encryption

Twitter Error Results in Passwords Being Stored in Plain Text

Episode 1486

Twitter login

Twitter sent an email to its 330 million users recommending that they change their passwords. This is because of an error that caused user passwords to be stored unencrypted and in plain text. While this was a big flaw, Twitter is being praised for disclosing the information immediately so users can take action to protect their accounts.

Read more at Reuters.com.

How can I encrypt and anonymize my web use?

Episode 1485

Jim from Indianapolis, IN
Anonymous

Jim called in to talk about how the Department of Homeland Security is monitoring not only the free press, but also bloggers, podcasters, and vloggers. Jim wonders if he should use a VPN as a hedge against that. Leo says that while anonymizing his content is a natural reaction, and while a VPN could be a useful tool, but it's not a privacy tool. In fact, encrypting his traffic shines a light on him more than just being a part of the "background noise." Also, a VPN only encrypts the traffic along the way.

How can I securely erase an SSD?

Episode 1476

David from Hollywood, CA
Hard drives

Dan's computer was damaged and Acer is going to replace it, but he's worried about the data on it. How can he wipe the data? Leo says that there's a program called DBAN - Darik's Boot and Nuke that can wipe the drive pretty thoroughly. But Dan should understand that an SSD doesn't format the way a spinning hard drive does, and there can and will be some data leak, where someone could grab the data if they're really motivated.

Are encryption services really secure?

Episode 1467

Gary from Cheektowaga, NY
Encryption

Gary is an attorney and has heard of a business product called LockBin that promises to encrypt his data. Is it legit? Leo says that there are limits of privacy with an encryption service. If the service can give him his password, then it has access to all his data and it's not really reliable. If they can't give him the password because only he knows it, then he's in good shape. The downside, though, is that if he forgets it, he's out of luck.

How strong is the encryption on Microsoft Office documents?

Episode 1456

Mike from Riverside, CA
Microsoft Office

Mike is wondering how good the encryption is in Microsoft Word and Excel documents. Leo says it's actually pretty good and that it's adequate, but not uncrackable. Leo says it's hard to crack stuff on the web when a service can slow the attacker down. But if someone can get a document that's locked and own it, there's nothing to stop them from trying a million passwords a second, and brute-force that document. Having said that, Microsoft has started using strong encryption on documents. The weak link will be the password.

Can I use DBAN on an SSD?

Episode 1455

Mike from Niagara Falls, Ontario, Canada
SSD

Mike wants to wipe a hybrid SSD using Darik's Boot and Nuke (DBAN). Is that a good idea? Leo says that SSDs are written to differently than spinning drives, and it also uses a technique called "wear leveling," which writes sectors randomly. This makes it difficult to fully and securely wipe a drive to prevent it from being recovered. He can do it to erase a drive, but it won't really remove the data. That's why Leo recommends encryption. Using BitLocker on Windows, or some other technique to secure data with encryption.

How can I back up sensitive information to the cloud?

Episode 1444

Christian from San Diego, CA
Microsoft SharePoint

Christian is installing new computers at his accounting company. He's going to be transferring the data from one computer to another and wants to know if Google Drive will work. Leo says absolutely not. There are serious privacy issues handling a client's financial information and personal details. Carbonite is a better option that is encrypted. He'll want to be sure that the data is not only encrypted at the destination but also in transit and that the keys are well controlled, ideally only by him.

KRACK Wi-Fi Flaw: What You Need to Know

You may have heard about the latest Wi-Fi vulnerability in the news called “KRACK” or “Key Reinstallation Attack.” This is a security flaw in the WPA2 protocol that could allow a third party to intercept network activity between a router and a device. It does this by taking advantage of a problem with the way the client (your mobile device or computer) authenticates with the access point (the router).