Cyber Security For All

Apetech Website: https://www.apetech.me/

https://anchor.fm/apetech/message

Email: [email protected].

Twitter:  @apetechda

I’ll be reviewing the following 4 password managers.

Lastpass

1Password

Bitwarden

Strongbox

Security Policy:

LastPass: https://www.lastpass.com/security/what-if-lastpass-gets-hacked

1Password: https://support.1password.com/1password-security/#:~:text=Your%201Password%20data%20is%20kept,cryptographically%20secure%20pseudorandom%20number%20generators.

BitWarden: https://bitwarden.com/blog/post/vault-security-bitwarden-password-manager/#:~:text=Bitwarden%20uses%20end%2Dto%2Dend,password%20can%20decrypt%20your%20vault.&text=Since%20your%20data%20is%20fully,store%20encrypted%20and%20hashed%20data.

Strongbox: https://strongboxsafe.com/

Getting Started/Initial Thoughts:

Lastpass - Easy to get started.  Prompts 2FA if you log in from a new location.  You can create the following secure items:   See screenshot.  Alternatively, when you visit a website that requires a password, LastPass notification pops up if you want to add.  It’s best to use the popup because it saves metadata that manually entering passwords doesn’t do.  I really like it.  But maybe it’s because the interface is red and red is my favorite color

1Password - Chrome extension.  Web interface is not as intuitive, but once you have a vault set up, you can add items.  Has a built in password generator and audits your existing stored browser passwords.  Tells you which ones you should change because passwords might be compromised.

Bitwarden - Clean and simple interface.  You get down to the brass tax right away.  Very intuitive because they store your passwords.  This is a password manager.  Nothing special.  No bells or whistles.  You just get a tool to store your passwords and a few other things.  Command line interface available and you can host bitwarden on your own server so you don’t have to go to the cloud.

Strongbox - Accidentally installed Strongpass.  Realized my mistake and then downloaded the right one.  Please note that this is only an iOS or Mac app.  I really don’t like that there’s no web interface.  The app has a ton of features and is open source, but you need to use an apple based app.

Lastpass - This is the one I’m keeping.  It offers the most features.  The Free version covers everything I would need.

1Password - I didn’t really like the interface, but other than that it’s very close to LastPass.

Bitwarden - If I only want passwords, this would be my go to. I just felt it’s missing too many features.

Strongbox - Too limited.  Only works on iOS and Macs. I live on all types of devices.  Not for me.

Apetech Website: https://www.apetech.me/

https://anchor.fm/apetech/message

Email: [email protected].

Twitter:  @apetechda

In this episode, we are going to talk about 3 ways you can protect your files with a password

Sometimes you don’t want to encrypt your entire hard drive or folder.  Sometimes you just want to encrypt a specific file.  PDF’s, Word, and Excel files are usually the most common types of files that folks like to encrypt.  Password protecting a file means that you can share a file, or put it in a public place, but people can’t access it unless they know the password.  This is perfect for sending confidential information to a coworker, or for selling electronic books.  Even if someone gets a hold of your file, without the password, they will not be able to see the contents of the book.

A good reason to password protect your files is if you use public document sharing sites like dropbox or google drive.  As you may know, Google Docs doesn’t offer password protection on their files.  So, people can create a Word document, password protect that file, and then upload it to the cloud.  Now, it’s much safer and only the intended audience can view the contents of the file.

If you are password protecting a Microsoft Office file, the steps are super simple to add this extra layer of security.  First, go to  File -> Info -> Protect Document -> Encrypt with Password.

Next, type a password and confirm the password by typing it again.  Finally, save the file and confirm the password took effect by trying to open the file.

Like all the topics I’ve been writing about here, not everything is ever 100% secure.  This is just adding layers of security to your files.  Other ways of protecting your files is to encrypt your email, send via an encrypted USB, use encrypted cloud providers like Box.

In addition, sometimes you may want to encrypt a bunch of files all together. In that case, you can put all your files in a zip file and then password protect that.  This isn’t as easy or straight forward as with Microsoft Word, but the same theory applies.  The biggest difference is that you’ll need to install special software on your computer that allows you to zip and password protect your file.  Some are free, others are paid.  I personally recommend using 7-zip as I’ve been using it for years.

Another great benefit of using a zip file is that you can basically encrypt any type of file. You are no longer bound by just MS Office or PDF’s.  You can encrypt music, movies, and even malicious data such as viruses or spyware.

That about wraps it up for this week's episode.  Let me know if you enjoyed this episode by reaching out to me on Twitter at apetechda.  I’d love to hear from you!  Stay tuned for next week’s episode where we take a look at 3 different password managers and answer your top questions about their use and effectiveness.

Apetech Website: https://www.apetech.me/

https://anchor.fm/apetech/message

Email: [email protected].

Twitter:  @apetechda

In this episode, we are going to talk about Encrypting your sensitive files on your computer.

Whether you are on a pc or mac, you have the ability to encrypt and password protect folders on your computer.  This is a really neat feature that doesn’t cost anything and adds an additional layer of security on your computer.  If you want to be super safe, you can encrypt your entire hard drive, but for the purposes of today’s topic, we are going to focus on just encrypting a folder.

What is folder encryption?  Folder encryption is pretty simple.  You pick a folder on your computer, or create a new one.  You then follow the simple steps to encrypt a folder.  

https://www.comparitech.com/blog/vpn-privacy/encrypt-windows-files/.  

https://www.intego.com/mac-security-blog/how-to-use-apples-built-in-features-to-encrypt-files-and-folders/

https://itsfoss.com/password-protect-folder-linux/

What this does is it scrambles the information stored in that folder and only a password can unencrypt it.  Whenever you want to access the information in that folder, you’ll be prompted to enter a password.  If you forget that password, then the content of that folder are gone forever.  Because of this you’ll want to make sure you pick a strong, safe, but easy to remember password.  Feel free to listen or watch one of our previous episodes where we discuss how to create a password.  If anyone were to ever physically gain access to your computer, they can’t see the contents because they don’t have the password. If they try to copy the folder to a different computer, they will not be able to see the data either because the values are encrypted and will not assemble the appropriate data without the key, which is the password.

But, why would you want to encrypt a folder?  Well, there’s a couple of reasons.  First, you may want to consider encrypting a folder on your computer that contains sensitive information.  This information could be things like tax information, confidential information, or something as simple as pictures.  The information encrypted is typically something you don’t want someone else getting their hands on.  Companies encrypt entire hard drives because they don’t want any of their proprietary information being leaked.  Similar idea, but specific to a folder only.

Next, you may want to encrypt a folder because even if you delete files from your computer, they aren’t really deleted unless you perform a proper hard drive deletion or destruction.  If you ever sell your computer, or if someone gains physical access to your hard drive, encrypting folders allows you to rest assured that your data is unreadable by anyone else.

But just because you encrypted your data, it doesn’t mean that it’s 100% secure.  An algorithm was used to encrypt your data, which means that if someone figures out the algorithm used, they could potentially reverse engineer it.  If you write down your password and keep it close to your desk, or if someone finds it, well it doesn’t matter that you encrypted your folder at that point.

Apetech Website: https://www.apetech.me/

https://anchor.fm/apetech/message

Email: [email protected].

Twitter:  @apetechda

In this episode, we are going to talk about why you shouldn’t save your passwords to your browser.

If you use a modern browser such as Chrome, Firefox, or even Edge, then you’ve probably seen a little notification that pops up when you first log into a website.  It asks you if you want to save your username and password.  How convenient you think.  How awesome is this is probably another thought that crosses your mind.

While it can be a tremendous time saver have your browser store all those passwords for you, there are some serious drawbacks that I’d like to highlight in this episode.  If you have ever used your browser to store your username and password, you’ll want to stick around because we’ll be discussing some the biggest risks you have if you utilize that feature.

Okay, so I’m not going to lie.  I’ve used the feature on the browser that allows you to save your password.  It almost immediately pops up and whenever you change your password, it reminds you to update your stored credentials to match the new ones.  This is an amazing feature.  Best of all, it stores your unique passwords for each website.  Every time you come to the website, there it is, prefilled for you.  Life can’t get any better.  Except there are some issues with using this feature.  Let’s jump into it.

First, every password is saved on your one browser.  In order to see the list of all those passwords, all you need is the administrator password for your computer.  This one feature ruins it.  It doesn’t matter how safe, strong, and unique your password is. It doesn’t matter if you use a different username and password for every website.  It doesn’t matter if you update your passwords every 90 days.  None of that matters if only 1 admin password can show and expose all of your hard work.

With one password, an attacker can gain access to your entire catalogue of usernames and passwords.  In my opinion, this isn’t very safe.  You might be thinking, but I’m the only one that uses my computer.  Well, what happens when you sell or pass on your computer to someone else?  Do you take the appropriate precautions to wipe your computer clean?  What if you have your admin password written down and someone finds it in your house?  They then have access to every stored password.  Worst case scenario, you log into a public computer and save your username and password.

The next problem is that it makes you forget your password.  Because you never have to retype your passwords, your passwords are more likely forgotten.  Easy solution, write your passwords down. . . but then we are back to violating password safety guidelines.  I’ve met countless people that depend on the browser saving their passwords that they need to reset their passwords whenever they log in from a different device.  This then begins an endless loop of constantly having to reset your password because you forget what you change it to.  Then your previous browser still has the old one saved and the new password doesn’t work because you forgot it.  So then you update it in that browser and the cycle continues.

Moral of the story, if you can avoid it, please don’t use the browser to save your passwords.  It’s much more secure to use unique passwords that are long and easy to remember so you can avoid having to save them or writing them down.

Apetech Website: https://www.apetech.me/

We just crossed over 50 listens to our podcast and super excited to hit our goal of 100! To everyone that’s listened, thank you very much.  If there’s a topic that you want us to cover, please let me know.  You can call in your questions or email me at [email protected].  Link for the voice messages in the episode description.  Also don’t forget to check us out on social media.  We’re pretty active on Twitter so, make sure to follow us!

https://anchor.fm/apetech/message

Twitter:  @apetechda

In this episode, we are going to talk about what to do if your password is hacked.

A password is never 100% safe.  Any company, at any time can get hacked and your password can be stolen.  Because of this harsh reality, there's a good chance that your password has already been compromised.  If you suspect that your password has been hacked or compromised, there’s a couple of things you need to do immediately in order to minimize your exposure.

First, and this is the most obvious one is go directly into all the accounts you have change your password there.  Do NOT, under circumstance, click on a link from an email stating your account has been compromised.  This is a phishing attempt and you can very easily fall victim of this type of attack.  If your password wasn’t actually compromised before, if you click on the link and follow through, your password sure is compromised now.  By going to the website directly, you control the URL that you visit and you can check for SSL encryption as well.  We’ll be talking about it in a future episode, but you should be updating and changing your passwords regularly, regardless of a known hack or not.

The next thing to do once your password has been compromised is to set up 2 factor authentication.  By doing this, you add a layer of security and if someone tries to change your password, then they’ll also need to have your phone or some other item in order to continue.  Keep in mind, if you password is compromised, an attacker may know your password.  If they use your password on lets say your banking website, they log in as you.  Once logged in, they can change the password, keeping you out.  With 2FA, the system will prompt for a code or something that typically goes to your cell phone via text or email.  This added layer of security will either deter the attacker or prevent them from changing your password.  If you ever get a 2FA notification and you didn’t “trigger” it, change your password immediately.

The last thing to do once your password has been compromised is to change your user names.  Having a compromised password is one piece of the puzzle.  The second piece is knowing the username.  Oftentimes, as we are creatures of habit, we use the same username for a lot of different places.  If your password is compromised and usernames happen to leak, or your username is something like your name, an attacker might be able to log into your account and make changes.  Changing your username often adds yet another layer of security.

The focus of this article was mainly on if a website you use gets hacked and their stored passwords are compromised.  There are of course many other ways to get your password compromised such as having a keylogger installed, a social engineering attack, a phishing attack, and many others.  No matter the situation, it’s a good practice to enable 2FA AND change your passwords often.  It’s better to be safe than sorry.

Apetech Website: https://www.apetech.me/

Welcome to episode 5 of the Apetech Podcast.

We just crossed over listens to our podcast and super excited to hit our goal of 50! To everyone that’s listened, thank you very much.  If there’s a topic that you want us to cover, please let me know.  

You can call in your questions or email me at [email protected].  

https://anchor.fm/apetech/message

Twitter:  @apetechda

In this episode, we are going to talk about passwords for your kids

With most, if not all students going to school remotely, all of them now need to have a password to utilize their digital tools.  If your student is anything like my child, then you know that they aren’t very good at dealing with passwords.  They simply don’t understand the importance of a password and how critical it is to not share that password.

If your kids are like mine, their minds are in their minecraft and roblox world.  Their perspective on life is innocent and pure.  They don’t understand the perils of the internet.  Thus, it is so important to teach your kids about the dangers of the internet.  They need to be taught how to utilize this powerful tool in such a way that they are safe.  And it all starts with passwords.  Well not really, but for the purposes of this episode, let’s assume that passwords should be one of the first things kids need to learn about.

There are some options currently available on the internet, but after looking at them, I wouldn’t personally recommend them.  The passwords are too “simple” and not very secure in my honest opinion.  Services like dinopass create easy to remember passwords for kids, but they can be cracked in seconds.  Don’t use that service, if you want a very secure, yet simple to use password for your kids, keep listening.

Here’s the takeaway:

Students need safe, strong, but EASY to remember passwords.

Like all good passwords, the same principles that apply to adults works for students.  So, what makes a good password for students?  Let’s take a deep dive.

We’ll start with the most important part.  Passwords need to be easy to remember.  That means that the password needs to be something memorable to them.  This means that it’s something that’s important to them.  So, the first thing to do when creating a strong password is to pick something that is special to you.  This should be fairly easy to determine for your kid because kids are passionate about a lot of things.  Pick one and let’s move on to the next phase.

Passwords that are long in character length, make for the most secure passwords.  Just because a password is long, doesn’t mean it’s hard to remember.  When you combine it with the first suggestion, you’ll get a long password that kids can remember easily.  For example, these passwords can be passphrases or sentences that they can remember.

Finally, add a number or special character to make things a little more complex, but still just as easy to remember.

After all of that here’s a good password for you kid.

MyFavoriteIsSpid3rM@n!

This password is easy to remember, very long, and has special characters, capitalization and numbers.  You have officially created the best password your child can have.

No more needing to write it down.

Now all you’ll have to worry about is teaching your child how to type!

Apetech Website: https://www.apetech.me/

Twitter:  @apetechda

Welcome to episode 4 of the Apetech Podcast.

We’ve also enabled voice messages on anchor, so if you want to call in your questions:

https://anchor.fm/apetech/message

In this episode, we are going to talk about using wireshark to find passwords.

Wireshark is an amazing tool that is typically used for monitoring network traffic.  Wireshark is such a powerful and capable tool that there are many books written on the tool.  The tool is completely free and and can help uncover many things about a network.  Since the topic of wireshark is so massive, I’m going to focus this episode on just talking about using Wireshark to find passwords.  If you are interested in wireshark, let me know in the comments or on social media and I’d be more than happy to do a deeper dive into this tool.  There are two different uses of wireshark that can help you find passwords.  First, sending sensitive information over a non-secure website is a simple way of seeing passwords using Wireshark.  The second method is to capture an image that contains a password.

Alright, let’s get into the details.

First, if you haven’t already, download wireshark.  It’s a free tool and it can be found at: wireshark.org.  I recommend getting the latest stable build, but if you are feeling lucky, get whatever version you want.  There’s lot of documentation and tutorials on wireshark available on the website.  Feel free to give them a watch.  I wont go into much details in this episode, but you should still be able to follow along even if you’ve never used wireshark

Fire up wireshark and start listening to your network of choice.

Make sure you hit capture and watch a bunch of information flood the screen.  You don’t have to pay special attention to any of this just yet.

But this traffic is traffic coming in and out of your computer.  If you want to see all the traffic on that network, then you want to enable promiscuous mode.

Open up your browser of choice and head on over to any website that doesn’t use encryption.  Since most websites use encryption, this is going to be harder to do.   Assuming you find a website that’s unencrypted, you can watch Wireshark as each character from your computer is passed through the network.

You’ll see something to the effect of:

W

Ww

he next way of capturing sensitive information is via pictures.  If you are transferring pictures over an unencrypted medium, then those images can be captured by wireshark.  The images aren’t immediately easy to see.  But once you are done capturing traffic, you can sort and search by JPEG.  From here, you can see a list of all the images captured during the traffic capture.

In order to find passwords, you’ll have to be patient.  You are looking for pictures of stickies or documents that have their passwords written on them.

If you are interested in wireshark, let me know in the comments section below, and I’ll make more episodes on wireshark.

https://www.instructables.com/id/How-to-Find-Passwords-Using-Wireshark/

https://blog.packet-foo.com/2016/07/how-to-use-wireshark-to-steal-passwords/comment-page-2

Welcome to episode 3 of the Apetech Podcast.  I hope you are having a fantastic day.

We’ve also enabled voice messages on anchor, so if you want to call in your questions, link in the description.

Send us messages:

https://anchor.fm/apetech/message

Alright, enough of the chit chat, let’s get into today’s topic.

In this episode, we are going to talk about passwords for all smart devices you have in your home.

We all have them at home, whether they be smart light bulbs, smart cameras, smart voice assistants, smart fridges, smart whatever you can think of. . . these technologies are making it into homes across the world.

They make our lives easier and it’s neat that the technology we dreamed about 50 years ago is slowly tickling into our every day lives.

These devices are great.  I can’t deny that I have my fair share of devices at home and use them on a daily basis.

But are they safe?  What risks are you accepting by having these devices in your home?  Let’s talk about that today.  I’ll be covering 5 basic things you should be doing to protect yourself and your devices.

1) Default Password

2) Different Accounts

3) Manufacturers

4) 2 Factor Authentication

5) App Permissions

Well that wraps up our episode for today.

If you liked it, please consider subscribing and hit that like button.

Hopefully I didn’t scare you too much.  These devices are great.  They help us do things that are usually boring or mundane.  They are getting better every year.  Just be careful and use some of the tips I provided today to keep yourself and your family safe!

In this episode, we are going to talk about 2 factor authentication.

In the most simplest terms, two factor authentication means using two different methods of authentication to verify that an individual indeed is that person.

The good - makes your account safer

The bad - still hackable, but it’s harder

The ugly - it’s annoying when you are in a hurry.

Something you know - passwords

Something you are - biometrics

Something you have - badge, phone

Something you know - This is a password.  This is something in your mind that no one else knows.  Security questions - only you technically know them.

But this isn’t enough.  Someone else might figure it out.  By itself, it’s not safe.

Facebook questionnaire.  Asking you where you grew up, your favorite color, etc.

Biometric - using some element of your body to identify yourself.

Fingerprint, face recognition, retina scan, hair, voice.

Something you are utilizes a biometric to identify an individual.

Something you have - something physical that no one else should have.

Badge is a good example.

Your phone, along with a text or email another good example

Individually, these are just authentication methods.  But, when put together, you get 2 factor authentication.

Simply put, you use 2 items from the list above, to authenticate a person.  This makes it harder for hackers to get into an account, because they have to have 2 pieces.

While this solution isn’t 100%, it’s still better than just relying on a password.  An attacker has to go the extra mile to get one of the other items.

Security by layers.  Most attackers are lazy.  Unless this is a targeted attack, 2 factor will deter most attacks.

In this episode, we introduce ourselves, Alex and Bernandina Ortiz.  We are the founders of Apetech LLC, an IT and Software services company.  We work with small business to help them get online and secure all their digital assets.  Check us out at apetech.me.

The focus of this episode is to help our listeners learn about different types of attacks hackers perform in order to compromise your password.  We offer tips to protect yourself and your business.  

More episodes will be added further outlining password protection and best practices.  Subscribe to our Podcast so you never miss out on this critical information.