Username & Password Pairs: Understanding the Significance of HeartBleed and How to Prevent Becoming a Victim

The Heartbleed bug allows hackers to access username and password data through a programming fault (vulnerability) on OpenSSL systems which power over 2/3 of the internet online security.  It's a huge mistake and an extremely significant problem.  If you need to understand the Heartbleed bug, see my other article:
http://domainating.wordpress.com/2014/04/14/the-internets-broken-heart/

This article discusses why this is such a big security issue and why, as well as how to prevent becoming a victim to these malicious hackers...

This post was originally posted on my WordPress blog at:
http://domainating.wordpress.com/2014/04/17/the-heartbleed-password-dilema/

Because this bug is so bad, and the implications of its abuse so broad, so dangerous and so extremely important, I am cross-posting that blog article in many of my blogs.  Please do not hesitate to fix this issue for yourself, your family and loved ones.  Tell your friends about this problem, as well (or point them to this article).

For your convenience, that article is reprinted below:

OK, the fall-out from the 'heartbleed' bug is worse than I thought.  The problem is with how we, as humans, don't manage a ton of passwords well.  It isn't so much that we are lazy, but to avoid clutter in our mind, we re-use passwords across the internet to log-in to different websites.

But with the heartbleed vulnerability, the problem becomes worse because of our conservation of brain cells and the repeated username and password combination becomes yet another vulnerability.

You see, most people don't come-up with a unique username and password for each site they have become a member of.  Most people reuse the same username over and over so that they can be identified as themselves by friends and acquaintances across networks.  Now, that would still be OK if the password used was unique for each and every website that user logged into using that username.  But because we are trying to make things simpler we usually only use a small index of passwords from which we draw our passwords, so that we don't have to remember so many, because we know what it feels like to be locked-out.

It all has to do with username and password pairs.

So if a user logs in as "Gibraltor5" with a password of "1Ydd/R247" on a forum website that is compromised, the problem then becomes that the username and password pair are entered into a database and some malicious hacker will eventually try to use that username & password pair at other places, such as Yahoo, Twitter, Gmail, Facebook, Chase, CapitalOne, Amex, etc...

So eventually, someone will make a program that will actually try to login to all sorts of websites using "Gibraltor5" as the username and "1Ydd/R247" as the password, possibly even on a global scale.  Once more, they may not stop at one attempt.  They might wait a year or so and try again, just to check if the user had protected his accounts, but then gone back to his lazy ways.

So from now on, you have to create a unique password for every single site that you have ever accessed.

Even though Google may say that your Gmail and Google+ accounts are safe, they aren't if you have ever used the same username and password combination ever before or afterwards on any site.  You can't be sure that any certain site was or wasn't compromised.   The username and password pair could have come from a site you don't even remember joining.  So if you have a tendency, like most humans, to use the same password over and over, you have to stop that right now, go back to all the sites that you have ever been a member of, and change your password to something unique.

Now, if you are like me, you have lots of places that you frequent.  That means you will require so many passwords you won't know how to keep them all straight without writing them down.  But if you write them on plain paper, or in a little black book of passwords like I used to do, you open yourself to having them ripped off and hacked that way, by your very own hand.

The best way to do it then, is use a password program that will keep all your passwords safe and handy.  Since I don't always have my PC with me, but I try to always have my phone on me, I have to recommend Kuff's Password Safe for the Android.  It allows you to generate unique jibberish style passwords on the fly, comes with 128 or 256 bit encryption to protect your entire catalog of passwords, categorize them, and more.  The one thing is that you must remember the password you will use to access the application, because there is no back door and without that one password, you will not be able to access the application again.  The good news is that you only have one password to remember, again.

Now, to top that off, you can also get another version for Windows, so that you can update and access your password data across platforms, as well as backup your data to remote servers such as Dropbox, SkyDrive & Google Drive, or to your local Windows machine.

Kuffs Password Safe on Google Play:
https://play.google.com/store/apps/details?id=uk.co.kuffs.free.passwordsafe

The developer's website for Kuffs Password Safe (Android & Windows):
http://www.kuffs.co.uk/

If you do not have an Android based smartphone and/or tablet, or you do not expect to upgrade to an Android smartphone/tablet, or if you prefer a Macintosh supported version, you will have to shop around.  But this little utility, a password safe, to secure all of your username and password pairs and other private information, encrypt the data to protect it from malicious hacker idiots, is now an important and vital component in the life of anyone who has or had an online lifestyle (meaning anyone who ever has done anything online).   

I even keep my server details and all sorts of vital info there, I trust it that much.

What's the Very Best Password Safe?

The best Password Safe?

I finally have entered all of my passwords into my DroidX. It took a long time to find just the right application, and it was quite an adventure, trying so many different apps along the way. But I am certain that I finally settled on the very best of them all... Kuff's "Password Safe Pro". I was trying out all the free versions and this one definitely was the best. I bought the license key (3 euro) because it was so good and because I got tired of seeing the ads very quickly. ;)

There is also a lite version (Password Safe Lite) without network support for 1 euro which doesn't show ads and has no network back-up or sync features (because of the lack of network connectivity feature in this one). It will, however, back up to the SDCard . I wound-up getting both, but that's because I was a bit foolish and didn't find the license for the pro version right away, mistaking the lite version for the license. I wrote the developer and heard back from right away, he's going to refund the money I spent on the lite version for my Droid and we will definitely get another lite version for Maria. She'll then have one and she doesn't need the networking backup/sync features (she or I can manually back it up from her SDCard to her computer, anyway).

I am very happy with this software package. It acts like an app should.

Both versions are very secure and use 128bit AES encryption by default with a 256bit AES encryption option setting.

You can setup the item data fields the way you want, organize them the way you want. Your control over your data is total. You can even setup templates for items, though I have yet to experiment with that.

Nothing else comes close to these Password Safe apps. And you can sync the full version (the one w/backup/restore/sync networking capabilities) with your PC using DropBox, too! The Windows version of the program is free (until the end of this month, anyway). And there is a WiFi backup/restore/sync version available, now. My license is for a lifetime. I am just starting to test the WiFI capabilities, that's a new feature.

Cool program. Works well, too. Very reliable. No complaints (and the few I had were addressed by reading the docs). You can have all sorts of nested folders so that you get everything organized just right. And there are all sorts of skins you can use on it, as well. Even more skins in the Windows version. It was developed by a bloke in the UK.

I honestly am glad I waited to get such a great tandem act for a Password Safe with Kuff's. I should also mention that it's full of features that I will probably never use, but are important to such devices, such as an optional wipe feature that will kick-in upon so many failed login attempts. A remote wipe feature, incase of phone theft. These are important matters of security for the secure obsessed. And there are other security features such as a configurable "shake to show" option, as well.

I will say this, I had a little trouble finding the license key because I kept searching for terms using "kuff's" (with the apostrophe) and eventually found it just searching for "kuffs". So be sure to search for kuffs to see the 2 versions of Password Safe and the license key for the full featured version. It's always the little things that hurt us the most. LOL.

There are some tiny UI issues that I had which were all addressed in the new update by the developer before I could even shoot off an email to him... this guy is sharp!

Thanks, DAz!

Amendum: DAz is the developer and his responses have all been immediate. The purchase of Password Safe Lite was refunded to my credit card within minutes of the request. I am extremely impressed by his professionalism and immediate service to accomodate all my needs. You're just not going to find a better Password App anywhere, and possibly not a more well made app, either.

Oh, I should mention that the Windows version is pretty slick. I'm sure he'll start charging for that one soon, so get it (the Pro version for the android and the Windows version for free) before the end of the month while the Windows version is still free with the Pro license (only 3 euro for both, that's great!).

Links:
http://www.kuffs.co.uk/ - for Kuff's Password Safe
http://db.tt/kSl8Ytt - for Drop Box file sharing & sync