Archive for RB

2015’s Worst Passwords

2015's Worst PasswordsFollowers of Bach Seat know that passwords suck. For even more proof that passwords suck, the password-management company SplashData released its fifth annual list of the most popular passwords. SplashData studied more than 2 million passwords that were leaked in 2015 and identified the most commonly leaked passwords and those that were least secure from Western European and North American users according to Business Insider.

2015’s worst passwords

SplashData logoMost of the 2015 results are not surprising.

  • 123456 is the most common password. It has been #1 since 2013.
  • Password is the second most common password. It too has been #2 since 2013. Password was the most common password in 2012 and 2011.
  • 12345678 is the third most common password found in the Splash data results. In fact, 12345678 has been the most consistent performer, having been in the #3 place four of the past five years.

One surprise was that the Disney marketing machine was able to get Star Wars related terms into the top 25 worst passwords in 2015.

  1. princess
  2. solo
  3. starwars

Here’s SplashData’s full list. If your password is on here, think about changing it.

25 Worst passwords

20152014201320122011
1123456123456
123456
password
password
2passwordpasswordpassword123456
123456
3123456781234512345678
12345678
12345678
4qwerty12345678
qwerty
1234
qwerty
512345qwertyabc123qwertyabc123
612345678912345678912345678912345
monkey
7football1234
111111dragon
1234567
81234baseball
1234567pussy
letmein
91234567dragoniloveyou
baseball
trustno1
10baseballfootballadobe123
football
dragon
11welcome1234567123123
letmein
baseball
121234567890 monkey
admin
monkey
111111
13abc123letmein
1234567890
696969
iloveyou
14111111abc123
letmeinabc123
master
151qaz2wsx111111photoshopmustang
sunshine
16dragonmustang1234michaelashley
17masteraccessmonkey
shadow
bailey
18monkeyshadow
shadowmasterpassw0rd
19letmeinmastersunshinejennifer
shadow
20loginmichael
12345
111111
123123
21princesssupermanpassword1
2000
654321
22qwertyuiop696969princessjordansuperman
23solo123123azertysupermanqazwsx
24passw0rdbatmantrustno1harleymichael
25starwarstrustno10000001234567football

 

Protect yourself

keep your passwords secureTo keep your passwords secure, you definitely shouldn’t use any of the passwords on the list.

SplashData offers three simple tips to help people protect themselves:

  1. Use passwords or passphrases of twelve characters or more with mixed types of characters;
  2. Avoid using the same password over and over on different websites
  3. Use a password manager such as SplashID to organize and protect passwords, generate random passwords, and automatically log into websites.

rb-

What to do if you are responsible for securing systems where your users use these passwords? Stop Them!

This is what makes passwords suck – Implement complexity rules:

  • Minimum of 8 characters
  • A mix of characters, UPPER CASE, lower case, numbers, and special characters.
  • Prevent reusing passwords
  • Blacklist all the above passwords so they can never be used again.
Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Ford to Make Google Cars

Ford to Make Google Cars The 2016 North American International Auto Show started today at Cobo Center in Detroit so let talk about autonomous cars. Ford and Google are in talks to have the Dearborn,MI-based automaker build Google’s next-generation autonomous cars under contract, Automotive News has learned. A source with knowledge of the project says both parties have been negotiating on the deal “for a long time.” An announcement, if finalized, could come as early as the International Consumer Electronics Show in Las Vegas.

Ford logoNeither firm would confirm the reports for the record. Google (GOOG) officials did confirm that the company is talking to automakers. Ford Motor Company (F) official Alan Hall did say, “We work with a lot of tech companies all over the world. We keep these discussions private for obvious competitive reasons and we do not comment on speculation.

Google loading up auto executives

To fan the rumors, two veteran Ford executives have recently joined Google. Former CEO Alan Mulally joined Google’s board of directors eight days after he retired from the automaker on July 1, 2014. Then in September, Google hired John Krafcik as CEO of the company’s Self-Driving Car Project. Mr. Krafcik, who most recently was president of TrueCar Inc., was CEO of Hyundai Motor America. He spent 14 years at Ford, including a stint as chief engineer during the development of the Ford Expedition SUV.

Google logoFord is scheduled to hold a press conference on Jan. 5 in Las Vegas. Ford CEO Mark Fields, product development chief Raj Nair, research and advanced engineering vice president Ken Washington, and Don Butler, executive director of connected vehicles and services, are scheduled to attend.

Yahoo Autos reported on the negotiations, quoting three sources familiar with the deal. The sources said the deal would create a joint venture legally separate from Ford. The venture would shield Ford from potential liability. The agreement, if completed, also would be non-exclusive, meaning Google could negotiate a similar deal with another automaker.

Autonomous vehicle

CEO Fields recently gave Auto News an update on Ford’s Smart Mobility efforts. The initiative would bolster the company’s expertise in car-sharing and other new business models for transportation. He said. “It’s not about just going from an old business to a new business. It’s about going to a bigger business.

Auto News theorizes that a Ford deal with Google would fit within the strategy laid out by CEO Fields. He commented during an interview:

It’s not only about what are the things that are going to be core to us but who are we going to partner with. I don’t think we can just be so arrogant to think that we’re going to do everything on our own and we’re going to do something better than maybe a company that does that 24/7. For us, partnerships are really important.

New mobility models beyond cars

During a visit to Ford’s Silicon Valley research facility in Palo Alto, CA, Mr. Fields signaled that Ford sees new mobility models as a way to grow its business. When asked why Ford is developing its own software for self-driving cars, rather than striking a deal to use best-in-class software from an outside vendor. Ford’s Fields joked that Silicon Valley practically invented the concept of “frenemies.” In a corporate context, that means companies are willing to simultaneously collaborate on projects and compete against one another. Ford’s R&D center is working on self-driving software, Mr. Fields said, “that doesn’t mean we won’t work with others. I think that’s part of the beauty of being here.

PartnersSuch a partnership would mark another step toward the marketplace for Google. Bloomberg reported that Google is thinking of putting its technology into automated taxis as a rival for Uber and Lyft. Google may spin-off the unit into a standalone business within its new Alphabet Inc. corporate structure in 2016.

Ties between Ford and Google

It isn’t clear whether Ford would design a purpose-built vehicle for Google or supply a standard production car fitted with the sensors and computers that the car needs to guide itself down the road.

Having Ford build Google’s test fleet would save the Silicon Valley tech giant years and billions in development costs. The Ford-built vehicles would use the automaker’s production-ready powertrain as well as safety and emissions components.

There are already ties between Ford and Google. Google’s first generation of 100 self-driving vehicles were assembled in Detroit by Roush Industries, a company closely aligned with Ford. The bubble-shaped cars, as Crain’s Detroit Business reported used components from local Detroit area suppliers.

Thilo Koslowski, lead automotive analyst at Gartner (IT) in Santa Clara, CA said it makes sense automakers would want to work with Google, which could help them catch up to rivals that are pursuing automated driving to differentiate their products.

And at Google, “the focus has shifted to looking for OEM partners to deploy the technology, rather than considering building their own vehicles,” The Gartner analyst said. “That makes sense. If Google is interested in bringing the benefit of the technology to consumers, then they need as many partners as possible.”

Ford and Google are said to have been in talks since at least 2012 on autonomous cars. The two companies also teamed up in 2011 on technology that would help vehicles learn customers’ driving habits and get them to destinations more efficiently.

VP Washington said recently that he expects fully autonomous vehicles to be ready within four years. Ford has secured approval from California to test its own autonomous cars in California. Ford has been testing autonomous Hybrid Fusion’s at the University of Michigan’s 32-acre simulated city Mcity.

rb-

Autonomous cars will increase the direct impact of the Internet of Things (IoT). With all of IoT’s inherent security and connectivity issues.

 

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Beat Stress & Boost Happiness

Beat Stress & Boost HappinessJust in time to make a New Year Resolution, interactive game, and social media site Happify has created an infographic that teaches us about stress and how we can boost happiness.

Titled ‘How to beat stress & boost happiness’, this infographic gives valuable tips on how to beat stress in easy ways while avoiding any stress-induced illnesses.

How to beat stress & boost happiness

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Happy New Year

Happy New Year

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Target Wish List Leaking Your Data

Target Wish List Leaking Your DataThe holiday shopping season has not been merry for mega-mart Target. You would think the mega-retailer that leaked info on 110 million customers would learn how to keep their customers’ info secure but NOOOO. The anti-virus firm AVAST has discovered the Target (TGT) Wish List app is leaking your data, your personally identifiable information (PII).

Data leakThe Avast Blog says that if you created a Christmas wish list using the Target app it is leaking your data.  it might be accessible to more people than you want to actually receive gifts from. The Target app keeps a database of users’ wish lists, names, addresses, and email addresses.

Alarmingly, for a firm that has privacy issues, the Target app’s backend interface is not secured. This allowed the database to be accessed over the Internet. The author reports that the Application Program Interface (API) is easily accessible over the Internet. An API is a set of conditions where if you ask a question it sends the answer. Also, the Target API does not require any authentication. The only thing you need to parse all the data automatically is to figure out how the user ID is generated. Once you have that figured out, all the data is served to you on a silver platter in a JSON file.

Leaking your data

while developers investigate

The JSON file that the AVAST researchers requested from Target’s API leaked lots of interesting data. The leaked data included: users’ names, email addresses, shipping addresses, phone numbers, the type of registries, and the items on the registries. The AVAST researchers did not store any PII, but they did aggregate data from 5,000 inputs for statistical analysis.

The AVAST researchers took the sample and looked at which some of the data they got. It included; brands, states the Target app users are from, and the most common names of people using Target’s app.

Leasked info

This appears to be a classic case of security by obfuscation. The app developers created the online API for data that is uploaded by Target. They also set up a separate API in tandem so that the retail chain could download and process the uploaded data – but without any security measures in place.

Target has reached a $39.4 million settlementIn a post on Ars Technica, a Target spokesperson said that it has suspended elements of the app while developers investigate. Hopefully, this should mean that the data-leaking has stopped while the backend has been disabled.

In other Target data breach news FierceITSecurity reports that Target has reached a $39.4 million settlement with banks and credit unions over claims they lost millions of dollars as a result of the massive 2013 data breach at the retailer. The massive data breach at Target exposed the credit and debit card numbers of 40 million customers to hackers and personal information on another 70 million.

The settlement, if accepted, will resolve class-action lawsuits by the banks and credit unions seeking reimbursement for fraudulent charges and issuing new cards. Of the $39.4 million, $20.25 million will be paid to banks and credit unions, and $19.11 million will be paid to reimburse MasterCard card issuers.

cautionary taleThis follows settlements that Target reached with Visa card issuers for $67 million and with customers for $10 million. Target estimated that the breach so far has cost it $290 million, with insurers picking up $90 million, according to a filing with the Securities and Exchange Commission last week. Target is not out of the woods yet. It still has to deal with shareholder lawsuits and a probe by the Federal Trade Commission and state attorneys general related to the data breach.

Fred Donovan at FierceITSecurity says Target is a cautionary tale for any enterprise. Despite handling billions of dollars in credit card transactions, the retailer did not have one person responsible for IT security at the time of the breach. While it had a network security system in place, it did not have IT security personnel skilled enough to recognize an alarm the system set off months before Target discovered the breach.

rb-

Cash is king, especially at Target.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.