4 ms·

If you want to shock your colleagues into action, one effective way is to plug their email addresses into haveibeenpwned, and tell them: > Alice, YOU were expo

If you want to shock your colleagues into action, one effective way is to plug their email addresses into haveibeenpwned, and tell them: > Alice, YOU were exposed in the XYZ breach. Your $identifiable_information IS publicly available. If you used the same password on XYZ as you do on other services, those services ARE vulnerable. If any of those services allow you to access your email, ALMOST ALL of the services you used are vulnerable. You should change them as soon as possible.

trashcat 7y ago
It's a shame that most people will just add a number to their current password though.
- nothrabannosir 7y ago
  After talking this through with many non technical people, I have become of the opinion the shame is ours. Why do we keep pushing this patently unsafe authentication mechanism? It should never have been allowed in the first place, but now with hardware keys readily available there really is no more excuse. I understand there is a first mover disadvantage to disallowing password-only auth, but that’s on us. Our collective timorous prevaricating is to blame for the misuse of passwords by end users. Because, unlike them, we do know better.
  - kardos 7y ago
    Hardware keys get lost, what is the fix for that?
    - thomk 7y ago
      Hardware keys embedded under your skin. What could possibly go wrong with that? Joking aside, hardware keys will absolutely get lost. Even car keys get lost around here on a fairly regular basis. Fingerprints maybe?
      - kardos 7y ago
        Probably not: https://www.csoonline.com/article/3268837/busted-cops-use-fingerprint-pulled-from-a-whatsapp-photo-to-id-drug-dealer.html https://www.csoonline.com/article/3268837/busted-cops-use-fi...
      - stevenicr 7y ago
        and when the fingerprint database is stolen and shared with multiple adversarial parties? they now have your password and its gonna be hard to update / change yours. This happened with the opm hack and a big one in India or Indonesia or something not too long ago I think.
    - marcosdumay 7y ago
      Backups. Either in backuping the data, or in enabling several tokens for the same service. The problem is that the first one is frowned upon for good reasons (but maybe not as good as they seem), while nobody supports the second one. So, yes, currently depending on hardware keys is dangerous.
    - nothrabannosir 7y ago
      The same as real keys: you make a copy. If you don’t, you have to call someone to get it fixed, which is an expensive hassle. It’s an intuitive model that everyone already groks. No fragile user re-education necessary.
      - kardos 7y ago
        That doesn't seem right: https://support.yubico.com/support/solutions/articles/15000010242-can-i-duplicate-or-back-up-a-yubikey- https://support.yubico.com/support/solutions/articles/150000...
  - 91iejrj20310 7y ago
    It's a shame that operating systems exist with no functioning system-wide API for authentication, let alone storing passwords. That would change things. Just look how Apple now inserts long random passwords in registration forms and immediately saved it. That's how users will use secure authentication. By helping them, not telling them to do better on their own.
- rolph 7y ago
  go to some random video chat, and record the reactions when you offer full data on some plain nothing to hide person, then show that to those with nothing to hide In my experience there is a realization that its not about hiding your data, its about hiding from a particular type of netizen that amplifies to an extreme
- enriquto 7y ago
  what is a shame is the mere existence of the password system, in a world where we have public key cryptography.
sroussey 7y ago
Yeah, that’s the first step we take with PrivicyPal. Then data brokers, then Google/Facebook et al. While there are others, Troy Hunt’s HIBP is a great resource, and we are indebted to his work there.
ycombinete 7y ago
I make a habit of getting friends and family to do this. And, it’s sad to say, but even this doesn’t always elicit the sort of response one would think reasonable
- ghostpepper 7y ago
  Agreed. The typical response seems to be “what’s the worst that someone could do with that info?” The NYTimes article attempts to answer that question but I’m not sure how successful it is. The gist seems to be that your data affects others, and you may case later about data that you don’t care about now. Nothing about identity theft, answers to secret questions, etc. Some people I talk to already get it, that it’s hard to foresee the abuses, but for most people, if it doesn’t end with a hacker raiding their bank account then it’s not really a problem .
inetknght 7y ago
> Alice, YOUR physical address and family names are available in public information aggregation site ABC. Did your bank ask you what your mother's maiden name is "for security"? Did your HR set your password to YourLastName+StreetNumber?
amelius 7y ago
> If you want to shock your colleagues into action Another way to shock your colleagues is making them point their browsers at https://myactivity.google.com https://myactivity.google.com (and let them scroll down) Part of the information shown there is likely to be part of what's in their phones.
jcims 7y ago
Another way would be to get that 50B location point data that some analysis was done on recently, and send them a list of all of the people that visited their home and all the homes the people in their home visited. Do that enough and you'll likely discover some clandestine activities.
n3k5 7y ago
Hmmm … I wonder into what kind of action they'd most likely be shocked. > So you took a private email address I gave you in confidentiality and handed it over to some hacker site which, without making any verification that you own that address, gave you a list of services I'd signed up for? Bob, YOU are now on my shit list. Your face IS punchable. You should get lost as soon as possible. Maybe it would be better to tell them something along the lines of: "I just improved my internet security, and so can you! Check out these resources, plus some background information from trustworthy sources." But which tools and reports should I recommend? In this context, "that talk I saw at Defcon" doesn't cut it. Recommending a site that endorses exactly one password management service also seems questionable; I'm concerned that if I tell colleagues to trust HIBP, I'm priming them to fall for anti-malware protection rackets. How about the venerable NYT? They must have some great stuff. But then there's also content such as TFA, in which a graphics director and a writer from the opinion desk deliver bons mots such as: "None of us really has a choice to participate in tracking or not — the system just serves up location data, usually without us noticing. […] When we participate in this system, we're tacitly endorsing it." On a page that attempts to contact DoubleClick and Google Analytics. (Which I did notice, and, unlike the NYT, chose not to participate in.) When someone asks for advice or I noticed them make a security boo-boo, I can teach them the bare minimum (basic stuff such as how to use unique credentials for every site and service). But when it comes to doing my part in spreading the word about being more proactive than the bare minimum … halp! Edit: Credit where credit is due: I just finished reading TFA and discovered the section "What about The Times?", which has links to "This Article Is Spying on You" [0] and "How The Times Thinks About Privacy" [1]. [0] https://www.nytimes.com/2019/09/18/opinion/data-privacy-tracking.html https://www.nytimes.com/2019/09/18/opinion/data-privacy-trac... [1] https://www.nytimes.com/2019/04/10/opinion/sulzberger-new-york-times-privacy.html https://www.nytimes.com/2019/04/10/opinion/sulzberger-new-yo...
AndrewKemendo 7y ago
When I've done something like this in the past, most of the responses I get are shrugs and, "I guess I'll change that password, do you have any tips on good passwords?" A few people will go off with their lighthearted hyperbole "I'm moving to a cabin in the woods!" To which I respond, it's much easier to track a n=1 with a unique heat signature in the middle of nowhere - should someone be so inclined.

trashcat 7y ago

It's a shame that most people will just add a number to their current password though.

nothrabannosir 7y ago
After talking this through with many non technical people, I have become of the opinion the shame is ours. Why do we keep pushing this patently unsafe authentication mechanism? It should never have been allowed in the first place, but now with hardware keys readily available there really is no more excuse. I understand there is a first mover disadvantage to disallowing password-only auth, but that’s on us. Our collective timorous prevaricating is to blame for the misuse of passwords by end users. Because, unlike them, we do know better.
- kardos 7y ago
  Hardware keys get lost, what is the fix for that?
  - thomk 7y ago
    Hardware keys embedded under your skin. What could possibly go wrong with that? Joking aside, hardware keys will absolutely get lost. Even car keys get lost around here on a fairly regular basis. Fingerprints maybe?
    - kardos 7y ago
      Probably not: https://www.csoonline.com/article/3268837/busted-cops-use-fingerprint-pulled-from-a-whatsapp-photo-to-id-drug-dealer.html https://www.csoonline.com/article/3268837/busted-cops-use-fi...
    - stevenicr 7y ago
      and when the fingerprint database is stolen and shared with multiple adversarial parties? they now have your password and its gonna be hard to update / change yours. This happened with the opm hack and a big one in India or Indonesia or something not too long ago I think.
  - marcosdumay 7y ago
    Backups. Either in backuping the data, or in enabling several tokens for the same service. The problem is that the first one is frowned upon for good reasons (but maybe not as good as they seem), while nobody supports the second one. So, yes, currently depending on hardware keys is dangerous.
  - nothrabannosir 7y ago
    The same as real keys: you make a copy. If you don’t, you have to call someone to get it fixed, which is an expensive hassle. It’s an intuitive model that everyone already groks. No fragile user re-education necessary.
    - kardos 7y ago
      That doesn't seem right: https://support.yubico.com/support/solutions/articles/15000010242-can-i-duplicate-or-back-up-a-yubikey- https://support.yubico.com/support/solutions/articles/150000...
- 91iejrj20310 7y ago
  It's a shame that operating systems exist with no functioning system-wide API for authentication, let alone storing passwords. That would change things. Just look how Apple now inserts long random passwords in registration forms and immediately saved it. That's how users will use secure authentication. By helping them, not telling them to do better on their own.
rolph 7y ago
go to some random video chat, and record the reactions when you offer full data on some plain nothing to hide person, then show that to those with nothing to hide In my experience there is a realization that its not about hiding your data, its about hiding from a particular type of netizen that amplifies to an extreme
enriquto 7y ago
what is a shame is the mere existence of the password system, in a world where we have public key cryptography.

sroussey 7y ago

Yeah, that’s the first step we take with PrivicyPal. Then data brokers, then Google/Facebook et al. While there are others, Troy Hunt’s HIBP is a great resource, and we are indebted to his work there.

ycombinete 7y ago

I make a habit of getting friends and family to do this. And, it’s sad to say, but even this doesn’t always elicit the sort of response one would think reasonable

ghostpepper 7y ago
Agreed. The typical response seems to be “what’s the worst that someone could do with that info?” The NYTimes article attempts to answer that question but I’m not sure how successful it is. The gist seems to be that your data affects others, and you may case later about data that you don’t care about now. Nothing about identity theft, answers to secret questions, etc. Some people I talk to already get it, that it’s hard to foresee the abuses, but for most people, if it doesn’t end with a hacker raiding their bank account then it’s not really a problem .

inetknght 7y ago

> Alice, YOUR physical address and family names are available in public information aggregation site ABC. Did your bank ask you what your mother's maiden name is "for security"? Did your HR set your password to YourLastName+StreetNumber?

amelius 7y ago

> If you want to shock your colleagues into action Another way to shock your colleagues is making them point their browsers at https://myactivity.google.com https://myactivity.google.com (and let them scroll down) Part of the information shown there is likely to be part of what's in their phones.

jcims 7y ago

Another way would be to get that 50B location point data that some analysis was done on recently, and send them a list of all of the people that visited their home and all the homes the people in their home visited. Do that enough and you'll likely discover some clandestine activities.

n3k5 7y ago

Hmmm … I wonder into what kind of action they'd most likely be shocked. > So you took a private email address I gave you in confidentiality and handed it over to some hacker site which, without making any verification that you own that address, gave you a list of services I'd signed up for? Bob, YOU are now on my shit list. Your face IS punchable. You should get lost as soon as possible. Maybe it would be better to tell them something along the lines of: "I just improved my internet security, and so can you! Check out these resources, plus some background information from trustworthy sources." But which tools and reports should I recommend? In this context, "that talk I saw at Defcon" doesn't cut it. Recommending a site that endorses exactly one password management service also seems questionable; I'm concerned that if I tell colleagues to trust HIBP, I'm priming them to fall for anti-malware protection rackets. How about the venerable NYT? They must have some great stuff. But then there's also content such as TFA, in which a graphics director and a writer from the opinion desk deliver bons mots such as: "None of us really has a choice to participate in tracking or not — the system just serves up location data, usually without us noticing. […] When we participate in this system, we're tacitly endorsing it." On a page that attempts to contact DoubleClick and Google Analytics. (Which I did notice, and, unlike the NYT, chose not to participate in.) When someone asks for advice or I noticed them make a security boo-boo, I can teach them the bare minimum (basic stuff such as how to use unique credentials for every site and service). But when it comes to doing my part in spreading the word about being more proactive than the bare minimum … halp! Edit: Credit where credit is due: I just finished reading TFA and discovered the section "What about The Times?", which has links to "This Article Is Spying on You" [0] and "How The Times Thinks About Privacy" [1]. [0] https://www.nytimes.com/2019/09/18/opinion/data-privacy-tracking.html https://www.nytimes.com/2019/09/18/opinion/data-privacy-trac... [1] https://www.nytimes.com/2019/04/10/opinion/sulzberger-new-york-times-privacy.html https://www.nytimes.com/2019/04/10/opinion/sulzberger-new-yo...

AndrewKemendo 7y ago

When I've done something like this in the past, most of the responses I get are shrugs and, "I guess I'll change that password, do you have any tips on good passwords?" A few people will go off with their lighthearted hyperbole "I'm moving to a cabin in the woods!" To which I respond, it's much easier to track a n=1 with a unique heat signature in the middle of nowhere - should someone be so inclined.