Irreal

I’ve written before about how I’ve embraced the digital life and pretty much given up dealing with paper, pens, and all the rest of the traditional record keeping methods. Almost everything happens on-line and whatever paper documents I get are scanned and saved to digital files. It’s tremendously liberating: no huge file cabinets bursting with impossible-to-find papers, no documents piling up waiting to be filed (probably in the wrong place), no searching through paper archives when the IRS or some other entity comes calling. It’s all there in my digital archive and easily accessed when needed.

It seems like a no lose plan. All your data instantly available with a minimum of effort. But what if those digital files were lost? Or stolen? Well, that would be disaster, of course, but, after all, those paper files could also be lost or stolen. Except that they’re not nearly as likely to be. Sure, the floods could come but that’s pretty unlikely and no one is going to bother stealing your huge filing cabinet. But suppose someone stole your computer that contained those digital records? Not nearly so unlikely.

Here’s a story of how that actually happened. The entire digital life and business records of someone whose laptop was stolen gone in an instant. The story is horrifying. An entrepreneur working all over the world returns to the safety of his home only to have all his electronics stolen. Everything, business records, copies of his passport, bitcoin wallet, password manager, and everything else were in someone else’s hands.

In this case the victim spent 12 hours changing all his account logins. That’s bad enough but what about all that lost information? In this case, the victim had a series of old backups so only his most recent information was lost. How can we avoid these problems? Read the post at the link for some ideas. The most important of those are to encrypt you data and have a robust backup plan that ensures your backups are never more than a day old.

If you have those precautions in place, loss of your computer will be annoying but not disastrous. There are plenty of services that will automatically backup and encrypt your data. It’s just asking for trouble not to use one. Read the post to see what can happen and what you can do to prevent it.

The United Kingdom’s CESG has published an appraisal the security of various operating systems. The TL;DR is that Ubuntu Linux is the “most secure” but Ubuntu is probably a proxy for Linux (no other Linux distros were profiled). Happily, the CESG analysis was a little more nuanced than “the most secure OS is…” They looked at several aspects of the OS and rated them as “significant risk,” “some concerns,” and “no risk.” The summary is useful no matter what OS you’re using.

Even more useful are links to a discussion, for each OS, of every aspect in the rating. This allows you to understand what the vulnerabilities for your OS are and what you should do to address them. Even if you’re not the type of person who cares about the relative standing of the various OS’s, you’ll want to know how your OS stands up and what you need to do to make it more secure.

PC World in reporting on the 25 worst passwords of 2013. As it does every year, Splashdata, a security firm, has compiled a list of the most common passwords culled from stolen password lists. Everything is depressingly normal. All our favorites are still there. The major difference this year is that 123456 has replaced password as the most common password. The two just switched places so they’re still the top two.

The people using these passwords are undoubtedly the same people who don’t get what all the fuss over the NSA is about. The universe will, of course, punish their stupidity in due time. The problem is that many of us conscientiously doing the right thing will be collateral damage.

In case you’re wondering, the only responsible password policy for 2014 is to use a password manager that generates long random strings for passwords and to protect your password database with a master password made up of multiple random words à la Diceware. Anything else is certain to fall to the crackers no matter how clever you try to be.

And for goodness sake, if you’re a developer implementing password functionality, get rid of the stupid restrictions on password length and legal characters. There really is no excuse for those restrictions. None.