
Ensure the Safety of your Personal Information on the Web
Your bank offers you access to a website for managing your account, and your mortgage company soon follows suit. Then your credit cards send you notices that you can log in and check balances or pay bills. Pretty soon, the company that holds the note on your automobile sends you a notice that they have created an account for you where you can log in and pay your bill, followed suddenly by your electric company, water company, and gas company, all offering the same web-enabled, value-added websites for account management and billing. Many consumers are understandably and rightly concerned - that’s a lot of your life now on the web! How secure is it? What should you watch out for? What services should you use and which should you avoid? How should you manage all of the passwords and accounts? Read on, and those questions, and others, will be answered.
Web based access to financial information is convenient, but is it secure? It can be. Banks and credit card companies now have legal requirements for security - that’s why you’ll encounter “enhanced security” notices on those accounts. They will usually want you to provide questions and answers that can be used to further validate your identity, much like the venerable “What is your mother’s maiden name?” that we’re all familiar with from phone authentication procedures. Some such sites will force you to authenticate your browser, by sending you an email with an authentication code - this security step depends on the general wisdom that the more bits of identity you control, the more likely you are to be, well, you.
What this means from their perspective is that you have the account name and password - needed to log in - and you have the username and password for that person’s email address. Each identity fragment we require reduces the probability that someone is pretending to be you, although no such procedure can be absolutely certain, this type of process can get pretty close.
It’s important to be certain that your communication with any of these types of sites is encrypted. Many current sites offer the login and password box on an unencrypted page, but still direct that login information to a secure page in a secure manner. You can test this by first using a random username and password, click “Login” and watch the browser address bar - if it immediately switches to an “https” address, it’s probably a secure system. Again, if you have questions, don’t hesitate to call the provider and ask them to explain their security to you.
There are two considerations to take into account when you’re asked to create an account on your provider’s website. The first is their handling of re-registration. Credit card management sites often allow you to re-register with the same information and transfer your account to the new registration. In this case, there is no imperative to registration because it doesn’t add to your account security. If the provider registers your account to one registration and refuses to connect it to another, you may want to register regardless of whether you need the website features - this keeps someone else from registering as you, and with many sites, alerts you if someone tries. In any event, read through the features the website offers very carefully and decide if you will need any of them. If so, go ahead and register; if not, call the provider and see if they can permanently prohibit your account from being registered on the web site.
When you decide you should create an account, make certain you choose a password that’s very difficult to guess, and a unique password for each site. Passwords that are difficult to guess are made up of a combination of numbers, letters, and symbols, both upper and lower case. One way to make the passwords more memorable is to pretend they’re custom license plates like you see on cars around down - “IH8Fr0gz”, or “L8rMa+e”, for example. As long as you get a combination of upper case, lower case, and numbers, that is at least 8 characters, you will have a fairly secure password.
This can make it difficult to remember all of the password combinations, however. There are a couple of ways of approaching this problem of tracking them. There is one school of thought in security that says you should simply commit them to memory, that any attempt to record them in any way is a breach. This is fine if you have 2 passwords to remember, or if you have a photographic memory, but for most of us, it’s just not rational. Instead, we can use a piece of software called a “password keeper”. These programs allow you to enter various combinations of information - say, website address, username, and password - and then save them to an encrypted file that you access with a name and password. This way you only have to remember one name and password, which gives you access to all of the others. If you do this, make certain the program you choose has very hard encryption, and make sure your password is both memorable and difficult to guess - any compromise of this system exposes all of your usernames and passwords, so protect the file carefully.
The second process is similar, only for encryption we substitute “a safe place”. Many security advisers caution against recording passwords at all, but the real problem appears when people write them on sticky notes and attach them to the monitor. Instead, ideally, we would record the authentication information on pieces of paper and lock them in a physical, locked safe. If this is impractical, we can try storing those passwords and usernames where we keep our other financial records. After all, if you’re trying to protect your credit card account, anyone who finds your records already has anything they can get from that web site. Same with your bank - if they find all of your loan records and statements, they’ve got all the information they can get from the web site. A significant second advantage of this particular method is that if anything should happen to you, your wife, husband, daughter, son, best friend - anyone you trust enough to share the combination of the safe with - will be able to access those sites for information.
When you’ve made your own accounts as secure as you can, what remains is the security of the website itself. Every website is different, and has a different Webmaster, who may make different security decisions than the next fellow, based on differing assessments of risk. All security decisions are trade-offs of risk and access. We can make a site so secure no one can access it, or we can make it so convenient that anyone can - even people we don’t want accessing it. If you have any questions, contact the support address on the website and ask them what their security is like - don’t be shy, because it’s your information they need to protect. Most commercial sites are as secure as their engineers know how to make them, but, inevitably, some get compromised; there’s no process that results in complete, bulletproof security.
This brings us to the discussion of phishing. “Phishing” is a generic term that describes the process of sending emails or redirecting web access to get users to give up their login and password to important sites, by fooling them into thinking they’re logging into the actual site . In a common scenario of this type, you might receive an email from someone claiming to be your bank, asking you to log in to their website and update your username, password, social security number, and other important account information, and often threatening to close your account if you don’t. They even provide you with a convenient link that says “mybank.com”, and include icons and logos from your actual bank website. The most important thing you should know about this type of attack is this: no legitimate site should ever send you such an email. Your first response to an email like this should always be profound suspicion. Dead giveaways for scams like tNote (Online Security for the Web), 24 May 2008, 12:52his are URLs that look similar to your bank’s actual site. For instance, if your bank is at “mybank.com”, you may find URLs in these sorts of emails that direct you to “mybank.info”, or even “mybankinfo.to” - and sometimes, the most brash of them will have a bare IP address like “10.2.3.2/myinfo.php”. Frequently there will be significant spelling or grammatical errors in the email, as well, as there are certain parts of the world that originate the bulk of this kind of email, where English is a second language. These are all red flags, but never forget that no one should ever send you a legitimate email like this, and if you receive one, always contact your provider by phone to report the phishing attack, because they may need to alert other users to the attack’s existence. If you received such an email, you can guarantee thousands of others have, as well.
There are a few of things to remember here. Make good passwords and protect them, create accounts only when it’s beneficial to you, make certain your provider is using encryption, beware of phishing attacks, and if you have any questions, call your provider. They have your information on their website, and they’re responsible for protecting it once you’ve done your share as described here. The web can be a scary place when you start thinking about information and security, but if you pay attention to this guideline, you’ll be better prepared to face the risks with confidence.