Password Hacking
Hacking passwords is as easy as 1-2-3, with a little social engineering. Let's say, you need to call a local tech company to come in to work on one of your PC's. Or, you bring your PC to a local company to have it 'cleaned', or 'fixed up', because it is acting 'weird'. Most people use the most simple of passwords that they can easily remember. The name of your pet, significant dates, etc. Obviously you should be more creative than this. On just about every web browser, there is an option to let that browser remember your password so it doesn't have to be entered every time you visit that site. Most people let that browser remember the password because it's 'convenient'. Here are a few simple rules to help..1) Change your passwords regularly, ideally every 90 days or LESS. How often have you heard this but don't do it? If you only have a home PC or laptop, and no one else ever touches it, you're relatively safe. Depending upon your browser habits, you might want to change it daily. If you know me and are reading this, you know what I mean.
So, you say, 'I can't remember that many passwords!'. I know, it sucks. If you have a safe, and I mean SAFE, way to write them down, do it. I don't recommend this, yet I do it. As the only place my passwords are 'stored' is on my USB drive, which in reality, is not the safest way either. When you put your USB drive to get them, if the PC is compromised, you could be screwed. I usually write the down on a note piece of paper until I can remember them, usually a few days, and then chuck that piece of paper on my bbq.
2) Windows IE and most browsers can store passwords. When you bring your PC to Best Buy's Geek Squad, they could get access to every password recently entered. Hence, if anyone ever has access to your PC, change them the day you get it back. In worst case scenarios, you won't even have access to your accounts because some schlep who worked on your PC already accessed all your accounts and changed them, but usually that is too obvious. They wait to see that you haven't changed them, and then do their damage.
3) NEVER (unless you completely trust them, which for hired techs should be NEVER) let some tech put a USB thumb drive into your PC (even if they are your BFF, change them!). This is only asking for trouble. They may say, 'Oh but I have to run some programs off my drive to help clean your PC'. Most every program they use is freely available for download on the internet (virus scanner, ad removals, etc). Letting them run a program from a thumb drive is a way of telling them 'run anything you want, even that password retrieval key', and you'll never know. They could even be downloading a password retrieval program from the internet. How can I be safe? Change them as soon as they leave the building is one way. Hopefully they aren't in their car with an aircard and a laptop already accessing your accounts!
4) Make any password you use complex. NEVER use anything that can be construed as a word, date, etc., not even a reverse word combo! Make them upper case, lower case, with numbers, special characters, etc.. 2HA@4$!As, is a good one :) Just hit random keys! That way, no brute force password hack should ever get them.
For most, this sounds silly. Why do I have to protect myself? Why? Do you pay your bills online? Order from eBay? Email your friends? One day, you could find out that your account is dry, and every friend you knew got that picture of yourself that you took naked. Hey, I take pictures of myself naked and send them to my girlfriend. She likes that, and I don't mind if anyone sees my fat ass naked. But do I want them accessing my credit info? No fucking way. Base your password changes and security on what is important to you.
Always remember.. any data you enter on your PC or send over the internet is never completely safe. Quite frankly, everything you've ever done on your PC can be accessed with the right tools.
Scary? Yeah....