Credit Union Geek

Marketing, Strategy, and The Force by Joe Winn

Tag: privacy (page 1 of 2)

Passwords. An Update.

Originally published on CUInsight.com

It’s a topic you’ve seen here before. Time and again. Of course, it’s still pertinent since we keep using them. Passwords are a bane of the tech world. Unless you can invent a simple way to authenticate yourself with any service, they’re going to stick around for a while. That doesn’t mean we need to despise them, though. In the past, we have discussed the problems on both ends, from policies that lead to creating awful passwords, to people insisting on using “love”, “*dogname*”, and “!23456”.

Grab your favorite password and…throw it in the trash (sadly, even “CorrectHorseBatteryStaple“). Because we’re back.

Like the question of eggs being healthy or your worst nightmare, passwords see a wide variety of advice as the years go on. Some of it is due to a long period of terrible advice (which we discussed before, and, I’ll admit, my own suggestions evolved, too). Thankfully, this is changing…slowly. The other part is based upon processing speed increases; it’s easier than ever to parse billions of possibilities (using databases of common passwords from leaks combined with dictionary analysis). So what’s the current solution?

It’s lurking in plain sight, on all your devices. The best password is one you never create. Every modern platform supports strong password suggestions. Then, they save these passwords in a secured database, so you don’t have to put a note in your drawer (it’s ok, you’re not alone). Depending on the system, there might be a master password, or, it can combine with biometrics. Make this be your big, strong password, then never use it. Rely on the fingerprint scanner, FaceID, or other verification system.

On iOS (that’s iPhone and iPad), the next version will have automatic strong (Apple calls them complex) password creation and storing. That means, when a site asks to create a password, your phone already filled in a really good one. Then it saves it so you never even bother thinking of something. To log back in, your phone just asks for verification through TouchID or FaceID (depending on device). This is new; auto-fill now has security, too. Yes, you still have to create a unique username. Sorry, MarioKartKing is taken.

There’s another side of this revisit: Updating your password. I know, I know, I spoke strongly against this practice in the past. My position is unchanged. If you change your password, make it for a good reason. A brilliant website called haveIbeenpwned.com checks your e-mail address or usernames to see if they were included in any breaches. If so, it shows which and to what degree. Then, you know it’s time to update those passwords (and anywhere else you shared those credentials). That password auto-suggest is looking mighty nice right now.

Here’s the bottom line: With password managers so prevalent and easy to use, there’s no excuse to still create your own passwords. It’s putting you (and the data within) at unnecessary risk. It also saves time. When I read of a breach on a service I use, I just go in, update that password, and get back to my life. Since it won’t be shared with any other system, I don’t care what someone does with the information. Granted, if passwords were stored in a way someone could access them, I’d be questioning the utility of said service, given their poor security practices.

Bottom line of the bottom line: Complex, random strings of characters, stored in a quality password manager, is the best way to ensure your personal (or corporate) information remains only in the hands you want.

Resources (A non-exhaustive list of password managers)

OS Based:

  • SmartLock for Passwords (Android/Chrome)
  • iCloud Keychain (Apple devices)

3rd Party:

  • Firefox Sync
  • LastPass
  • 1Password

Data Security: Car Edition. Really.

Originally published on CUInsight.com

When you hear “data security”, what comes to mind? Your laptop? Phone? Internet of Things “smart” oven? (I’d hate to let a hacker know how badly I burnt that casserole)

Anything else? How about your computer on wheels?

Modern cars are rolling supercomputers. They have dozens of systems collecting unique data to make your driving experience safer, more enjoyable, and sometimes more distracting. For example, the traction control computer collects information on road conditions hundreds of times a second. However, it’s probably not a source of identity theft (though what could be learned from its records would surprise you). Nor is the network of proximity sensors to help you navigate tight areas.

Your car does contain a number of personalized systems. Let’s look at the big ones:

GPS: Your car knows where it is at all times, where it has been, the paths you take, and even the speed at which those drives were made.

Bluetooth: When you pair your phone, it does more than share a 4-digit code. To automatically reconnect, the car remembers your phone’s unique ID. This isn’t a huge privacy issue on its own, but today’s cars save far more. To make dialing easier, a lot of systems import your contacts and synchronize your text messages. No big deal, just your entire phone book and call/text history.

HomeLink: Do you have buttons on your mirror or visor? Do they open your gate/garage? Then you have HomeLink. These can even support turning on/off lights, though new smart integrations have made that a bit redundant. Combined with the GPS history, this is the biggest privacy risk in your car. The former tells anyone in the car where your house is located. The latter Opens. Your. Home.

Those are the big three. Others vary by manufacturer and features. Things like a custom entry code (many Ford vehicles still use this feature…do not choose a birthday!) are seen on occasion. App integration is becoming more common, making your phone an advanced car key.

So, what of all these features? I’m a huge fan of integrations which make sense, and I use them often. However, I also know there is a level of security necessary. To add a small degree, I never program my actual home address into the GPS. The “point” is around the entrance to my community, not in my driveway. Do you really need those last 4 turns? Granted, someone could just find my address on the registration, but I’m hoping a potential thief is just too dumb to consider such an option. Why make it easy? Note: My garage opener doesn’t reach from the home “point”.

It’s good to know what these features can reveal while you have the car, but what about when you sell it?  Given the privacy/security risk inherent, I find it almost criminal that an easy “I’m selling my car, delete everything” button is not available in every car. For mine, I’ve had to do the following:

  1. Delete my phone pairing from the car.
  2. Remove the “Home” location in my GPS.
  3. Remove all recent waypoints in the GPS.
  4. Reset the HomeLink buttons.
  5. Cancel/transfer satellite radio service (technically, with an active Radio ID, one can use a phishing strategy to get my personal information from SiriusXM)

You’re right, there is no direct credit union guidance in this post. However, given my recent experience in buying a new car, I felt it necessary enough to share. Be honest, how many cars do you think are traded-in with the prior owner’s home address and garage code?

Help protect your staff and membership by sharing this with everyone! (And along with every booked loan)

Image credit: That’s me, while owning two cars.

Billions of Dollars for Data? You bet!

You may not have seen, but Microsoft just wrote a check few can imagine. In pursuit of a comprehensive business platform, they are acquiring LinkedIn for a staggering $26.2 billion. In cash.

It would be the largest acquisition in company history, far exceeding the $8.5 billion they paid for Skype. So what can a social media platform for job hunters, executives, general employees, and recruiters possibly have to offer for a software and services firm like Microsoft? I mean, they have Office. What else could they want?

Big Data. Hold on, let me rephrase that. #BigData. Because knowing the trends behind it helps to better understand the rationale. Remember that article CU Insight shared of mine about your members’ data? It’s truly big business, and whatever you aren’t doing, someone else is. Besides, it’s really about better serving your members, and using the information you already have is the best way forward.

I cannot stress enough the importance of embracing data to further your personalized offerings. And once again, you don’t have to be working with millions of people or data points. Just a few carefully-selected points helps you draw incredible conclusions. Sure, it will raise important conversations about member privacy. That’s a good thing. But you have to be doing it.

I’m here to help. Feel free to contact me here (the old-fashioned way) or on Twitter @JoeCUGeek. I promise your credit union can take substantive steps for less than $26B. Trust me, I’m a geek.

Image credit: http://www.aicpa.org/Advocacy/CPAAdvocate/PublishingImages/Data%20Tunnel.jpg

Older posts

© 2018 Credit Union Geek

Theme by Anders NorenUp ↑