all your passwords belong to us!!

Three articles of recent release from Wired Magazine by journalist Mat Honan offer yet another peek into the underworld of 3733t h4x0r and the realistic perspective that even strong passwords are insufficient in a world of hyperconnectedness where people project their lives online and into the cloud.

Why your passwords and even your RSA key is probably insufficient security when people remain our weakest link

A glimpse into the life of the fallen 15 year old king of social engineering


How Mat Honan got hacked, followed by a number of other tech journalists

So here’s the question, how secure are you really? Those of you who work in DOD or have security clearances probably can speak to three, four, and five factor security and will state that the only secure device is one that isn’t connected to the outside world, period, and lives inside a faraday cage with all kinds of other active security countermeasures in place.

In the commercial world where we have mortgages, bank accounts, email addresses, social security numbers and social presences, our lives are infinitely less secure than the average person believes. I can find out everything I need to know about you in about an hour in order to hack most of your accounts and if I’m a good social engineer, what I don’t have I can get out of even a bright support drone sitting in India with a brief conversation on the phone.

The most secure environment you have is probably your credit card account where you bank is using multi factor behavioral analysis to identify risk behaviors that run outside the norm for your usual credit activities. Eventually this will have to be the direction necessary to ensure actual protection - or will it? Ultimately your primary protection is that no one is currently interested in hacking your life. You’re too boring and not worth enough to be bothered.

What security measures do you enact to protect yourself?

These articles bring up a lot of great points, but not all 100% true IMO. Strong passwords can be safe, its just about being smart in regards to means in which you setup the recovery options. Granted half of that falls on the companies ability to have the procedures and properly trained staff to better handle a direct phone call or e-mail rather than simply resetting a password with just a few bits of information anyone can get on google.

Doesnt matter if its a password, a biometric scanner or whatever, for the time being recovery options will be kept in place that will allow a user to reset their password, bypassing having to put in the password they forgot or whatever the security measure may be.

Do away with call centers and e-mail reps resetting user passwords, and advise users to put bullshit answer in the password recovery option fields.

A few of my accounts if I ever forgot a password I woudl be fucked, theres a couple that when they ask for a security question i just slam around on the keybaord.