EBay Users Should Change Their Passwords After Breach

EBay is urging users to change their passwords after a hack attack on a database with encrypted passwords and non-financial data. The database includes information such as customers' names, encrypted passwords, email and physical addresses, phone numbers, and dates of birth. As of the end of their first quarter, the company has 145 million active buyers.

What to Do About Heartbleed

So, what should you be doing about Heartbleed?

1. Know what it is: Heartbleed is the name of a major security vulnerability that may affect nearly two-thirds of websites online. It’s a severe situation potentially exposing your login information—your username and password—and other sensitive information about you.

2. Try to find out if the online service you are concerned about has updated their servers in order to compensate for the Heartbleed vulnerability. Do not change your passwords until you’ve done this. A lot of outlets are reporting that you need to do this as soon as possible, but the problem is that Heartbleed primarily affects the server end of communications, meaning if the server hasn’t been updated with Heartbleed in mind, then changing your password will not have the desired outcome. Mashable has a list of popular websites affected by the Heartbleed vulnerability. View that list, but keep in mind that this list is not comprehensive, but it is an excellent place to start.

3. Don’t be taken in by a phishing attack trying to get you to change one password on various services. Don’t go to a site where you want to or need to change your password from a link in an email sent about your password. Instead, manually head to the website yourself, log in, and then, change your password.

4. Keep an ear out about Heartbleed and other related security flaws, do some research on them, and then make the appropriate changes.

5. Think about getting a Password Manager program like 1Password to help you keep track of your passwords, let you change them easily and efficiently, and keep you from being tempted to use the same password for more than one site.

6. Understand that Heartbleed may just be the tip of the iceberg. Heartbleed "underscores the possibility that there are potentially so many vulnerabilities out there right now, right under our noses, that we don't quite realize. One of these days someone will -- and I hope the good guys find it first," Verizon's Bryan Sartin says.

Understanding Two-Step Verification

We wrote in the blog, a few weeks ago, that Apple was adding two step authentication to Apple accounts. The basic upshot is that two step means that when a person logs in they are asked to provide a shared secret as well as a password. Where the issue comes in is the shared secret, which may be one that didn’t exist a minute ago and won't be valid a minute from now: a numeric code generated on the spot and sent to a device that only you should have access to — your phone. Getting that message can be tricky if you have no phone service or are in some other sticky situation. To make sure you understand what you might be up against if you go the two step route, take a look at Q&A: What is two-step verification?

<

Apple Adds 2 Step Authentications

Apple recently added a tool that strengthens password security for Apple accounts: two-step verification, a feature widely available for many Web services.

The security feature, which has to be turned on manually at Apple’s Web site, lets a user receive a code on another device that can serve as a second password. For example, after entering a password to log in to iTunes or iCloud.com on a computer, the user receives a text message with a temporary four-digit code on his cellphone that must be entered as well to successfully log in. Many other online services, like Facebook, Google, and online banking Web sites, have been offering two-step verification for a while. For help getting started, see this Q. and A.

BYOD to Work – Security and Privacy Concerns Mount

Most companies have been all for the BYOD — Bring Your Own Device to work - trend that's been on the rise for a few years. Companies save costs, employees enjoy greater flexibility, and both reap productivity gains. But, security experts say that this year many employees who use their own devices may find their companies begin to impose much tighter restrictions because of security concerns. Concerns are on the rise about phones getting lost or stolen that can lead to someone outside the company accessing corporate information or malware installed on a phone brought into the corporate network that can begin spreading throughout the network. Companies are expected to roll out Acceptable Use policies for employees to sign this year and employees are urged to take the time to read and understand them as well as back up any stored data including contacts, messages, and favorite apps, they care to preserve.

Mac Users – What To Do Before Your Mac Catches A Virus

Experts have been warning recently that smug Mac users may get their comeuppance soon as hackers are noticing that Macs now encompass nearly 10% of the personal computer market and may be gearing up to send off a barrage of viruses. So should Mac users start thinking about anti-malware software? Dwight Silverman of the Houston Chronicle seems to think so and he has some solutions to suggest his article A Flu Shot for Your Mac . What he suggests is looking in a free software program called iAntiVirus, a new Mac program from PC Tools. Guess it was inevitable, huh?

Staying Safe in the Land of E-Commerce

Some people swear by online shopping, others wouldn't be caught dead making that seemingly fateful click-to-purchase online. Making purchases in both realms has its pluses and drawbacks. The truth is that in both realities the middle guy may be the biggest threat. Out in the real world, for example, the wait staff or clerk has possession of your credit card out of sight just as when you make an online purchase you have to trust that your credit card info is going to the right people who will send you what you are looking for. Always pour over your monthly credit card bill to make sure you haven't been scammed by the middleman. For more tips, see Staying Safe in the E-Commerce Jungle.

What Will Spock Know About You?

The founders of new site called Spock.com have set quite a task for themselves. They want to index information on every person in the world. Spock.com says it has already indexed 100 million people and is adding one million names per day on the invitation-only, test version of its Web site, which will be made available to the public in mid-August.  Users will be able to add keywords, pictures and other personal and professional information about people with an internal system on the site to filter out false information that could destroy the Web site's credibility. Each Spock.com user will have an "authority ranking" that can go down if the information provided for a profile is rejected.

You don't have to be an Internet privacy expert, though, to worry about possible abuse. These days, with some people checking things like their credit rating every day, you have to wonder if we all are going to have to monitor what's online about ourselves. Organizations like the privacy rights group Electronic Frontier Foundation agree. "More and more of our lives appear online, or are being organized online," Derek Slater, an activism coordinator at EFF says. "It can be very annoying to see so much of someone online, potentially without putting that (information) online oneself." And, by the way, people search engines have little to worry about legally. As third parties, they are not held accountable under U.S. law for putting on their Web sites information provided by others. Just one more thing to worry about, eh?

In Phishing Experiment, Students Take the Bait

Indiana University researchers say the best way to understand online security is to act like the bad guys. So they set out to send some phishy emails and were somewhat surprised to find students so readily taking the bait. In one study done in May, 72% of more than 600 students tested fell for an e-mail from an account intended to look familiar that sought usernames and passwords. Overall, the experiments found that hackers have the most success by using hijacked Web addresses or e-mail accounts that look real. The research also showed computer users generally have little knowledge of website security certificates and leave themselves open to attack with poorly configured routers or operating systems. Pretty scary considering this is the most digitally "with it" generation and shows that we all need to pay more attention to the email we open and where we "leave" our private information. But researchers also say that phishing attacks rely on human vulnerabilities such as greed, curiosity, ignorance and fear. Some things seem to never change.