Monday, January 23, 2012

Security_System_Passwords

10 world's worst passwords are-
password
123456
12345678
qwerty
abc123
1234567
dragon
iloveyou
letmein
monkey

Things to remember-
  • Never ever reveal your password to anyone--------------- Revealing password to even your relative or friend could become dangerous if he happens to use it in public computers like libraries or wrote it down somewhere which later read by some third person. So avoid to reveal to anybody.
  • Never write down your password------------------ Writing down the password increased 34% chances of gettng it disclosed so avoid to write it down and even if you write it down just wrote it in breaks i.e. one portion of password at one place and other portion of it at somewhere else, if you want to write it down at one single place then make some changes in the password which only you knew.
  • Test and change your password regularly----------------- A very regular practice indeed to have a check it occasionaly and even change at regular intervals to avoid hack.
  • Dont enter log-in details for the doubtful links------------------- Its easy to avoid those links which are not trustworthy and most of the times these are the links which usually steal personel information of novice internet users.
  • Always logoff, if your system is around others---------------------Remember to have your system LogOut whenever displaced from your seat when your system is in public hands. It is good practice to follow as one is not even aware of things that can be of much greater use besides your passwords.
  • Dont type your password in public computers(Libraries etc.)-----------------------filling up passwords in public places like libraries could end up with password theft as there are chances of malware in these systems due to 24*7 insecured internet connectivity at these places.

Some cruelling statitics about the passwords-

1)50% chances that the password has atleast one vowel.

2)Capital letters are usally at the begining followed by the vowel.


Tips for strong passwords-
  • Include puntuation marks or numbers.
  • Mix capital and lower case letter.
  • Make an acronym from a phrase.
  • Use substitution like the number zero for the letter 'O' or 'S' for the $
  • Include phonetic replacements as "Luv 2 laf" for  Love to Laugh


Avoidation in weak passwords-
  • Dont reuse passwords for atleast a year
  • Dont use a duplicated good password as sometimes people search on internet for some good examples of strong passwords and use the same for their accounts which is not a good practice to follow and often resulted in password theft.
  • Dont use the same passwords for multiple account as it sometimes become easy for the hackers to get the information for all the accounts
  • Dont use a password with personel information(name, date of birth etc)
  • Dont use dictionary words
  • Dont use repeating characters(222TT)



For Online Presence Its Good practice-


1)Use of password Manager
LastPass, KeePass, 1Password, Stenagos and Kaspersky Password Manager

2)Turn on Gmail two-Step Verification--------------it enhances security as it enables a code sent onto your listed mobile number in the second step of the two stage login process and the same computer can be remembered for 30days if you are using a personel computer.

3)If you’re in the habit of checking e-mails or Facebook status updates in coffee shops or on public WiFi networks, it’s important that you uses a virtual private network (VPN) to encrypt your activity and keep private data out of the hands of malicious hackers.

4)Encrypting Full Hard Disk---
Without encryption, forensic software can easily be used to bypass an account password and read all the files on your computer.

5)Routine backups---
No body can understand this factor more then me, as i lost my backup data therefore lost EVERYTHING.

6)Uninstall  "Java(TM) 6 Update 29"   Publisher-Sun Microsystem, Inc as it is most targeted by hackers using "ExploitKits".

7)Use Latest Version Softwares installed onto your system as automatically reduces the chances of being exploit by a malware which is removed in the new version. Eg Adobe Reader X didnt identified a single malware while the earlier versions do have.

Wednesday, January 11, 2012

Security_System

For those who might think that the photos that are uploaded in your profile is not safe from any second person from whom the photo is hidden, might think again and thanks to the security system adopted by the fb.
let me confront you with the way the numerous url are made in the dynamic manner or at run time that nobody can even view your photo or may be(if he is you)!!!!!


(I use "shem" in place of "Facebook")

lets make an environment of a profile to make the understanding a bit easy for the fb users or in their own manner:

Suppose there a profile of a user having profile id= 10000000000000(15 digit number and this is variable number)

Suppose the user has three albums named as
a) Wall Photos
b) Mobile Uploads
c) December Birthday

All three photo albums of the user is kept under a link in profile called- "Photos"

4)When a user click on the link "photos" then the URL consists of:

https://www.shem.com/?sk=photos

5)When a user click on link "Wall Photos" then URL consists of:

https://www.shem.com/media/set/?set=a.(AlbumNo1).(MagicNo1).Profileid&type=3

here-
AlbumNo.1= a unique one time generated number for a particular album of the user(Length = 15 digits)
MagicNo.1= a number generated in accordance with the album no. and its length= 4-5 digits(max 5)
Profile id= its a unique number given to every profile on fb which in some of the user cases is replaced by a name

6)When a user clicks on any of the 6 photos inside the album "Wall Photos" then 6 URL's are-

a) https://www.shem.com/photo.php?fbid=(photono1) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater
b)  https://www.shem.com/photo.php?fbid=(photono2) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater
c) https://www.shem.com/photo.php?fbid=(photono3) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater
d) https://www.shem.com/photo.php?fbid=(photono4) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater
e) https://www.shem.com/photo.php?fbid=(photono5) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater
 f) https://www.shem.com/photo.php?fbid=(photono6) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater

Note= the difference between the different photono is only the last 9 digits out of the 6 starting digits
i.e.

fbid=145111578945689 
fbid=145111412356974
fbid=145111457986523
fbid=145111147852369
fbid=145111897916478
fbid=145111781124589
here one can see that the starting 6 digits are same where as the last 9 digits changes with the every photo.

7)When a user clicks on the link "Mobile Uploads"

https://www.shem.com/media/set/?set=a.(albumno2).(magicno2).profileid&type=3

8)When a user clicks on any of the 6 photos in mobile uploads then the 6 URL are like-
https://www.shem.com/photo.php?fbid=(photono7) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater
https://www.shem.com/photo.php?fbid=(photono8) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater
https://www.shem.com/photo.php?fbid=(photono9) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater
https://www.shem.com/photo.php?fbid=(photono10) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater
https://www.shem.com/photo.php?fbid=(photono11) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater
https://www.shem.com/photo.php?fbid=(photono12) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater

Again note that the photono generated here is that 15 digit value only where the first 6 digits are same and the rest of the digits are different.
fbid=208340898754652
fbid=208340451223457
fbid=208340784124517
fbid=208340598756235
fbid=208340547896325
fbid=208340147894796

So it result into some crucial results which describes the security provided in fb ie. the fbid which a 15 digit number is generated for every photo on fb of a particular user whereas the album number and the magic number is the one time generation which is created with the each album creation.So overall the URL's thus generated for the each album and the photo is dynamic due to random creation of these numbers and therefore if sombody happens to enter such URLs then he wont be able to find the one for the photo or the album which a particular user hide it from the users of fb around the globe.