A major vendor of point-of-sale terminals has not changed the default passwords used on its devices in a quarter of a century, researchers have revealed at RSA 2015.
The post Point-of-Sale vendor has used the same admin password for 25 years appeared first on We Live Security.
The humble password has struggled in recent years, and is often seen as vulnerable to attackers. The interactive infographic below offers up some alternatives. Click on the tabs to read about the options.
The post Infographic: Alternatives to the password appeared first on We Live Security.
Most people have dozens of passwords, for dozens of online accounts. At times it can be tricky to remember them all, as best practice says they should all be slightly different.
If you’re one of these many people, Yahoo’s recent announcement may get you excited. Earlier in March, Yahoo revealed an innovative idea that would mean we never have to remember a password again.
The concept is very simple. By selecting to use one-time passwords in your account settings, the next time you login it will send a password to your phone that you can use to login in with via a SMS.
While this seems very convenient, is it secure?
Generally speaking, there are three types of authentication in use today
The Yahoo solution seems to be half way between the least secure option A and Option B.
Sending a password on demand to a device is a step in the right direction, but there may be other security risks involved when transmitting data over SMS and to a potentially unprotected device.
The phone may not have a passcode and could be infected with malware that reads the SMS. This could mean the email account and all the data inside gets compromised.
If you do want to enable one-time passwords, I would recommend you have both of these: a passcode and AVG AntiVirus for Android on the phone to keep yourself protected.
Using the mobile device to add another layer of security is a smart idea as most people have one. Most of us also use apps regularly and if you’re a Yahoo user then you probably have the Yahoo app.
I would change the delivery method of the password from SMS and instead deliver it, in an encrypted format, via their own app.
On top of this, the Yahoo app with this one-time passwords enabled should require the device to have PIN security.
This would mean that an attacker would need the ID, the phone and the PIN in order to access the account. The app could even go further and check for the presence of an Anti-Virus product to ensure that it’s being scanned regularly.
It could be that there are currently technical limitations with one-time passwords, and that in the future we’ll see a lot more secure and comprehensive process.
My top advice right now though is if you’re going to use this service then be sure to have a security app and a PIN on your phone so you can help ensure that the password is being sent to a secure device.
Follow me on Twitter @tonyatavg
Twitch has backed down on its attempts to force stronger password complexity on its site post-hacking, after multiple complaints from its userbase.
The post Twitch backs down on 20-character passwords in wake of hacking appeared first on We Live Security.
A British bank has been trialling a different type of biometrics, allowing their customers to confirm their identity via heartbeat according to the BBC.
The post British Bank trials heartbeat based authentication appeared first on We Live Security.
Account holders with Toys “R” Us have been informed that their passwords will be reset, after unauthorised third-parties attempted to gain access to the company’s reward program.
The post Toys “R” Us resets account passwords to counter stolen reward points appeared first on We Live Security.
Follow these top 5 security resolutions from We Live Security to make for a safer 2015.
The post Top 5 security resolutions for 2015 appeared first on We Live Security.
WWE superstar Antonio Cesaro was the victim of a Twitter hack this week, as a wrestling fanatic hacked his account to vent against company chairman and CEO Vince McMahon.
The post Hacker puts words into wrestler’s mouth in WWE Twitter hack appeared first on We Live Security.
Is it time for big companies – at the very least – to abandon weak password security? If so, what password alternatives are there?
The post What are the alternatives to passwords? appeared first on We Live Security.
Gamers using Raptr and AMD Gaming Evolved chat services should change their login details immediately, following a breach that could give hackers access to names, email addresses and passwords
The post Raptr gaming hack leaves user passwords and personal info exposed appeared first on We Live Security.
