Switchers' Blog

Lifehacker: "Your Passwords Aren't As Secure As You Think; Here's How to Fix That"

Lifehacker's "The How-To Geek" wrote a reality check about password security in the 21st century, and the summarized thesis is that things are still not great. The blogger points out some pitfalls of modern security implementations, including the fact that Pidgin, a popular open-source, multi-protocol chat client, stores account passwords on the drive in plain text. Egad.

The How-To Geek arrives at the ultimate conclusion that: 

The only truly secure way to store your passwords is to use a password manager to securely track your passwords, combined with a a great master password to protect the rest of your saved passwords.

A link to a previous Lifehacker post, Five Best Password, Managers, offers some great recommendations for taking your online security up a notch, including 1Password.

We're always grateful to get a mention from a great publication like Lifehacker. But it's also good to hear a call to both developers and users to take security more seriously.

Hotmail breach exposes all-too-common passwords

Have you reset your password recently? If you use a password that is anything like the 10,000 that were just stolen and leaked from Hotmail users, you might want to.

As the story goes, an anonymous user published a list of over 10,000 stolen passwords from Hotmail users. Researchers and security firms like Acunetix immediately pounced on the opportunity to study the password habits of this sizable sample of common users.

Want to know what the most frequently used password on the list is? "123456." How about the second-most used? "123456789." Other popular passwords are spanish names like "alberto," phrases like "iloveyou," as well as even "000000" and "america."

Now this may come as a shock to you, but we're fans of using passwords that are just a tad more complex. Common words and simple number schemes are pretty easy for password cracking tools to sniff out these days, which is why we're pretty proud of one of our most popular 1Password features: the Strong Password Generator. This powerful tool creates extremely secure passwords for you, like "1LdcHo2

Revisiting how to respond to a data breach

Earlier this month, freelance hiring service Elance suffered a data breach. Announced on the company's blog, hackers obtained the contact information of registered users like name, email address, telephone number, and city. Login information was also stolen, though Elance says that passwords were protected with encryption.

No other account information, such as credit card numbers or bank accounts, was stolen in this breach.

Elance says that it is taking a "drop everything" approach to this breach, and it has already implemented a number of steps to protect the data of both the company and its users. Besides fixing the hole and communicating with affected users, the company is also requiring that all users reset their passwords according to new, more stringent requirements. Naturally, we are fans of this fundamental recourse to a data breach. We recommend that all Elance users sign in at their earliest convenience to perform this simple, effective process.

How 1Password Can Help

Of course, 1Password makes it orders of magnitude easier to minimize your exposure in situations like this. If you use 1Password to generate your passwords, you have very little cause to worry about duplicate passwords and your risk is mitigated.

If you have entries in 1Password that do use the same password, you can search for entries that have that password and then change them accordingly.

1. Launch 1Password
2. Enter your master password to unlock your keychain (if necessary).
3. Click the magnifying glass in the search field and choose "Search in Password."
4. Enter the password in the search field.

This will reveal all the entries with that password.

1Password Workflow for Changing Passwords

1. Select a login and choose File > Go and Fill Login (cmd+return) from the menu to go to the site and login.
2. Navigate to the change password page.
3. Right click the password field and choose "Strong Password Generator" to generate a new password.
4. Click "Fill" and then submit your password change.
5. 1Password will attempt to recognize that you are changing your password and offer to update the login's password for you. If it does not, you can find the generated password in the Password History section of 1Password and update the login manually.

Repeat this procedure for each login that you need to change.

David Chartier
Chief Media Producer, Agile Web Solutions

1Password touch, encryption, and iPhone

As you may have heard by now, the new iPhone 3GS features hardware encryption for protecting data on the device. Apple is touting this feature as part of a new Enterprise-ready push for the device.

As you may also have heard from this Wired story, an iPhone developer, hacker, and professor named Jonathan Zdziarski called this encryption "useless" for businesses. Zdziarski says that Apple's decision to store the encryption key on the device alongside the very data it is protecting is "like storing all your secret messages right next to the secret decoder ring."

Understandably, we have received a few support requests about what this means to 1Password and the security of our customer's data. Fortunately, it doesn't mean much of anything.

Let me explain.

1Password for iPhone and iPod touch (and Mac, for that matter) encrypts all of your information with your Master Password. We use secure, 128-bit AES encryption (outlined in greater detail in this support document) to protect your 1Password database. While we do use the standard, hardware-accelerated encryption frameworks included in the iPhone OS, your Master Password is never stored on the device alongside your data.

In other words, if a thief were to steal your iPhone and use the tools outlined in Wired's article to copy everything off of it, your 1Password information would still be safe; as long as you don't commit a security faux pas and use a very short and simple Master Password like "b0b". The Master Password is (ideally) stored only in your head, locked away from inquiring thieves—just like your 1Password data.

David Chartier
Chief Media Producer, Agile Web Solutions

How to Respond to Data Breaches

Recently, Monster.com had customer information stolen from its database including usernames, passwords, phone numbers, email addresses, birth dates, and certain demographic data, according to a report published by ZDNet.

Following a breach like this, it is important to change your password not only at the breached site, Monster.com in this case, but also for any other site for which you use the same password. Many computer users use the same password or handful of passwords for all their Internet accounts. Imagine if you used the same email address and password for Monster.com that you use for eBay or Paypal. It's not a huge leap for a bad guy to try the same password you use one place on another site that might have even more attractive information.

So, if you have an account at Monster.com or any other site that has its data (really *your* data) compromised, be sure to be vigilant about changing your passwords and considering how far the damage might spread if a bad guy were to go exploring.

Bonus: How 1Password Can Help

Of course, 1Password makes it orders of magnitude easier to minimize your exposure in situations like this. If you use 1Password to generate your passwords, you have very little cause to worry about duplicate passwords and your risk is mitigated.

If you have entries in 1Password that do use the same password, you can search for entries that have that password and then change them accordingly.

1. Launch 1Password
2. Enter your master password to unlock your keychain (if necessary).
3. Click the magnifying glass in the search field and choose "Search in Password."
4. Enter the password in the search field.

This will reveal all the entries with that password.

1Password Workflow for Changing Passwords

• Select a login and choose File > Go and Fill Login (cmd+return) from the menu to go to the site and login.
• Navigate to the change password page.
• Right click the password field and choose "Strong Password Generator" to generate a new password. 
• Click "Fill" and then submit your password change. 1Password will attempt to recognize that you are changing your password and offer to update the login's password for you. If it does not, you can find the generated password in the Password History section of 1Password and update the login manually. 
• Repeat this procedure for each login that you need to change.

Your 1Password Master Password and You

Installing 1Password for the very first time involves creating the initial master password (you can change it later if you desire). This password is used to unlock the 1Password keychain and access all your data contained within 1Password. Without this password, no one can access your 1Password data when the 1Password keychain is locked. Obviously, this is the one password you will need to remember and is the reason that the program is named 1Password. I want to address a couple of issues that arise from time to time regarding the master password.

1. There is no way to recover a lost or forgotten master password so choose wisely

Leopard Code Signing and Keychain Problems

OS X 10.5 Leopard brings a new Code Signing security feature that helps verify the integrity of an application. Applications are signed by their creators before being distributed using their private key, and then can be verified on the customer's machine using the companies public key.

The OS X Keychain Services leverage this new Code Signing feature to verify the signature of each application before it will allow access to the contents of the keychain. By verifying the signature, the OS X Keychain Services can detect when a potentially malicious change has been made to an application and thereby protect your sensitive data by denying the changed application access.

Since the upgrade to Leopard, many 1Password users have written in to mention that they cannot access their data, usually from within Safari. At first we were confused why the keychain data could not be accessed from within Safari, yet it was accessible from other browsers and the 1Password application.

iPhone Password Manager

Since before the iPhone was released, passionate 1Password users have been begging us to support it. As Canadians we couldn't even get one, so Roustem and I travelled to Chicago to purchase a few for development.

After several grueling weeks, we are proud to announce that 1Password 2.5 sports a new icon on its toolbar!

Sync to iPhone will export all your 1Password data to an encrypted Safari Bookmarklet, which can then be used on the iPhone (or iPod Touch) to access all your information. Of course everything is encrypted with some seriously strong cryptography, namely 448-bit Blowfish with Cipher Block Chaning (CBC) and randomized salt.

Without further ado, let's see how this works!

Mac Phishing Protection in Action

I’ve been having fun with my new screencasting toys and have started making movies of my Mac password manager.

I decided to start with a video of how 1Passwd protects you from phishing attacks. I have made this claim before, and several people have questioned me exactly how a password manager can protect them from phishers. In fact, the majority of password managers cannot protect you. Any password manager that relies on you manually entering your information into a web page offers no protection whatsoever.