Online security and password management

This post is a bit off topic from what I usually write about. I want to take look at a something that is increasingly becoming an issue - being secure online. The internet is an essential utility that one cannot avoid. As such it’s more important than ever to have good security hygiene.

Background

Wired journalist Mat Honan was recently hacked hard. Hackers gained access to his Apple iCloud, Twitter and Google accounts. They posted some vile comments via his Twitter, deleted his Google account, and wiped his iPhone, iPad and MacBook Air. His MacBook air was the only place he had more than a year’s worth of photos, covering the entire lifespan of his daughter. (He's since recovered his data, at a cost of about $1500.) Really, he was lucky in that they did this for the “lulz”, not to gain access to a bank account or steal his identity.

There is no such thing as perfect security when online, but you can take steps to be more secure. Before looking at solutions, let's consider the issues.

Authenticating yourself involves providing evidence that you are you. You can prove who you are through:

• something you are (e.g. a finger print)
• something you know (e.g. a password)
• something you have (e.g. a mobile phone).

Logging on to a website generally uses "something you know" - a password. The problem with this is that this is inherently insecure. If a hacker gains access to your password - game over.

I've spent a fair bit of time getting secure as reasonable. The main ways of doing this are:

1. Using strong passwords
2. Two factor authentication

This post will take you through some apps that make it easy to do this with hopefully not too much effort. It is more effort than not being secure, but much less effort than trying to recover a destroyed digital life, or worse, a stolen identity.

What to not do

Most people use terrible passwords. The most common passwords are:

1. password
2. 123456
3. 12345678
4. 1234
5. qwerty
6. 12345
7. dragon
8. pussy
9. baseball
10. football
11. letmein
12. monkey
13. 696969
14. abc123
15. mustang
16. michael
17. shadow
18. master
19. jennifer
20. 111111
21. 2000
22. jordan
23. superman
24. harley
25. 1234567

If one of yours is here... sheesh. (And one assumes number 8 is referring to the popular house pet.)

Some basics of things you shouldn't do. Do not use:

• personal information in your password that someone could work out
• dictionary words, or geographical or biographical names
• a password that is the same as your account information.

If you think you're okay because you use an "un-guessable" password of your own, think again. If your password isn't actually random, then it's getting worse over time. Every time a password database is leaked, hackers get a better idea of the patterns that people use, as this great article explains. Other points:

• The average Web user maintains 25 separate accounts but uses just 6.5 passwords to protect them.
• In the past year alone more than 100 million passwords have been published online.
• 8.2 billion average passwords combinations per second are able to be tried by a PC running a single AMD Radeon HD7970 GPU.

Passwords people think are secure follow patterns that hackers have cracked. E.g:

• Adding numbers or non-alphanumeric characters such as "!!!" to them, usually at the end, but sometimes at the beginning.
• "Mangling" — transforming words such as "super" or "princess" into "sup34" and "prince$$".
• Mirror imaging — "book" becomes "bookkoob" and "password" becomes "passworddrowssap".
• Appending a date of birth or similar to a name — Julia1984.

The bottom line is you're not really that clever or original. Any pattern you thought of using, someone else has probably thought of using it too, and at some stage a password database leak has enabled hackers to add that pattern to the lists of passwords they cycle through.

How to create a strong password

The fundamentals of making a password strong are:

1. A bigger set of characters: numbers only (10 characters), numbers + lowercase + uppercase letters (10 + 26 + 26 = 62 characters), all the characters on your keyboard (92).
2. The longer the better. Longer means exponentially more possible combinations an attacker has to try. A four character password would take about 0.0004 seconds to crack. A 10 character one would take about a year.
3. Increase entropy. Use random characters for your passwords.

Digital note taking

Since about 2003 when I got my first PDA (remember these) I've gone all in on paperless (with the exception of proof reading and doing Maths). Mobile computing has been the key to me being organised and able to take legible notes. I've gone through many gadgets. With my iPad and Galaxy Nexus, I've never had it better when it comes to paperless productivity.

One of the most important uses I have for my iPad, phone and laptop is note taking. Depending on the situation, I'll use one or the other (sometimes two at the same time) to take notes in a meeting, or just when I'm out and about and have a thought I want to capture.

I've experimented with many different services and apps for note taking. Over time I've come up with the following criteria that I need in a note taking app:

• Platform agnostic: It's not locked in to any particular operating system and is available on any device I want to use. In my case, it needs be on iOS, Android and the web.
• Syncs to the cloud: If I make changes on one device it'll show up on another without any effort on my part.
• Data portable: It's my information so I should have complete control over it, and be able to leave the service easily.
• Simple (plain text - at most basic formatting): I've used note taking apps with a fair bit of formatting. What I've found is they tend to be slower and you end up spending too much time mucking about with the formatting. If I need a formatted document, I'll use a word processor or a markdown text editor.
• "Photo notes": Taking a photo of some information and having it in your notebook is really handy. In the last month I've taken photo notes for the following reasons:
  
  • where I parked at a multistory car park at the airport
  • my hotel room number
  • the odometer reading on a car for recording in a log book
  • record of receipts
  • whiteboard diagrams
  • someone else's hand written meeting notes (my favourite use...).
• "Voice notes": Sometimes you can't type a note. Just click the little microphone icon and speak the note.
• Fast: If you have to pause before capturing an idea, the idea might be gone before you're typing the note in the app. It's essential that whatever app you use, it's as fast as the main competitor - pen and paper.
• Searchable and easy to organise: Here's one thing that digital is indisputably better at than analogue - categorising and organising information. Search by keyword, tag, title, folder, date, the list goes on... Finding relevant notes is very simple and accurate.
• Reliable: All of the above is moot if you can't trust your note taking system. It shouldn't ever cause sync conflicts and you definitely do not ever want to lose a note.
• Looks good: This might seem somewhat trivial, but you're in the app using it all the time. If it's not decent looking the experience won't be enjoyable and you won't take as many notes. I can't stand the faux analogue Apple seems to employ (skeuomorphic design). I prefer my digital apps to look "authentically digital". Each to their own, but this is something to consider.

On reading the above, it should be pretty clear I don't use the default note app on my iPad.

The note taking app/service I use is Catch Notes. It fulfills all the above criteria. There are excellent apps for Android and iOS, and a web app too. It doesn't lock you in. They haven't yet implemented a way of exporting all your notes in one go, but it is in development. You can export them one at a time.

I can be taking notes in a meeting on my iPad, snap a picture of the whiteboard on my Galaxy Nexus, append the picture to the same note using Catch Notes on my phone, have that re-sync and the note on my iPad now includes the picture. I can then go back to my laptop and open up the Catch Notes web app, and have it all there. It's seamless.

Other note taking apps/services I've used and liked are Simple Note and Evernote:

• Simple Note is great for plain text. It's very quick to open, runs smoothly, the search function is excellent. Catch Notes I'd argue is just as fast and seamless in its syncing, but it also allows you to make audio notes and photo notes.
• Evernote also does images and audio. However, you can't have complete offline access to your notes on your mobile device with the Evernote free account. Being a cheapskate, I don't want to pay for my note taking solution. Catch Notes also has a paid plan, but you're fine on the free account unless you need to sync 70 MB a month or attach PDFs to a note. One thing Evernote has going for it over Catch is it will OCR images that you upload. I rarely need this, and on the occasion I do, I just use Google Googles.

There are a bunch of other note taking apps/services out there. Microsoft OneNote has a powerful set of features, is now cross-platform and syncs with SkyDrive. It's worth a look too.

My advice is to play around with a few of them for month or two before settling. There will be nuances in the different ways in which they work that won't be immediately obvious. Once you have found something that works, try to stick with it and not do what I've done over the last two years (change between about 6 different methods/apps/services).

iPhone - you get it or you don't

The following Samsung commercial takes the **** out of people who line up for iPhones and the like. I find it to be both highly amusing and true to life.

My favorite line: "I could never get a Samsung. I'm creative".

Last week well known Apple evangelist, and blogger at Daring Fireball, John Gruber provided a great example of special pleading when citing a quote in a review of the Samsung Galaxy Nexus in comparison to the iPhone 4S.

You either see it or you don’t. If you don’t, that’s cool, enjoy your Nexus. But I think the reason Apple Stores are so crowded, and getting so big, is that there are an awful lot of people who do see it.

An advocate generally reverts to special pleading when they have no other way of justifying their position. The beauty of special pleading as a rhetorical trick is it gives the opponent no room to maneuver. Gruber has argued that his opponents, Android users, cannot possibly comprehend the subtleties and beauty of Apple's iOS operating system. They are simply unable to attain the level of insight available to Gruber. "You either see it or you don't." He has a deep insight into and empathy with technology that cannot be evaluated by Android users who, by definition (they use Android), lack the capacity to make any valid judgement. How does one respond to that?

This excellent article at Gizmodo points out the irrationality of brand loyalty.

______________
(Note that I'm a happy iOS user - I wrote this on my iPad which I lined up to buy... For a full gadget disclosure, see my gdgt profile.)
Image source: http://commons.wikimedia.org/wiki/File:Gruber.jpg
Via The Verge: http://www.theverge.com/2011/12/15/2638611/horseshit