I’m going to start off this article with some great news for everyone! I find it much too difficult to remember all the PINs for my banking cards and credit cards so I’ve decided to with one PIN number. I also don’t have a very good memory, so I tucked a note in my wallet with a sheet of paper that reads “Mr. PIN: (905) 555-1204”. That way, all that I have to do is pull out the handy piece of paper if I can’t remember my PIN. What a great idea!
Hopefully, people will realize that I’m not so foolish as to have done the above. I certainly wouldn’t set all my cards to one PIN and then put that PIN number in my wallet, so that someone who has my wallet could have the key to all of my accounts.
However, what this does illustrate is how lax and lazy we can be with regards to our online passwords. As wonderful as this technology is, one of the biggest problems is that there are just too many passwords for us to remember. Without some mechanism to keep track of them, it’s inevitable that we have our “standard” passwords. Unless you have a photograph memory, it’s next to impossible to keep track of all of the sites that you login to.
I’ll be the first to admit that I’ve been as guilty about this as anyone else in the past and I had used the same password for many sites. Sometimes, I would have a site where the password that I used didn’t conform to their standards, so I had a second version which was more compliant.
There’s an old saying that a chain is only as strong as its weakest link and this is very much in evidence with security on the Internet.
Intellectually, I’ve always known that this common approach to passwords is a problem, but it took a recent, real-life example to give me a wake-up call.
A few months ago, a popular dating website was hacked. That in itself is bad enough, but the problem is that this dating website did not (and I believe still does not) encrypt their member’s passwords. This gave the hackers immediate access to the login passwords for a certain subset of members. Someone’s initial reaction to this might be, “Not such a big deal, the worst thing that could happen is that they could mess with someone’s profile or send nasty messages to another user.”
Stop and think.
Imagine that some website was hacked and that your password was exposed. Perhaps it’s a message board and that you think that the impact and risk are inconsequential. However, think about if you’ve used the same password or maybe a version of it with some numbers at the end on some other site – and possibly you’ve used the same user id and the same password on other sites
Multiple locks – one key.
Let me give another analogy. Say that you are in the parking lot of the local mall and you’re going back to your car. You reach into your pocket for the key fob and when you press the button, not only does your car honk, flash it’s lights and unlock it’s door, but every car of the same model in the proximity did the same thing. Imagine for a moment that Honda had one key fob/code for all Honda Civics. How concerned would be that anyone can unlock your car?
Multiple locks – one key.
The “easy” solution is to have a different login ID and a different password on each site that you frequent. This brings us back to the original problem that most humans don’t have an easy way to remember all of these credentials and simply writing them down – anywhere (without it being secured) – is just as bad.
What is the solution? There are a number of them and it depends on your own circumstances (refer to disclaimer). I have stumbled across a website called PassPack (www.passpack.com) which for most users is a free online password manager. I’ve started to use PassPack and I’m encouraged by the security that they’ve built in, but I’ve come to realize that even with a website like PassPack, that there is still an inherent problem.
The problem is this – if I store ALL of my user IDs and passwords online, then I am right back to the same conundrum – a chain is only as strong as its weakest link. What if the security there was breached? In this case, it’s even worse as my entire login credentials are in one location. It wouldn’t matter if I used the password of gr81for#9930 on one site and yy3-9##9! on another, everything is fully exposed.
What’s the solution? Well – I think this whole issue of security will evolve and it will continue to be fluid as the nefarious hackers try at anything to login to our accounts, so keep in mind that how we handle our identities in the electronic age will need to become more sophisticated.
One possibility would be to maintain a separate login for each site, but have one or two standard prefixes or suffixes that only you know – one that someone would not be able to guess, perhaps something as random such as 2#pff. Don’t write this prefix or suffix down anywhere. Even if your login credentials are exposed, they won’t have your full password.
There may be some of you who don’t do any financial transactions online and as a result, perhaps this isn’t as much of an issue for you. Don’t make this mistake. The more personal information of yours that is available online makes identity theft easier. Having your name, address, perhaps phone numbers or date of birth that you had entered on a “safe” website when you registered, might be all the information that an individual needs to take out a loan or mortgage in your name.
When it comes to security, privacy in the electronic age, it pays to be skeptical and to assume that nothing is secure – there’s too much at risk.
Disclaimer: The author of this article does not recommend any websites, methodologies or practices within this article. The intent of the article is to give the reader cause for thought to examine their own practices, the risks and the best way to address this issue.
