Note — This is the first of two three very different columns about what turns out to be the same topic.
I was driving back to college in my red 1966 Oldsmobile Cutlass convertible when a pickup truck appeared before me on the two-lane road going perhaps 20 mph under the speed limit, which was to say 25 mph slower than me. I pulled into the opposing lane to pass him and the guy punched it, accelerating quickly to keep pace with me so I could neither pass him nor pull back into his lane without hitting him. My simple passing maneuver became a death race because now a third car was added to the mix, coming straight for me down the road. I tried to speed up to pass the truck but he stayed with me. I looked over and he was laughing, trapping me in the passing lane. So I stomped on the brakes and he did too! The other car was still approaching, slower now because he was also afraid. I came to a complete stop on the road and only then did the pickup resume speed, finally allowing me over. The guy was, as my Mom would say, an asshole. But if you think about it my behavior contributed to the peril. He had been lying in wait, but I had taken his bait.
What’s the admin ID and password on your home router? Leaving the factory they are all the same for each major ISP. You haven’t changed it, have you? If it’s a wired router some bad guy can start with a block of IP addresses and easily hack you. He probably has. If your router is wireless he can do it over the net or over the air. And we helped him by not changing our IDs and passwords (change both). In this case the hacker is that guy in the pickup and — like me in the Olds — we’re fat, dumb, and happy.
In Palo Alto many years ago there was a $1 video rental shop on the corner of El Camino Real and Page Mill Road. It later became a florist and now is something completely different. But back in the 1980s when VHS tapes rented for $3-5 per night, $1 rentals were amazing and the shop was packed with customers who driving past on their way to Hewlett Packard, Varian, or Syntex when they stopped for a copy of Lethal Weapon. The deal seemed almost too good to be true. It was too good to be true. The shop owners were gathering credit card numbers and one weekend a few months into their video business they extracted more than $1 million from Mastercard and Visa before skipping town forever. Those of us who rented $1 videos without question enabled their crime.
How many passwords do you have? According to data security researchers, you probably have a four-digit PIN you use for accounts where four digits are required and you have an eight-digit password you’ve been using for everything else for at least a decade. If I set up a web site offering a deal too good to be true, like say free online video rentals (just to make my point brutally clear) free games, or free horoscopes, or maybe a free VoIP phone account or even a free IP proxy service to let you cheat and watch the BBC iPlayer, what password will you give for that account?
Why your ever-faithful eight-digit universal password, of course!
Nearly everybody does it, security researchers report, and nearly everybody is vulnerable as a result.
When Dick Feynman was cracking safes for fun at Los Alamos during the Manhattan Project, 30 years before winning his Nobel Prize, he found most of the military safes had their original factory-set combinations, which of course are all the same.
Now throw-in your pornstar name, which includes answers to typical security questions, and millions — maybe tens of millions — of networks, PCs, and financial accounts are suddenly wide open.
There are viruses and malware and botnets — always more botnets — and the fact that millions of our PCs are zombies comes down as much to our carelessness as to the evil intent of the people hacking our machines. They get away with it in large part because we let them — even help them — do it.
Next, how our habitual behavior has allowed the world economy to be screwed… and what can be done about it…
Too true. I’m 98.6 percent sure I was burned this way several years ago. Of course, I wasn’t really burned; my credit card company was. I was merely inconvenienced.
I now haul around a software password keeper in which I store separate user-IDs and passwords for each account. The number of accounts I have is — let me check this — 56 work-related accounts and 87 personal accounts. I’d guess that those numbers are above average for work accounts and below average for personal accounts. But that’s just a guess.
It’s not your fault when someone does something malicious. It is their fault alone. We can’t be expected to know how to be secure in every possible situation. Being trusting, and not spending all of your time trying to remember dozens of passwords doesn’t make use stupid or complicit, or even naive. It just makes us normal humans who don’t take advantage of others, and therefore don’t think others will take advantage of us.
Good point, but when people like the guy in the pickup keep getting away with their behaviour whose responsibility is it? Assholes need to be found and punished, but mostly they get away with it.
You can’t find and punish someone until they have committed the crime. This article was about jumping through hoops so as to prevent the crime in the first place which I agree with the other poster is pointless.
So what was Bob supposed to do? Not overtake the guy. 99.9999% he would just have been a normal truck driver and he would have gotten home faster. Same can be said about the cheap video rental place etc
It’s really up to the banking industry to figure this out and come up with a better solution. By implying that somehow it’s the user’s fault is totally the wrong way to think about it.
What do you think of GRC.com’s password generator and password haystacks? Does password padding really work?
https://www.grc.com/default.htm
Specifically, check out the “Security Now” podcast #315 regarding Steve Gibson’s “Off The Grid” paper-based encryption / password management system…
http://twit.tv/show/security-now/315
Also go to this page over @ GRC.com on this easy-to-use system for unique strong passwords for different websites…
https://www.grc.com/offthegrid.htm
Steve Gibson rocks!
Thanks Steve!
That happened to me once. I cut hard into the guy and ran him off the road. Then went to a pay phone and called 911. He was gone when cops arrived but I had his plate number. Never heard anything else about it.
That is a style I could like. he deserved to be ran off the road.
Yes of course. Raising the stakes when dealing with someone who is already a sociopath is a great idea. What could possibly go wrong?
You could kill them. If they’re laughing and playing games with a lethal weapon (an automobile) then they either need a serious clue, institutionalized, or need killing. In any case they’ll get it. It’s unfortunate when you get to the be the one to deliver the message though.
@planetjay: However, if the “asshole” had perhaps died as a result of your running him off the road, you would pay, not him, and possibly dearly. “He was teasing me” is not a defense for manslaughter.
Excuse me now, while I go look into passwords keepers….
““He was teasing me” is not a defense for manslaughter”
Of course it isn’t. But “self defense (due to attempted murder)” is.
Self defense doesn’t always hold up when a less lethal approach would have worked. If you don’t want to race just stomp on the brake and stop as Bob did. Even if self defense got you off scott free, you would then be faced with a civil law suit by the ass-hole’s ass-hole next of kin.
xkcd has been through this pretty thoroughly:
http://xkcd.com/792/
http://xkcd.com/936/
And of course there’s always encryption:
http://xkcd.com/538/
This is a big problem, and it’s got no end of clever solutions, but the simple solutions that don’t neglect the fact that humans have to use them will “win”.
Ok – so how about cloud computing in all this? At least my data is on MY machine & drives – not somewhere in Timbuktu in the sky. Cloud computing scares me to death – think of the recent Sony fiasco.
The Germans in WWII had a magnetic mine that had multiple trip mechanisms to make it explode if it fell on land — and they did not do the necessary preparations — well one was found defused and examined. One year later all ships were demagnetized and the hi-tech weapon became useless!
Laziness is the boon for the criminal, spy and humans.
What idiot came up with the idea that a password was a good security measure? And what idiots further perpetuate it every day as more and more are required and our busy minds are filled with stupid things like that to remember?
It’s no wonder that we use the same few passwords over and over.
My credit card number was used, I suspect which online business leaked the information. I wonder what if any action is taken by the banks, or do they just write off the expense.
> What idiot came up with the idea
The idiot was not whoever came up with the idea. Fifty years ago, it was perfectly reasonable to apply username and password to access the single account one had in an expensive computer at work, which could be accessed from a few dozen terminals in the same building.
However, since all this stuff is invisible and impalpable, we kept using the same lock for a wooden shack in today’s mega-malls. Bound to fail, as Bob pointed out.
What riles me are sites the limit the password length to something like 6 or 8 characters, or won’t let me use symbols in my passwords.
I know one site that is case insensitive meaning 26 letter combinations have been removed from a password. If A and a are the same, it makes a cracker’s job easier.
What was under the hood of that Cutlass? Surely not the vaunted 442…that would have blown almost any pickup off the road.
Thought-provoking column, about stuff we’re all too guilty of.
It was an Olds 330 V8. Potent enough, but no 4-4-2. The truck had a Big Block for sure.
Bob,
Two things:
1) The bad guy who has already used this password trick to conduct espionage is Mark Zuckerberg. He hacked into his erstwhile enemies’ email accounts by scraping usernames and passwords from TheFacebook.com and trying them on the harvard email server.
2) The solution to this problem is to use password managers. I use 1Password, but LastPass and KeePassX are also good solutions. I haven’t used the same password except for the test instances and short-lived machine accounts at work. The generate password, auto-save and auto-fill features are habit-forming and keep me using the maximum length passwords possible.
The last 1Password update has me ticked though. I can’t seem to save login information from the browser. The new plug-in, at least for Firefox under OS X, is so brain dead to not be funny.
Tony, Agile keeps updating the 1Password application through a series of betas. You should be able to access the beta releases by clicking on Prefs, Updates and checking the Include beta updates. The new plug-in interface does leave a lot to be desired but they respond well to feedback (they run a forum too: http://forum.agilebits.com/ ).
I quit actively running betas a long time back.
My point is the plug-in, at least for Firefox under OS X, worked well. The new plug-in does not work as well and needs a lot more polish.
I’ve told my wife to not update/upgrade her 1Password because she is visually impaired and the changes will make it more difficult to use 1Password.
Why pay $40 for 1Password when Lastpass is more well known and free?
Did you call 911 and report this morons license number. Er NO!. You should have done. Let us give your moron an identity – let us call him Billy Ray Fartburger.
Chances are that Billy Ray has previous and when the cops run his license plate through the system because you have told them that some idiot is playing chicken on Highway Bla Bla, they will suddenly be interested.
If he was playing chicken with you, chances are that he has done it with other people. If the cops catch up with him or visit his home in order to administer a stern lecture, chances are that he will not do it again – you DO NOT want to be losing your driving license in America.
“For evil to succeed, all it requires is for good men to do nothing” This incident might only be small scale, a blip in everyday life but remember all those broken windows in New York.
As for passwords – I already have a sheaf of papers that are the size of the New Testament. Frankly the situation is all too depressing for (pass)words.!!!
Oh please. It seems people don’t care if they have a license or not. They will drive anyway.
Yes, he should have been reported but given what I know of law enforcement, they are not usually interested and it seems most times inefficient to handle the incident.
Oh geez, have I had some bad experiences in trying to report dangerous behavior? Why yes, thank you for asking. 😀 Only once did I get a dispatcher who cared and we did get the bummed pulled off the road (last few years) but usually it is a case of repeating information 5 or 6 times because the dispatcher is not listening or paying attention. One case the call lasted 15 minutes and we finally gave up.
Had this happen to me when I was young in college…but it started as my fault. I was speeding outside of San Luis going north on 101 when I whizzed by between two cars in two separate lanes. Well the guy in the right lane zoomed over, sped up, and got ahead of me and then slowed down. He wouldn’t let me pass him and we had a highway dual for about ten miles with me trying to pass and him blocking me at every lane change.
Finally he pulled off at a Highway Patrol station exit and indicated he was going there to report me. I laughed and sped on finally away from him. Never heard a word from the CHP about it. I did get too many speeding tickets eventually and got my license suspended eventually though. 🙂
A good solution is to use something like KeePass Portable.
http://portableapps.com/apps/utilities/keepass_portable
A portable application keeps all its files in one directory, and doesn’t write anything to the host machine outside of its own directory.
The advantage of using a portable application to store your passwords is that a) You can run the application from a flash drive. b) You can easily copy the application and the encrypted database of passwords from one machine to another without losing your settings. c) Backup, and restoring on a different machine are equally easy.
This means that you will never lose access to your passwords, even if you change machines or browsers, and all you need to remember is one master password.
I second the recommendation for keepass.
It is worth noting that open source software (like keepass) is generally preferable to any closed source proprietary solution when it comes to security. The “many eyeballs” effect helps root out vulnerabilities and the open source code means you won’t be left in the lurch if one company goes out of business or turns bad.
Additionally Keepass is available on many platforms and there are a number of ways to use it. A popular option nowadays is to use it in conjunction with Dropbox so you can get your passwords from any device that can access your Dropbox. Drop box itself is not very secure of course but with keepass providing military grade encryption that isn’t a worry.
The only downside to Keepass is that the Iphone seems to be lagging behind other platforms in supporting it at least that was the case when I went looking six months ago. This might have changed since.
At work I use KeePass but for personal use it is 1Password. Prior to going to OS X I used Password Plus. It was good enough but not stellar.
So +1 for KeePass and +1 for 1Password.
“When Dick Feynman was cracking safes for fun at Los Alamos during the Manhattan Project, 30 years before winning his Nobel Prize, he found most of the military safes had their original factory-set combinations, which of course are all the same.”
Also, after the war Physicists found out that most of them set their combinations to there lockers to, can you guess?
Yep, 235, for Uranium 235.
Dick Feynman??? what’s up with you guys.. It’s Richard P. Feynman.. Where did the Dick come from?
Bob,
My preference is to use 1Password, or some password manager, to generate unique passwords for each site. In this way no two sites have the same password
But early on I too had a series of passwords I used. Thankfully those days are past for me.
I agree. I also use 1Password because it makes it easy to generate and use strong passwords. Mine tend to be 12 digits long and random numbers and letters. That’s effectively unbreakable though I could use a longer one just as easily.
The bigger problem you might want to address is how many of our accounts use a system that is ridiculously easy to hack. I don’t mean computer systems. Call into just about any service account you have (cable, electricity, water, etc.) and all they ask for is the last four digits of your social security number. So get those and you can access a lot of accounts. I haven’t sat down and thought of why a hacker would do this or how they would benefit but they could screw things up big time very easily.
The income is a bit lacking at the moment, thanks for the lovely ideas 🙂
(perhaps I’ll recycle some RSA key fobs)
As for the car thing, that’s only ever happened to me accidentally, but I can see that it would be a truly scary thing if there was evil intent on the part of the other driver… I would have thought that would be an invitation to get shot at in some states of the USA?
Interesting you publish this the same day that it breaks that the Wikileaks accidental leak was the result of lazy password usage.
For those not in the know:
Apparently the Guardian Reporters published the Wikipedia password they had in their book because they were told was temporary but it turned out to be the same as the password used on the insurance data dump that Wikileaks put out onto torrent websites. Big oops, and very topical it seems.
xkcd had a panel showing this exact password scam a few months ago. A better person than I am would look it up and give you the URL, but trust me: it was there.
And then there’s the question of how many (such) sites are (also) harvesting “wrong password” tries. Much potential current-password-on-wrong-site gold to mine and correlate there.
If you accidentally use a current password at a wrong site, change it immediately.
In addition to the numerous sites that require passwords, some of them require changing the password every 2 to 12 months, with a requirement that the password cannot repeat in the last year. This requires heavy bookkeeping if you keep a list of many different passwords. And you can’t minimized to only one password. Some (like a bank) only permit numeric inputs, others require various “strong” measures. A co-worker of mine found that he could not use the company copy machine because his “universal password” for all company work had an exclamation point in it. Unfortunately, the copy machine did not have an exclamation point in its softkey keyboard.
I myself have a “gold’ credit card that I use only for monthly utility billings (where the jerks require a credit card and not direct withdrawal from the bank) and one possibly less secure for making on-line purchases. I never leave the credit card number with their web site, but re-enter it each time I make a purchase.
It was not a password issue, but due to an earlier unfortunate incident using Pay Pal, I have sworn off that route of payment. They may have changed their ways, but I am not giving them a second chance. The seller was a crook and stalled me past the 30 day refund time of Pay Pal, but Pay Pal’s “customer service” phone number never permitted talking with a real person and I could not inform them of seller’s thievery. The only good news is that he ultimately went to jail (I laboriously tracked him down in spite of his cover-ups, and actually talked to the slease, who threatened to sue me for slander. I continued researching and found that the feds were also after him. They invited me to testify against him; the only reason I did not is that my schedule was inconvenient and the courtroom was across the country.) I never got my money back.
I’ve been using mSecure on my phone.. my passwords are in my pocket. It’s a bit of a pain to pull out my phone and enter a password to get the password for my bank account, but not something I’m unwilling to do. Slowly migrating all my passwords (auto-generated at that) to this mechanism.
Normally I’m against killing but this article sluatgehred my ignorance.
2AOZaI yslvtprhqryt
NEVER blame the victim for the crime.
There’s a cheap laminated padlock you can buy, manufactured at a certain low-cost country, that has only one key. There are millions of those padlocks around and they all take the exact same key. Even better, no owner can change the key because the lock mechanism is too cheap.
So if you ever see one of those padlocks that’s protecting something worthwhile, anyone can get access to it easily enough.
Also, has anybody seen the youtube movie of how to defeat any 3 number combination padlock using a piece of popcan skin? You cut it out with a pair of scissors! Costs the enterprising individual only 10 cents for the lost popcan deposit.
https://www.youtube.com/watch?v=1eGxRQlWTrM
Were you tailgating the pickup truck before you tried to pass?
I’ve been using a password manger from the start. All my user names and passwords are random 16 character strings….different for each account. I also make up random bullshit answers for each account’s security questions and save them as a note in my password manager.
As Dan Ariely mentioned in his TED Talk (“Are we in control of our own decisions?”) a large part of that is the human tendency to accept defaults.
The routers are getting better at that. The 2wire routers that come with AT&T U-verse service all have unique SSIDs and passwords. The Apple routers have unique SSIDs. And a lot of WiFi devices support the PBC method of WPS, so often you don’t even need to copy the password into your device.
[…] Robert X. Cringley: I was driving back to college in my red 1966 Oldsmobile Cutlass convertible when a pickup truck appeared before me on the two-lane road going perhaps 20 mph under the speed limit, which was to say 25 mph slower than me. I pulled into the opposing lane to pass him and the guy punched it, accelerating quickly to keep pace with me so I could neither pass him nor pull back into his lane without hitting him. My simple passing maneuver became a death race because now a third car was added to the mix, coming straight for me down the road. I tried to speed up to pass the truck but he stayed with me. I looked over and he was laughing, trapping me in the passing lane. So I stomped on the brakes and he did too! The other car was still approaching, slower now because he was also afraid. I came to a complete stop on the road and only then did the pickup resume speed, finally allowing me over. The guy was, as my Mom would say, an asshole. But if you think about it my behavior contributed to the peril. He had been lying in wait, but I had taken his bait. […]
[…] is the third of three columns on human behavior and systemic problems. The first column covered in general how our complacency allows us to be taken advantage of, especially when […]
My former bank requires me to create a password, then create three challenge questions. All of the questions are things like your high school name, the name of your first pet, your mother’s maiden name. Basically, everything that will eventually end up being posted on Facebook. If a thief knows your Facebook, they know you.
But my bank offers a really brilliant idea. If you do not log into your on-line checking every 90 days, it deactivates your account for security reasons. Nobody at the bank told me this. No automated email came to me. I found out when my attached automated transfers failed.
The way you resurrect the on-line checking is to log in and enter a challenge question. If you knew my 8 digit password and my challenge question, you can crack into my account without me ever being wise to what was happening. You could have drained me clean before I ever knew.
With a little phishing, a clever hacker could clear out many checking accounts in minutes. I can’t imagine my former bank was unique.
I bet the penalty for bank fraud is less severe than the penalty for armed bank robbery.
We live in interesting times.
Your bank allows you to use online banking with just a password.
With mine, my laptop is tied to my account so I can only use it from that one computer and my wife has a little random code generator given to her from her bank. Plus passwords off course.
I know that a thief could nick the laptop to access the account but it’s still much more secure.
I should point the brilliant idea from my bank was not serious.
I simply do not get is challenge questions. To me, it gives a thief five more chances to prove they are you. If your bank password is the same as your email password, they could easily monitor your email, clean you out and remove any email trace of the transfers from showing up in your email in box.
Most wired routers have remote access default off so physical access is the main deterrent and not the password.
I get the point, but your details are wrong. Out of the box, home routers don’t allow reconfiguration from the internet. So even if a homeowner doesn’t reset the admin password, a blackhat would have to break into their house, plug into their router and make their changes on-site. If it’s a wireless router, the bad guy would have to park on the curb outside their house to do their dirty work. Possible, yes, but very unlikely. In terms of risk vs reward, the chances of being cracked are extremely low compared to the cost of figuring out how to secure the damned router in the first place. Have you tried following the “quick start guide” for a home router recently? Ha!
As far as the guy in the pickup is concerned, I think the word you’re looking for is “griefer”.
Whattya think of this?
For meaningless sites, I use one of 3 PW’s, For work or important personal stuff, I’ve got 3 others that are at least 12-15 characters long and I switch them from time to time…
Is that better?
Matt
I drive really slow in the extremely-fast lane while individuals behind me are going insane…. I’m an …….
The main face of the cards is young and trendy women. As long as you like the bag, as long as you worship trends.
Tamil Serials online,Telugu Serials online,Hindi Serials online,Malayalam Serials online…
[…]I, Cringely » Blog Archive » Our Own Worst Enemies – Cringely on technology[…]…
Yeah I feel ok buying parts elsewhere because, well, parts are expensive, and the same part can usually be found cheapest online. I don’t skimp on the install though, having someone who know what they’re doing is worth spending a bit extra per hour, but then again, my shop has the best prices.
You could definitely see your skills in the work you write. The sector hopes for even more passionate writers like you who are not afraid to mention how they believe. Always follow your heart.
blurum funziona…
[…]I, Cringely » Blog Archive » Our Own Worst Enemies – Cringely on technology[…]…
A burleigh horse trials 2010search(�ٸA burleigh horse trials 2011…
[…]I, Cringely » Blog Archive Our Own Worst Enemies – Cringely on technology[…]…