Blog Post

Getting Scammed Using Common Password

  • By Grant Watt
  • 07 Nov, 2018

What to do about a Common Password in possession of a hacker

I have seen a few customers panic and respond poorly to scams. In this blog article I will discuss passwords and in particular what to do if a hacker sends an email blackmailing you and is in possession of one of your passwords. One tactic hackers use is to look for poorly protected websites say for a hobby or forum and hack their password and user name lists. This is the basis for blackmailing you, saying you have been watching porn or whatever and that you will be exposed unless you pay say $3000 USD in bitcoin. This is where you should be thinking about whether you use the same password for everything because if you do, it can be a big worry. Chances are they don't know enough about you to do much. 

 If this happens delete the email, don't respond and change your important passwords right away, just in case and write them down. I also recently upped security for holding passwords to a program called LastPass. Yes, you have to pay for it, a few dollars per month but I decided to use a proper program this time rather than a password protected excel spreadsheet. It also made me realise it is kind of scary being blackmailed by some unknown hacker who has accessed your personal information. Every time you register for a website for a hobby or a forum or to be on their records, there is a risk that the website itself could be accessed by hackers. Often these are poorly protected websites run by hobbyists. 

I think most people use the same password too often and myself is included. This is dangerous as if the password is compromised, it can give access to too many parts of your life. It also means you don’t even know where the password was gotten from. It is impossible really to have the same passwords for everything and to rely on your memory, eventually important passwords need to be changed. Even a list of passwords written down or in a document and kept somewhere safe is sufficient. If you are travelling possibly a password manager isn’t a bad idea.  

A password manager like LastPass will also work on an Android or Apple phone as well as a PC or Mac and hence is available everywhere. Of course, you have to remember this password and so please write this one down for safekeeping somewhere. Password managers have two factor authentication which means no one can log in from a device that isn’t trusted without you giving them permission.

Two Factor Authentication has been covered in newsletters before but commonly Gmail, Microsoft (hotmail.com, live.com and outlook.com) have two factor authentication available if you wish to use it. It is important that you do but yes, it can be a bit more complex to set up initially. It means though that it is only possible to get hacked if the hacker knows your password and you give them permission. 

Backups are important if your computer actually gets attacked. If you lose your data because of hardware failure, $1500 might recover the data but if you download a malware email containing a crypto virus then you will lose data so backups and even multiple backups of important pictures and documents are always a good idea.

If you want more security including good quality security programs such as ESET or Kaspersky, I supply both and can help set up better security for you including backups.

I don't mind spending 5 - 10 minutes on the phone discussing issues with customers and giving advice but a call out is necessary obviously if you need some real help.

By Grant Watt 12 Feb, 2019
Suggestions on the best methods of email migration from Windows Live Mail which is no longer supported by Microsoft or available as a download.
By Grant Watt 13 Nov, 2018

I update my blog from time to time. Yes, scams, security even phones and tablets. These days most people have a mobile phone, a tablet and a computer. The computer for most people is here to stay whether a desktop, an AIO (all-in-one) or a Desktop. A desktop still gives the most options, the longest life and the best performance but a laptop has portability. If you need portability, then go the laptop but in terms of long-term costs of ownership it isn’t always the best choice. Older customers often want big screens and decent keyboards. Now while these can be plugged into a laptop, most people either don’t know how or can’t be bothered. Rest assured it can be done but often, for a home or business, the tablet or phone is used for portability and the computer is in the office.

I see people spending a lot of money, sometimes, on security packages you don’t need. If you are spending even $60 per year, it is probably too much. I am a reseller for both ESET and Kaspersky and ESET NOD32 is $104.90 with GST for three years which is reasonable, and it is a highly rated product. The ESET Internet Security is just $20 more and locks down your computer even more. I use NOD32 on my Desktop and Laptop as I sometimes find more security occasionally gets in the way but I think it is 50/50 for most customers on which product to use.

Scams, yes, don’t ever give out details of cards or your bank unless you are 110% certain of whom you are talking too. Banks are tightening up on covering people (not) who knowingly supply bank details to unknown parties by phone. PAYPAL is a good idea if you buy things a lot online as it never involves giving out your details, the seller signs up for PAYPAL (and are vetted by PAYPAL). This is my preferred option for payment. Of course we trust people we trust…and yes other parties do get my bank account number etc..

Multi-Factor Authentication. Everybody should use this really and it applies to a wide variety of services these days. Even your bank SMS to authorise a purchase is a type of secondary authentication. Gmail, Hotmail.com, outlook.com, Apple ID, Facebook all have the capacity to use multi-factor authentication. This means that someone with your Facebook user name and password can not get onto Facebook without you authorising it, ditto with the others such as Gmail.

I would also suggest people consider Gmail (especially if they have an Android phone) and Microsoft email (hotmail.com and outlook.com) for their email along with Multi-Factor Authentication. Why? Well for starters Telstra and iiNet don’t provide multi-factor authentication and what happens if you change companies? That’s right, dozens of changes to be made for banking, Facebook and other logins.

If you are a business or a person with a domain name e.g. www.perthpc.com.au then you can get Microsoft Exchange email services from iiNet or Microsoft and these are highly recommended for power and ease of use. Microsoft Exchange is the platinum standard for businesses and these days most businesses use iiNet or Microsoft to host the user emails and leave the security to the professionals. It is also very easy to set up on a phone or tablet or multiple computers without knowing complex configuration details. If you are interested let me know as initially some set up may be involved.

This brings me to password management. Yes, you know it is a bad idea having the same password for everything and using your birthdate as a pin to log into your phone. You probably do it anyway…😊?

It ultimately is a terrible idea as you may one day find out. For starters, which website or company got this user name (usually an email address) and password? If the answer is dozens then you have a lot of work to do, if they are important. If you use an easy pin to get into your phone and the crook has access to your birthdate, yes, they may get into your phone.

The good news is newer phones have either touch ID, Face ID or iris scan recognition which is often used in place of your PIN to get into sensitive sites such as banks or a password manager.

A Password Manager can be a piece of paper hidden somewhere. Believe it or not this may be the best option for many as it is all that they can manage, and it is infinitely better than using the same password for everything and much safer. Record carefully what each user name and password is for and if it changes then make sure your list is up to date.

Another option is a password protected Excel spreadsheet or even better a proper password manage such as LastPass. The password managers cost but are professional products and it means that all your passwords are accessible from wherever you are as they run on any computer, phone or tablet. These will always require multi-factor authentication, as they should. Two reasons not to get them is that they are cloud based (and people don’t trust something on the Cloud) and it is too hard. I get the second reason, I understand. I understand the first reason too but these companies go to extraordinary lengths to protect their data, so it is probably much safer than a list in your bookshelf. It is definitely more accessible.

Remember, extra security, may seem difficult but weigh that up against getting hacked, the odds of which happening, increase every day and they go for easy targets, Mums and Dads and Small to Medium size businesses, often neither careful enough with data and passwords.

Should you change passwords? Well, yes, from time to time but I do get it, more trouble versus the risk. It is an individual choice.

Just be careful is all I say and if you are, your chances of getting hacked can be very low to non-existent. I think overall the risks are very low regardless but if you take too many risks like using the same user name and password everywhere then that is one risk too many. Anything important should have a special password and yes, it should be changed from time to time.

 

 

 

 


By Grant Watt 20 Sep, 2018
Android Google Play Store Scam.
By Grant Watt 11 Sep, 2018
An overview of some aspects of servicing a computer.
By Grant Watt 27 Aug, 2018
A chance to give your older computer running Windows 7 or 8 a new lease on life.
By Grant Watt 23 Jul, 2018

I get the occasional customer who contacts me about what to do when overseas about their data,

phone and security. The short answer is Vodafone has the best overseas roaming for $5 per day and

it covers many countries. If you are overseas for a few weeks or so this is obviously the best option.

Telstra has a $10 per day option but it is not as good as the data is restricted to 200MB per day

which is just adequate. It does depend on your plan, so I would suggest you contact your carrier as

some plans may include this by default, or not, or may require you to enable it. It also won’t apply to

pre-paid phones.

 

It is important to have key passwords to hand for your email, security programs and banking. These

can be kept by password managers, in encrypted spreadsheets and so on or just discretely kept

written down somewhere safe. It is very important to secure your phone properly as well, all the

security in the world won’t help if anyone can steal and use your phone.

 

The alternative for longer visits is obviously a SIM card, so it pays to get one that covers all the

countries you wish to visit, and it goes in your phone. The phone then gets used as a hotspot to

connect to a laptop or tablet.

 

This leads to the question of public Wi-Fi. Public Wi-Fi is often terrible in speed and quality and really

is a last resort in many cases, although some can be good. Security issues may also be present on

some poorly maintained and poorly secured connections. Hotel Wi-Fi is hit and miss I find and can be

slow, with limited download. The best option is still a SIM pre-paid with lots of data on your phone

and then use your phone as a mobile hotspot, also known as ‘tethering’, to your tablet or laptop.

 

Security can be an issue, although if you use a SIM rather than a public hotspot, you are typically

quite safe, and the risks are low. It does bring to mind though, whether more security is necessary

on your phone and/or laptop and tablet. Android is not as secure as iPhone due to the vast majority

of malware being directed at it, whereas Apple lock everything down. The best security is to delete

rather than read emails that are suspect, never connect to dodgy websites and be particularly

careful while on public Wi-Fi at airports, cafes etc.

 

If you look at security software for phones, it is mostly made for Android phones. Both ESET and

Norton have mobile Security and Antivirus. You can buy either off the app store or from their

website. Norton have free one-month trials which you can use and then cancel. ESET is cheaper I

believe. The consensus on Security for Android, is generally not to bother but some people don’t

agree, and I think if you are concerned then get paid Security. The reason for not getting it is, most

risks can be avoided if you are careful and the security can slow your phone down and provide false

alerts. An issue with Android phones is often people have a version of Android that is years old and

not up to date which increases security risks and additional security on older phones may be more

important.

 

VPN (virtual private network) secures your internet traffic. VPN software such as NordVPN and

Norton Wi-Fi Privacy may allow you uncensored internet if you are in a country that does censor the

internet. It also completely encrypts all network traffic providing additional safety. I personally might

consider it for use on a phone while travelling to third world countries or where you need to use

public wi-fi for sensitive business, and my suggestion would be to just use this just for your phone as

you can tether a tablet and laptop to the phone connection. Norton is the most user-friendly VPN

product although there are better ones such as NordVPN which are faster and better but present

more problems (and choices). These can be bought directly from a phone app store or via your web

browser and account with Norton or whoever and then the apps downloaded on the phone and

linked to your account.

 

I don’t recall any of my customers getting scammed via their phone or computers while overseas,

but additional security may give peace of mind and will further reduce your risk. You still need to be

cautious and the same considerations apply whether overseas or not.


I think another overlooked factor is 2 factor authentication. Two factor authentication ensures that no one can access a protected email or say

 set up a new phone or tablet using your Apple or Google account. A similar thing can be done with Facebook where each new log-in on 

Facebook requires a code from a trusted already logged in Facebook device or web browser.


The two factor authentication is not hard to do but make sure, especially if travelling to make sure that you put trusted phone numbers and

 email addresses in place when setting it up. In this way, you can cover most situations of theft for instance.


Google and Microsoft and Apple all have 2 factor authentication available. It makes it almost impossible for people to then hack your phone or

 accounts (but make sure you have secure password, preferably not your birthdate). Google and Microsoft also have authenticator apps

 available for your phone or tablet which provide easily accessible codes for you. 

Share by: