Passwords & Password Managers

How are password stored

• When you register for a website your password, it is put through a one way algorithm called a hash function.
• Passwords should never be stored as Plain Text
  • If a site stores your passwords in Plain Text and the site gets hacked, your password is easily accessible to anyone, no work required.
  • How do you know how a website stores your password? You don’t, and there lies the issue.
  • Why Are Companies Still Storing Passwords In Plain Text?
    • In 2019 Robinhood, Google, Facebook, GitHub, Twitter, and others stored passwords in plain text.

37% of internet users say they have to request a password change once a month on at least one website due to forgetfulness.

Hashed Password

• Below is an example of how a password might be stored in a database.
  
  Algorithm = SHA1
  Password = password1
  Hash = e38ad214943daad1d64c102faec29de4afe9da3d

The URL below shows you how the Hash function works with your passwords

https://md5calc.com/hash/sha1/password1

What happens when bad passwords are used

Hacking tools are everywhere and very affordable.

• 100 Hacking Tools and Resources

I can purchase the Elcomsoft Phone Breaker for $199 and try to break into your iPhone.

This tool might have been used to steal and post nude celebrity photos in the 2014 hack.

• https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_photos
  • The images were obtained via the online storage offered by Apple’s iCloud platform for automatically backing up photos from iOS devices, such as iPhones. Apple later reported that the victims’ iCloud account information was obtained using “a very targeted attack on user names, passwords and security questions”, such as phishing and brute-force attack guessing.

The Verizon 2019 Data Breach Investigations Report found that 80% of hacking-related breaches leveraged weak and compromised passwords.

Google’s New Research: Lessons from Password Checkup in action: 316,000 of users were utilizing already compromised passwords.

71% of Gen-Z respondents believe they wouldn’t fall for a phishing scam even though only 44% know what “phishing” means.

Password Cracking Video

It only takes 10 minutes to crack a lowercase password that is six characters long.

How to protect yourself

• Use a Password Manager
• Use a good password for each site
• Use a different password for each site
• Never use a password twice
• If you write you password down on paper, make sure to secure your paper
• Don’t manage your passwords in your browser
• Don’t use a password manager like Apple’s password icloud feature
• Don’t use a company like NordVPN to manager your passwords
  • They do VPNs not Password Management
• NEVER store you passwords in a non-encrypted file on your computer
• Always change your password after a breach
• Don’t send passwords in an email
  • Email is sent in Plain Text (see above)
  • You might forget to delete the password. Do you empty your email trash?
• When you sign up for a service and they require you to have security questions
  • Don’t answer them correctly
  • Keep notes of what you say in your password manager or document it someplace secure

Use a Password Manager

Add Passwords To Your Devices

• Number of users who put a password on their phone
  • Research from Kaspersky Lab has found that 52 percent of people do not password-protect their mobile devices, and only 22 percent of consumers use anti-theft solutions on their phones.

30% of mobile-device users never lock their gadgets because re-entering passwords annoys them.

Biometric Passwords

• Biometric is less secure than a real password – this is why
  • Biometrics will be easier to hack than passwords. Not only are they subject to all of the current attacks that work when hacking passwords, but biometric data were never designed to be secret. Most people make sure not to divulge their passwords, but it’s difficult to imagine a world where everyone wears gloves constantly to avoid leaving fingerprints.

• Someone can scan your face without your permission and gain access. 
  • They can’t do the same if it is password protected.

• Florida police attempt to use dead man’s fingerprint to unlock his phone
  • https://www.digitaltrends.com/mobile/florida-police-unlock-dead-mans-phone-with-fingerprint/

• Police 3D-printed a murder victim’s finger to unlock his phone
  • https://www.theverge.com/2016/7/21/12247370/police-fingerprint-3D-printing-unlock-phone-murder

• Biometrics is different than a password legally
  • https://slate.com/technology/2015/09/court-rules-that-defendants-don-t-have-to-provide-smartphone-passcodes.html
    
• Courts are increasingly having to grapple with the question of whether suspects should be compelled to unlock their phones for investigators. Adding to growing precedent, a federal judge in Pennsylvania said Wednesday that people cannot be forced to reveal passcodes, since that would violate the Fifth Amendment right against self-incrimination.  Passwords are considered “Knowledge” and would violate the 5th Amendment. 
  
• Court: Cops Can’t Force You to Unlock a Phone With Biometrics (2019)
  • A California federal judge rules that police cannot compel users to unlock their devices with facial recognition, fingerprints, or other forms of biometrics.

Employees report spending an average of 12.6 minutes per week entering and/or resetting passwords.

Crossing The US Any Border

• U.S. border guards can search your phone: here are some details on how
  • Agents can demand a password to open your phone, without probable cause, Nielsen confirmed during the hearing. However, Electronic Frontier Foundation (EFF) staff attorney Sophia Cope says the directive, which she calls confusing, also allows you to refuse to do so. That, of course, is not without its consequences she says in a statement to CBC News. Your device could be seized or detained. The border agent could delay your travel or even deny entry if you are not a U.S. citizen.
    
• I’ll never bring my phone on an international flight again—neither should you
  • What’s the worst thing that could happen if the Customs and Border Patrol succeed in getting ahold of your unlocked phone? Well…
    
• COMMENTARY: Can Canadian courts force you to reveal your password? The jury is still out
  • Following Britain’s lead, Australia recently passed a law that allows police to compel decryption, which means forcing an accused person to provide their password or unlock a device. However, in Canada and the United States — countries with a constitutional bill of rights — courts are divided on whether compelling a person to reveal their password should be legal.

Some Fun Password Stats

Password statistics for 2020 – ‘iloveyou’ and ‘sunshine’ are most common