Black Star Radio

Data breaches happen eg Microsoft accidentally exposed 250 million customer support records a week or so ago, and early last year Facebook’s data breach exposed more than 540 million records

Sometimes this happens because of the big companies carelessness. Other times it’s really complicated – hackers that constantly trying to find new ways to get into these big sites so it’s a constant battle for them. It’s always a bit hard to tell exactly what happened and why.

It’s not always valuable data that is breached, but hackers can get some not-very-valuable data (there’s a thing called social hacking) where people get a little bit of data from you and then they gradually incrementally use that to get more and more data. So, it’s still dangerous. Some people say “I just use a weak password on a site that’s up with not much valuable data in it”. But that’s still a bad idea because hackers can use that to get a bit more and then a bit more and then a bit more so on.

The biggest, best thing you can do is to have some form of Password Manager. Some of the antivirus software packages have them. There are some standalone ones which I tend to recommend. I use one called RoboForm.
There’s another one that’s probably more popular called LastPass. Now, both of these, they do exactly what they say: they manage your passwords.

Now, the thing with passwords if you can remember it, by definition almost, it’s not secure. And if it’s secure, by definition, almost you can’t remember it. So, it’s a real catch 22 with passwords. So with a password manager, you remember one big long passphrase which is what the security blogs call it out, not password passphrase, and you pick a sort of a nonsense phrase that really stays with you, one that you can you know you’ll remember. Like I use a variation of a nonsense rhyme that I loved when I was a kid, which was “and grandma rides a bike”. And at the time, the idea of my grandma riding a bike was pretty hilarious. It’s just happened to stuck in my mind over life so I use versions of that. But anything that’s, that’s a bit nonsense but has meaning for you is a good passphrase to use.

And you just give you a password manager that one passphrase and that’s the only password you ever remember from now on, you don’t care about the others, because the password manager looks after all of that for you. It’s a little bit of work setting up because obviously you have to change your passwords in all your sites that use passwords in and tell your password manager, but once it’s set up it’s actually quicker and easier to log into a site by your password manager than it is to type it in or, you know, especially if you’ve got a few and you can’t remember which one you’ve done in your top two or three passwords in.

The next best thing to use, in conjunction with a password manager, which Facebook does actually allow to do, is two-factor authentication. Now two-factor authentication means you use two different things to get into a website. The best example of 2-factor-authentication is when you have a hole in the wall bank. You put your card in, which you own, and then you put your pin in, which you know. So, it needs both those things for work.

And on most websites, you can activate two factor authentication. And the way it works on websites is you get an app on your phone, called authenticator apps. There’s one called Google Authenticator which I just happen to use. There are others, but Google Authenticator can be used on Android phones and on iPhones. And basically you connect up your site to that Google Authenticator and then it generates a new six-digit code every 30 seconds. So you log into your site, the site will say, what’s your six-digit code, you look at your phone, you type it in and then you enter your site now.

So, a lot most of the big companies are now trying to get you to do it because they realise it’s the safest way to go. So Password Manager by itself is like 70% safety. The two-factor-authentication gives you as close to 100% as you can be at this moment in time. That’s the best practice security you can do to protect your digital life.

Check if you have an account that has been compromised in a data breach here
https://haveibeenpwned.com/

Hi. Today we’re going to talk about spear phishing. Now I’m not talking about diving underwater and trying to catch fish with a spear. I’m talking about spear phishing spelt with a P-H, so P-H-I-S-H-I-N-G. Spear-phishing spelt that way is an email-based scam targeted towards a specific individual or organization. Microsoft report that spear-phishing attacks have doubled in the last year. Now having said that, I should point out that most spear-phishing attacks are aimed at larger businesses and larger organizations because they are really, really targeted and they take a lot of time to get working. But they’re still important to know about.

An example, a basic example of a spear-phishing attack, would be, say, for instance, a job that has been advertised in a large company. The HR person gets an email with all the correct details from a prospective job client. HR opens the resume, which then infects their computer. That’s sort of an example of that.

I bring this up because spear phishing is the highly targeted version of phishing, which is the more common type of attack. These are the ones that you’re likely to get attacked by. An example would be PayPal sends you an email asking you to verify account details by clicking a link, which then can install malware on your computer. The link might say, “Login into this site,” which is a fake site. Then they’ve got your login and your password.

There’s a couple of things you can do about that because a lot of those are quite sneakily done. One is to install two-factor authentication. Microsoft says that two-factor authentication stops 99.9% of automated attacks on your system. That’s number one big one.

Also, a password manager. Say, for instance, fake PayPal has sent you an email requesting you verify your account. You click on the link, you login into a site which looks exactly like PayPal. You don’t notice this: it’s actually spelled P-A-Y-P-A-1.com. So it looks very close to PayPal, and they spoof the site up to look exactly like PayPal. If you go to log in to this fake PayPal account, your password manager, which normally would offer to put your login and your password in, it won’t come up because it doesn’t recognize that as your legitimate site for that instance. There’s sometimes when it is the right one, but at least you can have a look and you can get suspicious.

The other thing is, because a lot of these are automated, there may be slight spelling or grammar mistakes, or just clumsy English. You know if something comes from PayPal or big banks or anyone like that, any big organization, they’re going to send you a well crafted, well written English email. They’ve got paid professionals to make sure the emails come out and look professional. If it’s not the usual level of professionality that you expect from that company, the next thing to do is just roll your mouse over where the link is and you’ll see down the bottom left corner of your browser, it’ll tell you the real link. If you roll over something that says, “Click here to verify your account,” and it’s purportedly from PayPal, then if you look down at that bottom actual URL, the actual web address, it might say abracadabra.com or whatever. Then you know, no, just don’t go there. Just delete the email.

Also, you can enter a fake password first when you login into the site that you’ve been sent by this email. If it’s fake, it will accept your password, if real it will give you an error.

The final thing to do is, if you suspect an email, say a fake one from PayPal. Well, PayPal is not a very good example because they don’t answer their phones, but from a bank or somewhere like that, just ring the bank or ring the organization and ask them. They’ll be really pleased that you’ve rung them because they want to know what phishing emails are about. They’ll almost always tell you if your email is a scam or not. That’s the best thing to do. Even with PayPal, send them an email, unless they’ve changed their policies and they do talk to you now, but they never used to. All right, thank you very much and goodbye.

Black Star Radio talk Aug 23rd 2019 (transcript)

I think most of us have heard of the term VPN and often we don’t really know what it is, or we’ve got a bit of a wrong idea about what it can do. What it actually stands for is, Virtual Private Network and what it does is, it encrypts your data going from your computer to a website.

So say you were filling in a form on a website, which would probably have your name, your address, maybe date of birth, and a few other quite interesting bits of information. Once it gets to the website, as long as the website is a secure website with HTTPS on it, or the little lock you see in your browser window, that means that the data inside the website is encrypted and pretty safe.

But the data that you send to the website, the time that it goes from your computer to that website, often that’s not encrypted, especially in an open wifi system where you’re in a hotel say, or in a cafe, or something like that. Then theoretically someone can grab your data as it’s going to that website, and steal it, and then use it for nefarious purposes. So it’s quite a handy thing to have.

Anonymity – No

Some people think using a VPN makes you anonymous and it doesn’t really. It hides some things that you’re doing, but it doesn’t actually totally make you anonymous. So if you’re looking for anonymity, don’t use a VPN. The best way to think about it is just an extra layer of security. So in our modern world, we have layers of security with what we do in our modern digital world. And a good analogy is, it’s like having curtains on a house. It stops people seeing what’s inside your house, the contents of the house, even though the house is in full view on the street. So that’s a really good analogy and a good way to think about it.

Now another reason to do it is, Australian law now says that ISPs have to collect all sorts of data, what they call the metadata. So what that is, they don’t collect your individual places where you go, but they do collect your name, your address, your date of birth, your email address, your billing details, and a lot of other information with your account, the time and date, and duration of any of your communications, the type, whether it’s phone, text, social media, email, or whatever, and the destination of where you’re going, and your IP address. And that’s available to the government if they need it.

So if you’re upset with that amount of federal government knowledge of what you’re doing, then a VPN can hide a lot of that information. It’s never going to hide everything. It’s still a really good idea to have. And one of the other things it does is, some of the streaming videos sites, for instance, the geo-block you, depending on what country you are in. So with a VPN, you can bypass that if you want to.

Netflix

But there are companies like Netflix who, if they see you’ve got a VPN, they don’t let you in at all. They’ve bypassed you trying to bypass their geo-blocking things. But it’s still quite important these days to actually have one. And particularly if you’re in an open wifi system where there’s no password, then your data is really up for grabs as you go up and down from websites.

One of the things you should be aware of is there’re plenty of free VPNs, but someone once said that if you don’t pay for a product, then you are the product. And I think that’s especially relevant in today’s internet world. So if a VPN company doesn’t make money from charging you for your VPN, it’s got to make money somehow, which is fair enough. It’s got to make money and it’ll make money either from ads, or selling your data. And the whole reason of a VPN is that you don’t want people to see your data. So this is an instance where free is not good, and it’s not really free.

Why it’s worthwhile using a VPN.

a) It’s worthwhile having it.
b) It’s worthwhile just going to Google typing in, ‘VPN Australia’ and then you’ll get plenty of reviews of good VPNs, and what people think of them, which is the more important thing. And all of them have got different prices, and different pros and cons. So you’ll find comparison sites that look through all of them and that’s a really good way to go. And I really still do highly recommend having a VPN for all of those reasons I’ve just talked about.

I use a product called Speedify They describe themselves: “Speedify is a revolutionary channel bonding VPN that combines Wi-Fi and Cellular (and more!) to create a faster, more reliable, and secure connection.”

I use Speedify mainly for combining internet connections but I keep the VPN on because of the reasons I’ve described above.

You should keep ALL your data in the cloud! I repeat, put your data in cloud storage – very important.

Why?

One very good reason is that’s it’s safe there. If you lose laptops and external hard drives, or they get stolen or break down, they can be replaced (bloody annoying but not catastrophic); if you lose all the docs, photos, files ie all your data then that can be catastrophic. Put your data in cloud storage.

Here is a good example of this:

None of the principal cloud storage companies (eg Google, Dropbox, Amazon, iCloud) have ever (to my knowledge) had a major hack. Icloud was reported to have been hacked but that was actually a password hack which is a very different animal. A point here to remember is that Password Managers and 2-Factor Authentication (use password october) are essential!

And the major cloud storage companies encrypt your data so even if the data centres are hacked, then your data has to be un-encrypted before it’s of any use to anyone. Their encryption is the best that is available too.

Most of them keep your data in multiple data centres, so in the event of a breakdown or failure of one data centre, your data is safe in another one.

Basically they have the best engineers and technology in the world, so are far safer than your laptop or external hard drive. Their job is to keep your data safe and they are world-best at doing that.

Having said all of the above, it still is a good idea to have external hard drive local backups.

So, what about emails? I recommend using a cloud-based email provider like Gmail, Mac Mail, or Outlook 360 (not the old Outlook). All of these give you storage space as well (a nice bonus).

There are two other main advantages of cloud storage:

1. you can access your data on all your devices – your laptop, smartphone and tablet.
2. collaboration is easier and less time-consuming

Finally – photos on your smartphone – most people have thousands of photos! Both Android and iPhones have the ability to do auto backups to their respective clouds of all your photos.

This has two major advantages:

1. Frees up space on your phone
2. Keeps your photos safe if you lose your phone, or it fails, or gets stolen.

Set up and use iCloud Photos

Setup and use Google Photos 

Google Photos is currently the better option for a whole lot of reasons (for both iPhone and Android)