The Practical Guide To Mac Security: Part 2, Passwords — Transcript

Full transcript

1. 0:00Hi, this is Gary with MacMost.com. This is
2. 0:03Part II of my course The Practical Guide to  Mac Security. This course is brought to you
3. 0:07free thanks to my Patreon supporters. To  find out more go to MacMost.com/patreon.
4. 0:18So I'm going to start this course  by talking about Passwords.
5. 0:21Passwords are perhaps the most fundamental part  of your Mac computer device and internet security.
6. 0:29Without strong passwords all other security  measures don't mean much since with a weak
7. 0:35password it's easy for someone else or an  organization to break into one of your accounts.
8. 0:42So to understand why you need strong  passwords it's important to understand
9. 0:45how an account is broken into. The main  method that is used is simply Brute Force.
10. 0:53This means trying over and over again to break  into an account. Any internet account has
11. 0:58three parts to it. The first part is simply the  Service itself. So this could be a shopping site,
12. 1:05it could be your bank's website, it could be  a site like Facebook. Now for your individual
13. 1:11account you've got an ID. This is almost always  your email address. Email addresses are unique.
14. 1:19That's why they make good IDs. IDs have to be  unique. Your name probably isn't unique. There's
15. 1:25probably somebody else with your name. Coming up  with your own ID it's going to be hard to come up
16. 1:30with an ID that's unique. But email addresses are  unique. You've got your email address and nobody
17. 1:36in the world has that same email address. So  they make really good IDs and also they're good
18. 1:41because they are hard to forget. So you can't  forget your ID because it's your email address.
19. 1:46The third part, of course, is the Password.  With these three things the target site,
20. 1:53your email address, the ID for your account, and  the Password, if somebody has those three things
21. 2:00they can get into your account. So  the target is always going to be a
22. 2:05property of some value. The bank is always  a common example but social media accounts,
23. 2:11email accounts, the account setup on  your computer, your iCloud account,
24. 2:16these are all good examples. Shopping sites like  eBay and Amazon are all good examples. There is
25. 2:21some value to having access to somebody else's  account on these targets. You email address,
26. 2:27the second part, is easily available. If you've  ever gotten a single piece of junk email that
27. 2:32means your email address is out there and  everybody has gotten some junk email. So if
28. 2:36you don't think you have look in your junk folder  and if you still don't find it there it's probably
29. 2:40because your internet service provider has  filtered it out before they come to you.
30. 2:45Lists of email addresses are out there. Your email  address is public information just like the street
31. 2:49address for your house. Anybody walking by your  house can see that. So the only real security is
32. 2:55your Password. If you have a weak password brute  force can be use. A combination of the target
33. 3:01site with your email address which can come off a  list of everybody's email address, and a password
34. 3:08that you use that is weak can be tried and, if  successful, they've broken into your account.
35. 3:14Now what are the chances that they are going to  guess your password. Well, pretty remote except
36. 3:20that they can try again and again and again. Using  brute force they can try millions of times, trying
37. 3:27all sorts of weak passwords to try to get in.  They can do this because they're not just using
38. 3:32one computer. They are usually using networks of  computers. Sometimes computers that have malware
39. 3:37on them that have been turned into servants of the  malicious people that want to break into accounts.
40. 3:43So you have all these computers all around  the world trying a service, and email address,
41. 3:49and password over and over again and trying to get  a certain number of accounts that they can hack in
42. 3:56a given time period. So try, try, and try again is  how brute force works to break into your account.
43. 4:05Another way that they can break in is  with the Data Breech. So a data breech
44. 4:10is when you have those same three things, the  target site, email address, and password, but the
45. 4:17email address and password come from a list.  This list is from when there is a data breech.
46. 4:22So sometimes you hear about a big company, maybe  a retailer or online service, they have a data
47. 4:28breech. They say somebody got to all our data.  This could include email addresses and passwords.
48. 4:35Now when you hear about this you are told to  change your password at that site or service.
49. 4:39Sometimes you get an email directly from  them telling you to do that. You may think,
50. 4:43okay I've changed my email address for that  service so I should be safe. But a lot of people
51. 4:49reuse passwords. So if you've used that same  email address and password on another site they
52. 4:55can break into that other site. So in other words  Site A you're using the same password as Site B.
53. 5:00Site A has a security breech so your password  for Site A is out there but you've changed your
54. 5:06password for Site A but you forget that on Site B  you're using the same email address and password.
55. 5:12They are going to try that email address and  password combination at that site. It's a lot
56. 5:17easier given a data breech list like this for them  to get in. Not all data breeches are reported. A
57. 5:23lot of them are not. So a site that you signed  up for that you didn't even think was important,
58. 5:28maybe you don't even use it anymore, that site  got a data breech. You never even heard about it
59. 5:33and that password you are using in another site  that is important, now that site is broken into.
60. 5:41They will try, try, and try again to  use this data breech information to get
61. 5:47into different accounts. They  are usually pretty successful.
62. 5:52A third way to do it doesn't involve weak  or strong passwords because any password
63. 5:57is vulnerable. It's Social Hacking. You've got  the same three things that are needed but in
64. 6:02this case they are going to use you and con  you out of your email address and password.
65. 6:10This doesn't need any kind of brute force. They  can do it in one try. We'll talk about that later
66. 6:17on in the course and how to avoid that. So  even strong passwords will have their limit.
67. 6:25Now in order to get a strong password you need to  understand what a weak password is. So what is a
68. 6:30weak password? Well, first it's any dictionary  word. Any word that's in a dictionary. Now keep
69. 6:35in mind even though there are only about 80,000  words in English which seems like a really low
70. 6:41number if you think about it. 80,000 words, 80,000  passwords, take no time at all for a computer to
71. 6:47run through them and try all those words as  passwords. But, in fact, most of those are
72. 6:52technical terms and things like that that we don't  normally use. Everybody uses about 10,000 words so
73. 6:56it's really easy to go through those words and  try them as passwords, even combinations. So
74. 7:02things like this for passwords, they may be great  because you can easily type them and can easily
75. 7:07remember them. But they will easily be broken. You  account will be broken into if you use something
76. 7:12like this. Even combinations of words like let  me in or my pass. Things like that where there's
77. 7:18more than one dictionary word in there easily  broken when they try to break into accounts.
78. 7:25Also variations. You may think  you're being being clever by using a
79. 7:28zero instead of an O or a 5 instead of an  S or even an exclamation point instead of a
80. 7:35one or an i. These can easily be broken too  because they know all these tricks and they're
81. 7:41going to try the word dragon with an O and dragon  with a zero and all other variations you could
82. 7:47possibly dream of. It's not hard for them to  add these to the list and try these variations.
83. 7:55Also names and places. So you might want to  have your password be the name of a loved one.
84. 8:01But there are fewer names than even regular  dictionary words. Even if you throw in a place
85. 8:07names and team names and variations of things  like that. These are also things that are tried.
86. 8:14Just imagine a huge list of potential passwords.  Millions and millions of passwords that other
87. 8:19people have tried that are combinations of words  and things. These are all going to be tried with
88. 8:25your email address to break into your accounts. Also dates. People try to use dates but in fact
89. 8:30there aren't that many dates. 365 days  a year and most dates that we try to use
90. 8:36are either without the year or maybe within  the past 50, 60, 70 years like birthdays and
91. 8:41anniversaries and such and there's only so many  formats. It really isn't hard to try all of these
92. 8:48different dates. No matter how clever you think  you're being trying to use a different date format
93. 8:54they're going to be things that are easily  broken. Combining words with dates as well.
94. 9:00Anything easy to type also is  on this list like 1,2,3,4,5,6,
95. 9:05qwerty, just repeating the same character over and  over again. Or things that are on the same row on
96. 9:11the keyboard. These are all things that they  are going to try to break into your accounts.
97. 9:20So the last piece here that makes a weak  password, even if a password looks strong,
98. 9:26it's weak if it's not unique. So what's not  unique. Any password you've used before.
99. 9:33You should only use a password  at one site once and that's it.
100. 9:37Once you've changed that password never use  it again. Never use it at a second site.
101. 9:43A password anybody else has used before.  So this, of course, you wouldn't know but
102. 9:48if you're going to be using a random password  then chances are it never has been used before.
103. 9:54Any words or phrases from TV, movies, book,  anything like that. Just weird things that
104. 9:59you've heard being used as passwords in  combinations or anything that's not unique.
105. 10:06Think of if it exists somewhere else in some form.  If it's been written, spoken, in anyway then it's
106. 10:14not unique. Then it is something that will be  tried as a password to break into your account.
107. 10:19So knowing what a weak password is can help you  learn what a strong password is. It's basically
108. 10:24anything that's not a weak password. So follow  some simple rules to have a strong password.
109. 10:33The first rule is it must be random. It cannot  be something that comes out of your head that
110. 10:38you've seen somewhere or somehow picked from  some source. It's got to be random. The only
111. 10:45way to have a random password is to have the  computer generate random characters for you.
112. 10:51It's got to be long. Six characters is  not enough. Even eight is questionable.
113. 10:56It should be long. You shouldn't have to worry  about memorizing it or typing it because, as
114. 11:01we're going to learn in this course, you're going  to use a Password Manager, like the one built into
115. 11:05Safari, to actually generate the password. It's  going to remember it for you and it is going to
116. 11:11enter it for you. You don't need to ever enter it  in. So, coming up with a password that's 12 or 16
117. 11:17characters long and it's random and impossible  to memorize, that's fine. That's a strong
118. 11:22password and that is what you should be using. Also unique. Never use the same password twice.
119. 11:29Never use it at two different sites.  Never repeat using that same password.
120. 11:34Then as a bonus, in addition to that also use as  many different characters as you can. Of course
121. 11:40use letters. But up and lower case. Numbers and  many symbols are accepted for passwords like
122. 11:47dashes and such. The more different characters  you use the stronger the password will be.
123. 11:54So how do you get a strong password? I've  already mentioned this. There's really
124. 11:57only one way to do it right and that's have a  random, password generated by your computer.
125. 12:04We're going to learn in this course how to use  Safari to have a random password generated.
126. 12:08But there are also many third party password  managers like OnePassword and LastPass that
127. 12:14will generate random passwords for you, remember  them, and enter them in for you automatically.
128. 12:20Anything less, anything that you come  up with or that you can easily memorize
129. 12:25because it's short enough or typed like  that is not going to be a strong password
130. 12:30and is going to make your computer, your devices,  your online accounts vulnerable to attack.