of this is that, if my password manager does NOT offer me my password on a website that LOOKS LIKE it is my bank, for instances, it is a warning that I might be on a fake website and about to give away my username and password to a hacker! If my password manager doesn’t recognize the website, I need to find out why. 

7. Consider trying passkeys instead of passwords. Passkeys are when you use another device instead of a password. You might use your fingerprint or other biometrics. A website might ping your phone, watch, or other device. You can even purchase an actual digital key that plugs into your computer and lets websites know that it is really you! 

8. Many websites now use one-time password codes instead of passwords. You log in with your email and they send you a code. This is great – as long as you have control over the means of getting that code. If a hacker gets control of your email or phone number, you will be unable to receive these one-time password codes.

9. For this reason (and others), it is critical that you use secure passwords with your high-priority assets: your email account, financial institutions, any website where you have stored a credit card (Amazon), social media accounts (Facebook, Instagram, TikTok, etc), and of course, work-related websites. All of these should be protected with long, complex, and unique passwords – so long and complex that you could never ever remember them. Thus, storing them using a secure password manager would be a good idea (there is a theme here – get it?). 

10. Always, always, always take advantage of two-part authentication when it is available. This is when you get a code sent via text or email or through an authenticator app when you log on to a site for the first time on a new device or browser. This is not foolproof. If someone has your phone, they might be able to use this to reset a password. However, if you receive a message with a code when you haven’t logged in to that website, you know someone else is trying to. 

The scammers are getting more and more clever and devious, as I have written about before. We have to help each other stay safe and protected! While a warning that you have a compromised password may or may not be true, we all could improve our password security. Be safe out there! 

Reading for Treasure: Protecting Your Information and Privacy

Reading for Treasure is my list of articles (and other readings) that are worth your attention. Click here for an introduction.

Once again, here are some articles to keep you safe as you use your technology. Specifically, how to thwart being tracked or scammed by devices, websites, advertisers, and others. 

This video from CNN includes a password tip that is genius and I have never heard of before. I am not going to list it here, but listen for the word “salt” in the video: "Here's how to keep your passwords safe, according to a hacker.” 

Wired provided a simple and common sense list of “6 Things You Need to Do to Prevent Getting Hacked.” Read the article, but I’ll list them here: Use multifactor authentication, get a password manager, learn how to spot a phishing attack, update everything, encrypt everything, and wipe your digital footprint. If any of those terms are foreign to you, take it as a sign you need this article. 

A great compliment to the above article, Propublica’s article, “A Former Hacker’s Guide to Boosting Your Online Security.” provides a straight forward and simple list of ten things to preventing stolen data, identity theft, and other online hazards. Again, I’ll list them here, but read the article for more: stop reusing passwords, delete unused accounts, use multifactor authentication, manage your privacy settings, think before you click, keep your software up to date, limit what you’re sharing online, security your SIM, freeze your credit reports, and back up your data! 

Lifehacker is also a great source for digital safety. Here a short and simple article that lets you know “How to Tell Which Apps Can See Your Private iPhone Data.” It is an older article, but still worth reading. 

This somewhat scary article from The Conversation via Inverse is a good overview of how your use of technology may put your privacy at risk: “Here’s exactly how tech companies and apps conspire to track you 24/7.”

Yes, emails can snitch on you. Many emails report back to their senders if you opened them, when you opened them, and even for how long you engaged with them. Want to stop this? Read this article from Wired: “How to Tell Which Emails Quietly Track You.” If you use Apple devices, this Lifehacker article, “How to Stop Email Trackers on Your iPhone, iPad, and Mac” will help you with this issue and more. 

A new form of hacking is to use free USB charging stations. Apple Insider discusses, “What juicejacking and trustjacking are, and how to protect yourself.” The basic piece of advice here is, if your phone asks you “Do you trust this computer?” or “Allow this device to access.. and you are not connected to your home computer, say, NO! 

How many of us have lost our phones or have had our phones stolen?  We may feel safe because our phone is locked with a passcode, fingerprint, or our face. Lifehacker says, “Your iPhone Is Still Vulnerable When It Is Locked” and then helps you secure it! 

And it is worse than that: Lifehacker provides instructions on how to use screen time on the iPhone to prevent a stolen phone from becoming a stolen Apple account or worse: "How Screen Time Can Save You When Your iPhone is Stolen." 

I am currently reading The Paper Menagerie and Other Stories by Ken Liu

Scram Scam: Some Guidelines to Prevent Scammers From Tricking You!

As we prepare to return to school, we must remember not to let down our guard and be duped by unscrupulous cons. There are too many people trying to take advantage of our trust and goodwill. Here are a few guidelines to help you from becoming another victim:

Email:

This article on Apple World Today cites Verizon research stating that 30% of emails designed to trick you (called phish emails) are opened! The article goes on to make several good suggestions about spotting a phish email. Here are a few suggestions to avoid email scams:

Don’t click on links in emails: This is how scammers trick you. The typical phish email appears to come from your bank and says that your account is frozen (or some other terrible thing) and you need to re-enter your password. The email looks like it comes from your bank and, when you click the link, the website looks like your bank’s website. But it is not! When you enter your information, it gives you an error message because, of course, it is not the real website. You have just given the bad folks your bank user name and password. Recently, scammers have used compromised email addresses to send phish emails. So it may be that the email appears to come from someone you know! No matter who sent the email, don’t click on the links – period!

Contact the sender – not through the email: If the email appears to be from your bank, don’t click on it, call your bank using the number on your debit or credit card or on your statements. If the email says there is a problem with your Apple ID, go to Apple.com on your own and log in or call Apple on the phone. This rule will also apply to phone scammers (which we will discuss shortly). If the sender of the email is a friend, call them. Replying to a scam email from a friend will only tell the scammer that you read the email. If you have a second email for your friend, try it or contact them through social media. If my email was hacked, I would like to know about it. 

Look at the sender’s email address closely: As the article linked above states, often phish emails look like they come from sources you trust. Your email has a name associated with it. If I send you an email, you won’t see the actual address, you will see my name. If you click on or hover over my name, you will see the actual address from which I sent the email. If I receive an email from American Express, I would expect that the sender has an American Express email. The label may say American Express, but if I go to the “sent from” line and look at the email, and it says something else, it is probably a phish.

Web:

Scammers can get you through more than email. This BottomLine article talks about how the scammers might trick us by creating websites that are one letter away from the sites we are trying to reach. The example in the article is that you type Netflix.co and forget to add the last letter. This reaches a website that looks like Netflix, but is, in fact, a way to harvest your Netflix password!

Examine the URL: Just as you examine the email address, look at the web address (called a URL = Universal Resource Locator) and make sure that it matches the site you are trying to use. If I am trying to look at my Bank of American account, the website must be bankofamerica.com. Please note that the address has the “of” in it. I discovered that bankamerica.com is not a functioning web address – yet.

Make sure the site uses https: In front of the web address are the letters http, which stand for hypertext transfer protocol. That means you are looking at a regular website. However, a site that adds an S means that it is secure! Here is an article from Computerworld explaining why it is so important to make sure that any site on which you enter personal information has that S and is secure.

Don’t enter any personal information on any website if you are on a public network: If you are in a hotel or at a coffee shop or in a library, you are on public wifi. The network that you are using is not unlike the old party lines where everyone could hear everyone else talking. With the right technology, a person can see the activity on a public website. Don’t enter passwords, credit card numbers, or any personal information unless you are on a secure and private network either at your home or work place. This is also why some people are using encrypted virtual private networks to protect their information. Click here to read an article on VPNs.

Use resources like Web of Trust: There are browser extensions (apps that run in Chrome, Safari, Firefox or other browsers  - you aren’t still using Explorer, are you?) and give the browser additional functions. I like Web of Trust because it presents me with a green, yellow, or red circle indicating the safety of the website I am using. It will present me with an alert I have gone to a problematic or scammer website. Norton also lists ten signs that a shopping site is secure which could be applied to any commercial website.  

Phone:

Don’t answer phone calls from numbers you don’t recognize: If the call is from a legitimate source, they will most likely leave you a voice message or contact you another way. If you are concerned you have missed an important call, call the number you have rather than the number that called you. Recently, scammers have made their number look like your number, so it appears to be coming from a local source. Don’t be tricked: an unknown number is unknown even if it has the same exchange or appears to come from your town.

Don’t talk to strangers on the phone: One scam worked this way: when a person picked up the scam call, the scammer would immediately ask, “Can you hear me?” When the person answered, “Yes,” their response was recorded and could be used elsewhere! If you pick up the phone, perhaps thinking it is from a legitimate caller, and discover it is from an unsolicited source – hang up! If the source says they are the IRS or your bank, hang up and call that source using a number you have used in the past successfully.

Don’t give personal information over the phone: Don’t provide your credit card, social security number, or other personal information over the phone unless you have made the call yourself and are 110% sure you are really talking to Ticketmaster, your bank, or your grandchild. If someone claiming to be from your electric company calls and says they need your bank account number, tell them you will call them back – and then use the number on your bill! 

Other Thoughts:

If you have any doubt at all, assume it is a scam: While I’d like to think the best about people, scammers are very good at tricking us. The latest scam sent an email that included a link that, when clicked, opened a Google drive window and asked the victim to sign in to allow an app access to their account. It not only looked real, it was the real Google sign in. The trick was that the scammer’s link (thus the “don’t click on links” rule) connected the victim to the scammer’s app! It tricked professionals! However, a little more care and the simple rule of don’t click on links in email could have saved them! Trust your gut reaction and err on the side of caution.

Go slowly and double or triple check: If your grandchild, niece, or neighbor calls and says that they are stuck in a foreign country without money, check with other people (like their families) before giving the caller your information. Scammers make things seem like an emergency and that, if you don’t act immediately, horrible things will happen. Horrible things will happen if you rush and act too quickly.

Travel Scams: Here is a fantastic infographic listing forty travel scams and the countries in which they have been reported. It is worth a look before you go on a trip.

Use strong passwords and two part authentication: I have written about ways to prevent your accounts from being hacked using better passwords, password vaults, and making your logins to important accounts harder to hack.

If you believe you have fallen for a scam and given away your information, you need to notify the appropriate authorities as soon as you can. Lifewire has a good article telling you some first steps to take if you have fallen for a scam. Your local police department is where you would report any sort of crime. Here is a link to the FTC’s scam alert page. It is a good place to look if you are wondering, “might this be a scam?” With a little knowledge, hopefully, we can stop the scammers from succeeding!

Seven Simple Shortcuts I Really Use

Recently, I have seen several videos and articles on “life hacks,” quick tricks that make life a little easier. Here are seven that I actually use:

Get your lost smart phone back: If you use a pass code (as you should) to lock your smart phone, how will someone be able to return your phone to you? It is simple: put a “If lost, please call…” number on the lock screen. Of course, this number should not be the cell phone number! I use my work number. You can make this in any program and take a screen shot of it. I made mine in Word.

Get your flash drive back: I name my flash drives with my phone number. I also have an “If Found, Please Open” document on each one that lists both my email and phone number. This way, I help a good Samaritan find me without going through all the files on the drive.

Get your luggage back: In every checked (or carried-on) suitcase, I place a piece of paper at the top. If someone opens my bag, that person will see a note with my contact information and itinerary. Just to help my bag get to the correct destination, I put the airport code on a piece of tape on my luggage. My luggage is also marked with large orange H’s as well. It is very easy to spot and cannot be mistaken for someone else’s bag.

Stop annoying cell phone calls: My default ringtone on my smart phone is silent. I assign individual ringtones to my family and close friends who call frequently. I have a standard ringtone I assign to most other numbers. However, if I get a call from an unknown number or someone who has never called before, the phone doesn’t ring at all. I don’t even notice spam calls- and when I see I’ve missed an unknown call, I block that number.

Easy closet origination that shows you which clothes you really wear: When I put my laundry back in the closet, I put the hanger in backwards. This way, it is obvious which clothes I have worn recently. Each summer, I take out the items that are still hung on forward facing hangers. These are the clothes to give away because I have not worn them since my last closet clean out.

Thin your wallet and have more at your fingertips: Rather than stuffing my wallet full of loyalty, insurance, and other cards, I photograph or scan them and keep them in my smart phone. Yes, there are apps that do this, but this is far more simple. Most of these cards I use infrequently. Rather than having them make my wallet bulky, I create a photo album and store them there.

Good passwords you can remember: I have two types of passwords: those I need to have in my head and all the others. I let my password manager program (I use 1Password) create long and random passwords for any websites that I use only on my home computer. For the rest, I recommend creating a long and unique password using the first letters (or suitable replacements) for a phrase you know well. So, if I was going to use Hamlet’s famous speech, my password might be: 2BoN2b-TiT? I alternate capitals and replace words with numbers or symbols when I can. I often insert a special character somewhere in the password as well. I can remember this password and it is going to be much more difficult for someone to hack.

Do you have similar little life hack shortcuts? Post them in the comments!

Prevent the Hack Attack!

Been hacked lately? Received an email containing a strange link? Seen people tagged as shoes on Facebook? Friends stuck in a foreign country and need money? If you don’t take precautions, your accounts could be hacked.

Everyday, people lose control of important online accounts. There are three simple ways to prevent this: better passwords, a password manager, and a security system called two part authentication.

Better Passwords: The first step is to make your passwords harder to crack. Don’t make your password a simple word or phrase; the longer the password, the better; include numbers, capital letters, and punctuation marks; don’t use the same password for everything.

One way to make a stronger password is to base it on a phrase. For example, the first few lines of Browning’s famous poem:

“How do I love thee? Let me count the ways.
I love thee to the depth and breadth and height
My soul can reach,”

This can turn into a password by using the first letters of each word (or some version of them): “HdIlt?Lm123tw.Ilt2td&hMscr,”.

This is a much better password than any single or combination of words –and I will be able to remember it!

Password Managers: Remembering passwords is difficult, but there is a good tool to help you: a password manager program. These programs store all of your passwords securely. Instead of a list of your passwords in a text file or on a scrawled piece hidden under your keyboard, these programs collect and enter passwords in your browser, and even help you to create more complex passwords. So my password can be “eKHnqjnqJCL98bUwrF” because I don’t need to remember it. When I need to use it, my password manager will fill it in for me. I only need to remember the password to that program! I only need one password!

Two popular password manager programs are LassPass and 1Password. Both offer apps for your phones so you can have your passwords in your pocket.

Two Part Authentication: Beyond making your password more secure, the other precaution you should consider is two-part authentication. Two part authentication means that your password is only one part of logging into a site like Facebook, Google, or iCloud. The second part is a code sent to your phone.

Yes, this means revealing your cell phone number. While that may make you nervous, I have not encountered any problems with it and the benefit is additional online security.

After signing up for two-part authentication, the first time you sign back on to your account, you will be asked for your password. After you put it in, a code will be sent to your phone. After you enter the code, you will have access to your account. You don’t need to do this every time you log on. You can indicate that you want to authorize a computer and the system will remember it. However, when you are logging on using a friend’s machine or any other “foreign” computer, you do not click that box, and even if someone gets your password, your account is still safe.

In order to log into your account, a hacker needs your password and the code sent to your phone. A person might hack your password, but will not have your phone. If a hacker is trying to get into your account, you will get a text message with a code. Didn’t request one? You know what is going on: change that password, and stay ahead of the hacker!

Here are links that show you how to set up two-part authentication for Facebook, Google, and iCloud.

Better passwords and two-part authentication will make your accounts less vulnerable to hackers. They are not perfect of fool proof, but why not put secure locks on your valuables?