SafeBlog

“Internet security is broken, and we need to roll up our cyber-sleeves and fix it.” — Becky Ferreira, in her recent Popular Science article exploring the problem with online identification today.

Last week, we discussed the growing problem of single password authentication and how passwords lack adequate protection for our online accounts. In an ideal world, we all would have a strong, unique password for each of our online accounts. However, the reality is that many of us keep the same, easy to remember password across multiple platforms. This leaves our personal information at risk for security breaches, identity theft, and other crimes.

As we highlighted in Part 1 of this post, groups such as Anonymous and LulzSec have recently hacked into organizations like Sony and even the U.S. government and released sensitive data to the public. Security breaches like these put a glaring spotlight on the problem we all have with keeping our web activities private and secure.

High profile incidents such as these are just pieces in the web of cyber-crime that plagues the lives of U.S. citizens. According to the U.S. Department of Justice, an estimated 11.7 million Americans were victims of identity theft of some kind including online identity theft over a recent two-year period.

The government has taken notice of the problem. On April 15, the U.S. Chamber of Commerce hosted the launch of a Whitehouse initiative entitled National Strategy for Trusted Identities in Cyberspace (NSTIC).The goal of the initiative is to create a joint public and private effort toward finding effective solutions to problems plaguing the online authentication process. NSTIC is designed to enable the development of “trusted credentials,” a term which refers to any method considered to be more secure than a single password.

The proposal comes soon after nominal efforts in the private sector to solve the problem. Google led the way in February by introducing their optional two-step authentication process for Google accounts. A two-step process combines two things in online authentication: something you should know (password) and something you should have (a device).

Once a user opts into this Google service, the password is only the first step. Users then also have to enter a verification code that is sent via phone, text message, or mobile application. A potential hacker would not only need to know your password but would also have to have access to your device that receives the verification code.

Google’s solution is a step in the right direction, but it is also somewhat cumbersome. In reality, most users won’t adopt a new process unless they are forced to.

But what are other private companies doing? Unfortunately, not much. Last week the tech blog Gizmodo requested that “Facebook and Microsoft and Apple start taking on this challenge in earnest.” Sites with tens of millions of users have a responsibility to their members to protect them.

For users who want to take their security into their own hands, security tokens are a noteworthy example of a “trusted credential.” A security tokens is a device that displays a unique passcode that changes about once per minute. In order to gain access to their accounts, users need to enter their traditional password and also the passcode displayed on the device in real time.

Unfortunately, even security token providers can be hacked. EMC, the makers of the security token SecurID, admitted in an open letter to customers this past March that they were victim to “an extremely sophisticated cyber-attack.”

Yet another solution that attempts to make our passwords more secure is the advent of applications like 1Password. This program not only creates strong and unique passwords for your myriad of accounts, but it also stores them for you, requiring you to remember just one. Every time you need to access an account, 1Password automatically enters an encrypted password directly into your web browser.

While we wait for emerging innovations to solve the growing problem of online authentication, let us ensure that your current passwords are strong and well-protected from criminals. Here are a few tips that should help:

1. Use numbers, upper and lower case letters, punctuation marks, and symbols.
2. Change your password frequently. Experts recommend doing so every 3 months.
3. Avoid writing passwords down. Whether at home or in the office, having written passwords offers them to an unauthorized person on a silver platter.
4. Use a unique set of letters – nothing personal like your name, pet, date of birth, or the city where you live.
5. Do not use the same password for any of your highly sensitive accounts – including email, banking, finance, etc.

We will keep you up to speed with the newest technologies that may help protect your online accounts from unauthorized access.

But we also want to hear from you.

Please share your comments and suggestions so that we may, with your help, build a safer online community for everyone.

Since the advent of the Internet, our daily lives are moving online at a rapid pace. We have become very comfortable, and even somewhat carefree, in conducting our most sensitive and private activities – banking, bill paying, email, chat, etc. – on the web.

And how do we protect ourselves from strangers’ prying eyes? A password, of course. Pinning our hopes on a 6-12 character combination, assuming that it will help keep others out of our business.

Unfortunately, that is no longer the case. A slew of hackings and security breaches in 2011 helped highlight the fact that the password has become outdated and can no longer be relied upon to protect us online. Our fast changing, web-driven world now requires a better solution.

Part of the problem is the sheer number of passwords that an average online denizen is expected to remember. It seems like almost every site we visit requires us to sign up with a log-in name and a password. As a result, our natural inclination is to use the same password everywhere to help simplify our lives.

Results from a survey published last year in the New York Times highlighted online privacy issues that were troubling to say the least. The article reported that two out of the five most commonly used passwords were “12345” and “password.” And “password1” appeared in the top list as well, seemingly because many sites attempt to protect users by requiring a number in passwords.

If we are not forced to create a strong, varied passwords, it is human nature that we just will not. The technology blog Gizmodo recently published a worrying report that serves as evidence of this tendency. Gizmodo matched a list of their users against a recently released list of hacked Sony users’ passwords. They found that two-thirds of those who used both services had the exact same password. That doesn’t sound too alarming, but chances are that these folks use the same password to access their Facebook, Gmail, or banking accounts as well.

That list of Sony users’ passwords was released by the hacker group LulzSec, which recently went on a widely publicized, 50-day rampage of cyber terrorism. They called it “50 days of Lulz”, which draws from the Internet abbreviation for laughing out loud (LOL). In addition to Sony, this unidentified group of computer criminals released major lists of secure data from the CIA and the U.S. Senate as well.

While it is claimed that LulzSec’s motivation is not to profit from their criminal acts but rather to have fun by spreading mayhem, some in the security industry have given the group credit for helping expose holes in large corporations’ online security systems. No matter how you slice it, their brazen activity of hacking into these companies’ computer systems is illegal. However, it is unfortunately an example of a new and growing trend called “hacktivism.” Along with other groups like Anonymous, hacktivists commit illegal acts online not just for fun but also for political reasons.

In a public message issued to defend its Sony break-in, the folks at LulzSec stressed that they are not “master hackers” and are simply exposing the vulnerabilities plaguing the Japanese company’s computer security systems. “Why do you put such faith in a company that allows itself to become open to these simple attacks?” they asked.

The answer to their rhetorical question is that we shouldn’t. But the unfortunate reality is that we do because we incorrectly assume that these large corporations behind the brands that we admire and trust will ensure the protection of our sensitive personal data. Groups like LulzSec help remind us that that the time has come for us to no longer take our online security for granted, and that we must take steps to ensure that our Internet activities and personal data are safe and secure.

In part 2 of this post, we will examine recent industry developments aimed at solving the problem of online identity theft and share steps that you can take to protect yourself from cyber criminals.

With the July 4th weekend behind us, summer vacation is now in full swing. It’s the time for cookouts, beach days, and lounging by the pool.

But are you looking for activities for your kids that are both fun and enriching? Below are a few safe and exciting pastimes that children and sometimes the whole family can enjoy:

1. Music Lessons: The sooner your child starts learning to play a musical instrument, the easier it will be. Plus, research has revealed a strong correlation between quality music learning programs and academic achievement. Check out our giveaway of music lessons below!
2. Summer camp: Nothing beats childhood memories gained from spending the summer at camp. You can choose a short sleep-away camp or day-camp for the whole summer. Either way, they are a great opportunity to make friends and to learn in nature’s classroom.
3. Art classes: Do you have a creative child? With public schools cutting down their art programs, now is a great time to enroll your child in a summer art class and help draw out a youngster’s inner Picasso. Whether it’s drawing, watercolors, or even crafts, the options are endless!
4. Science projects: Have a child with an inquisitive and analytical mind? Science kits are a fantastic way to keep your little Einstein occupied. If your community has a science fair, try entering so that they have a goal to reach for by the end of the summer.
5. Swimming: What better time to get your feet wet than summer vacation? Swimming is a lifelong skill that everyone should have, especially if you live near the coast. Enrolling your child in lessons at the YMCA will ensure that they don’t have to be a fish out of water at pool parties and beach days.
6. Babysitting: Do you have an adolescent at home that is old enough to watch younger children? He or she can make some extra money and stay busy by babysitting for friends and neighbors. It’s a good way to get them started on learning the value of money and becoming independent.
7. Visit the Library: Summer is the time to re-discover the joy of reading! Keep your kids’ minds active by visiting the local public library. Not only is it an escape from the heat, but reading opens up whole new worlds that will spark a child’s interest once the classroom opens in the Fall.

Enter our Summer Giveaway!

We are having a summer vacation contest that includes: a gift certificate for 4 thirty-minute music lessons with TakeLessons AND a $50 Best Buy card. The winner will redeem the lessons through the Music Lessons section of Safelist.com.*

You can enter in two ways**:

1. Follow Safelist on Twitter and tweet the following: “Win from @Safelist: 4 music lessons with @TakeLessons AND a $50 Best Buy gift card. http://bit.ly/piUYGe #winmusiclessons”
2. For an optional additional entry: Comment on this blog post and let us know how you plan to use your prize.

*Winner must be a registered member of Safelist.com to redeem the prize upon winning.

**There is a maximum of two entries per person – one on Twitter and one here on SafeBlog. The second entry counts only when the first entry is completed.

Submit your entries by 5 pm PDT on Sunday July 24 for a chance to win. We will announce the winner Monday morning, July 25 in the comment section below. We will also notify the winner via Twitter direct message.

Enjoy the rest of your summer and check back here soon for safety tips for your summer plans!

Here at SafeBlog and Safelist, we are 100% committed to public service.

As a business, we are constantly striving to build a classifieds marketplace that is not only better than any other on the Internet, but also safer. However, our ultimate goal is to help keep our communities, both real and virtual, safe for everyone. One of the ways we hope to achieve our goal is by enabling Safelist.com to disseminate timely AMBER Alerts to the users of our platform.

AMBER is an Alert Notification System created by the Child Alert Foundation in 1996, the same year that a 9-year old girl named Amber was kidnapped and murdered in Texas. It now stands for America’s Missing: Broadcast Emergency Response. When the appropriate police organization makes the decision to publish an alert, the U.S. Emergency Alert System issues it via radio, television, highway signs, and other media. There have been a total of 540 successful recoveries to date.

To help find a missing child, it is hypercritical to start the search efforts immediately. According to the U.S. Department of Justice, of the children abducted by strangers and murdered, 75% are killed within the first three hours. Therefore it is absolutely imperative that no time is wasted.

In order to quickly spread the word of a child’s kidnapping during those early moments when every minute is crucial, we have launched a feature on the Safelist website which will instantly notify you of an active AMBER Alert in your area.

Whenever you see the AMBER Alert icon (prominently displayed near the top of all Safelist pages) turn red, it means that there is an active AMBER Alert on a missing child in your area. Upon clicking the button, you will see detailed information about the alert, including the name of the missing child, a description and picture, and also any available information on the suspect. Since the alerts are hyper-targeted by zip codes, you will only be notified when an  alert is specifically relevant to your area. To guarantee the widest possible dissemination of these alerts, we will also be posting the information on Twitter and on our Facebook page as well.

No alert:

Active AMBER alert in your area:

In order for us to ensure safe communities for all our families, we need everyone’s help, and especially yours.  One way you can contribute is by quickly spreading the news of an active AMBER Alert amongst your friends and family. You may also follow us on Twitter @Safelist and on our Facebook fanpage to make sure that you are quickly notified of an alert in your area.

By working together, we will make certain that the all important initialminutes and hours immediately after a child’s kidnapping are not wasted, because that time could mean the difference between life and death of someone’s precious child.

You can learn more about AMBER Alert at their website (http://www.amberalert.gov/).

Have you checked your Facebook privacy settings lately?

The social networking site unleashed a firestorm of protests from privacy experts when it recently announced the rollout of their facial recognition technology that will semi-automate the task of photo-tagging for its users worldwide.

Facebook unveiled this new technology last December, but initially made it available to only a select test group. But starting June 6th the company has started enabling this feature for all of its 600 million users worldwide. Basically, their facial recognition technology will “suggest” tags for the over 200 million photos that its users upload every single day. So, if your friend Alex uploads photos of you to his “Wild Weekend in Vegas” album and Facebook suggests that he tag your name to them, all Alex has to do is click “Yes” and you’ll be tagged in all those embarrassing pictures for all to see.

This photo suggesting feature is a privacy setting that can be disabled, but Facebook automatically enabled it for all of its users without much notification other than a blog post. The company’s stance is that the feature is harmless and that “photos are better with friends.” The company also stresses how it is a major convenience to be free from having to manually tag all of your photos.

On the other hand, this also means that Facebook is sitting on a huge database of 600 million users, each one of whom it can now quickly identify with just one picture. So far, Facebook only suggests tagging those you are friends with on the site and they claim they have no plans to use it for anything else.

But who’s to say that that won’t change? Facebook has a long history of trampling over their users’ privacy rights. Almost any new feature they introduce is automatically enabled instead of allowing the user to opt-in. What’s more is that users are not permitted to approve a tag before it goes active, and only have the ability to un-tag after the fact.

Given Facebook’s record of doing what they think is best, rather than giving their users a choice, we can’t know what they will use this technology for in the future. Facebook now has the ability to potentially allow a stranger to snap a photo of you on the street and, after they upload it to Facebook, grant access to your name and identity.

Creepy, isn’t it?

At SafeBlog, our mission is to inform, educate and protect our readers from technologies that we believe have the potential for abuse. We think that Facebook’s facial recognition technology definitely has that potential. We therefore would like to show how you can disable this feature by following these simple steps and help prevent its potential for abuse from affecting you:

To disable the Photo Tagging Feature:

1. Go to Account
2. Select Privacy Settings
3. Select Customize Settings
4. Under the section Things Others Share, go to Suggest Photos of Me to Friends
5. Click on Edit Settings
6. Select Disable

Keep in mind that disabling this option will not prevent Facebook from using the technology entirely. It’s only restricting others from using it to tag you.

We hope that Facebook will listen to the critics of its facial recognition technology and acknowledge that the feature’s potential for abuse far outweighs its perceived convenience and benefits. At a minimum, Facebook must not force this feature on its users and instead, show a modicum of respect to its 600 million users by allowing them to opt-in if they choose to use this auto photo-tagging feature.