6 Quick tips to protect your passwords

I know, there are a bunch of posts and articles about this subject, why should you read this?
What if I give you 1,131,000,866 reasons? According to Kaspersky Labs, this is the whopping number of malicious attacks to computer and mobile devices registered in the first quarter of 2014. It's just about as big as the number of inhabitants of China.
The number of cyber attacks in 2013 involving financial malware increased to 28.4 million – an increase of 27.6% more than 2012.

 
In this post, I'll try to give you some quick and usable tip to protect your passwords and your information from the most recent security vulnerabilities (such as Heartbleed) to make your browsing experience safer and more enjoyable.

1. Use a password manager and don't store passwords on your local PC: If you use a web-based password manager such as LastPass, your password are stored on a web server and not on your local computer. After signing up for an account (you can choose a free or a premium one), you'll be asked if you want to securely delete your passwords from your local PC. After doing so, you can access your web accounts only by using LastPass. No password will be stored locally. Even though a hacker compromised your PC, he wouldn't retrieve any passwords in your cache. For more details, have a look at my previous post LastPass, strong passwords for the web.
2.  Create and use strong passwords and never use the same password for more than one account: according to the best practices, a good password is 8 to 15 characters long and utilizes combinations of uppercase, lowercase, alphanumeric and special characters (@, #, *, $, !, ^, &, etc.).  There are several conflicting opinions about how to build a good password. My hands-on suggestion is: create a password that's strong and meaningful to you at the same time. The best password should be a long combination of random non repeating characters but who could remember it? If you end up writing it down on a sticky note, any security policy is undermined. The best option is to make up a password compliant with these rules but easier to remember, because you can associate it to something meaningful to you (e.g. gun$moke!  is a strong password and you remember it because it makes sense. It's way better than 12345 or your first name, because is much more complex and much harder to crack). Don't use the same password for more than one account, because if a hacker cracks that password, he can gain access to most your information by tracking all of your accounts. I know, we're all damn lazy and we don't have time, but this is a tough game and bad guys aren't lazy when it comes down to steal your money, identity or personal information, so you've been warned.
3. Check the strength of your passwords with online tools: There are several online tools allowing to check if you're using strong passwords. This way you can replace or modify weak passwords making your browsing experience more secure. I suggest you to have a look at this page to give it a go: Password Checker : Using Strong Passwords | Microsoft ...
4.  Use a two-step verification (aka two-step authentication): It's been first implemented by Google and is now offered by most providers. You can setup your account to require both a password and a code (that your ISP will send to your mobile phone via SMS and changes any 30 seconds) to login. This way, even though a hacker compromises your account, he would need that code to access your data. Here for more details about Google accounts: Google 2- Step Verification
5.  Go biometrics: The best security implementation should be made up by something you have (password), something you are (retinas, fingerprint, facial recognition) and something you possess (smart card). If you have very valuable data stored on your computer and can afford it, or you're in a corporate environment, consider to use a biometric device, such as fingerprint reader, instead, or in addition to, a password. Before you start visualizing some creepy scenes from Minority Report, let me tell you that tricking these devices isn't that easy at all and cut up one of your fingers would be no use to a hacker. 
6.  Use BitLocker encryption (or FileVault, for OS X): especially if BitLocker is implemented by means of a chip on the motherboard (the so-called TPM chip or Trusted Platform Module chip) you need an encryption key to access the files. Even pulling the hard drive off the PC is no use without that. You can also encrypt a drive with BitLocker without the TPM chip, by storing the key on a USB drive. If so, you'll need to plug the pen drive in to successfully boot the PC. To implement this solution, you need to go to Control Panel/System & Security, click BitLocker Drive Encryption and then select the drive you want to encrypt and choose Turn On BitLocker.

   

   Click to enlarge

Click to enlarge

Wrap-up

There are several things you can do to protect your passwords and your information from the risk of losing money or being victim of an identity theft.

They require only some minute of your precious time.

These tips are very quick and effective and can save you worries and troubles. The list could go on forever, but these steps are straightforward and don't require a huge expertise.

It takes a minute to be a victim of a loss of data or identity theft, but its consequences can be long-lasting.

Taking action now can save yourself and our country from catastrophic damages.