How long should my password be? Minimum password length suggested
Posted by Frank in Computer Security on 23 August, 2010
We should start talking about passphrases and not passwords, according to one Georgia Institute of Technology study any a password shorter of 12 characters is vulnerable to attack, the length of your password, as well as quality, like using a combination of alphanumeric characters, does matter a lot when it comes to computer security.
A standard English keyboard has 95 letters and symbols and you should be taking advatadge of them to write full sentences as your password. Knowledge about a user may suggest possible passwords (such as pet names, children’s names, etc), hence estimates of password strength must also take into account resistance to this attack as well.
Password box
The ideal password length is 12 characters
The Georgia Tech Research Institure study on brute forcing passwords suggests a 12 characters password length in order to strike the right balance between convenience and security. Assuming a hacker can try 1 trillion password combinations a second, it would take him 180 years to crack an 11 character pass, this number would increase to17,134 years to crack a 12 character password.
How to create a strong password?
- Include numbers, symbols, upper and lowercase letters in passwords.
- Avoid any password based on repetition, dictionary words, letter or number sequences.
- Use capital and lower-case letters.
- Password must be easy to remember for and not force insecure actions like writing it down on notes.
According to one of the study authors if an attacker wants to crack many passwords quickly, once he’s built a rainbow table it might then only take about 10 minutes per password rather than several days. A rainbow table encodes the hashes of the most common passwords and uses that database to quickly run it against your hidden password.
Solutions to create secure passwords
Instructions to create the best random password possible: Diceware
Store your passwords encrypted online: LastPass
Free secure password manager for desktop computer: KeePass
Security and encryption applets for Android phone
Posted by Frank in Computer Security on 4 July, 2010
The Android operating system allows for great customization due to its open source nature. If you own a smartphone that runs Android you will want to take care of your personal privacy and security, smartphones can store lots of personal data, you should be using encryption and anonymous proxies on the Android as well as your desktop computer.
Free Android security applets for encryption
RedPhone (Free): Provides end-to-end encryption for your calls, RedPhone uses ZRTP, an open source Internet voice cryptography scheme created by Phil Zimmermann, inventor of PGP encryption.
TextSecure (Free): All text messages sent or received with TextSecure are stored in an encrypted database on your phone, and text messages are encrypted during transmission.
OpenPGP (Free): OpenPGP for Android is open source, it helps you manage encryption keys (GPG/PGP) and encrypt/sign/decrypt emails/files.
OI Safe (Free): Store password securely using the AES encryption algorithm, encrypt OI Notepad notes and it support the premium Obscura picture safe to encrypt pictures on your Android smartphone.
CipherLog (Free): CipherLog™ is a simple journaling software that encrypts your entries, enabling you to store sensitive data on your device.
Password Safe Lite (Free): Keep your Android passwords and confidential info safe using 128bit AES.Encrypted information will be stored in a database on the phone and no information is kept online, the database can be backupby exporting it.
B-Folders (Free): B-Folders is a secure fully encrypted database password-based 256-bit AES algorithmwhere to keep passwords, trade secrets and financial info. With its sync technology you can sync all your phones, desktop and laptop computers.
Keeper (Free): It allows you to securely store all your secret information such as logins, passwords and financial info using 128-bit AES encryption.
PGP manager encryption android phone
Premium Android security applets for encryption
PGP Manager (€/$): PGP & PBE encrypt & decrypt, sending encrypted email using the Android OS, creation of PGP keys, Symmetric encryption and decryption (password-based) with selectable algorithms.
MyStash (€/$): MyStash encrypts sensitive files you use on your Android device, this Android encryption applet secures your files using the TripleDES encryption algorithm. Photos and movies become viewable only by entering a pre-selected 4-digit pin.
Password Juggler (€/$): Password Juggler safely and easily stores all those hard to remember passwords for quick easy access. Password Juggler uses a 128 AES Cipher to securely store your passwords.
Android applets for anonymous communications
Orbot (Free): Orbot allows mobile Android users to access the web, instant messaging and email without being monitored or blocked by their mobile internet service provider. Orbot integrates the tor proxy to the Android mobile operating system.
Android NewsGroup Downloader (€/$): Android Newsgroup Downloader handles all types of newsgroup attachments, it supports posting of binaries and SSL encryption. You will need a Usenet provider too.
Free online services to send encrypted email to people without encryption software
Posted by Frank in Computer Security on 25 June, 2010
Sending emails it is just like sending postcards, anyone who comes accross them can read the content. If you find it too hard to use encryption software such as PGP, you can resort to encrypt messages online on a website and send the encrypted text, or post it to Usenet, for the intended recipient to retrieve.
Online Services to Encrypt Text Messages
Lockbin: Lockbin is a free service for sending private email messages, the great thing of Lockbin is that it has an integrated online form and you can send the encrypted email from their own website.
WebSecureEmail: All encryption is done on your browser in JavaScript and sent as PGP encrypted secure email directly to your communication partners email address.
LockMyStuff: It encrypts your sensitive information so it can be safely transmitted over unsecure channels. Once encrypted, the original data can only be recovered using the encryption key.
FlexCrypt: Flexcrypt Online Text Encryption allows you to encrypt any text so that only those with the right password can decrypt it.
EnetPlanet: JavaScript implementation of Block TEA (Tiny Encryption Algorithm) done only on the client computer browser with JavaScript. There is no information sent or stored anywhere during encryption and decryption.
Hardened Padlock
All of the free online encryption services above are free and do not require you to install any extra software in your computer, just an internet connection.
You may also use a compression program like PeaZip, 7Zip or BCArchive to send your encrypted message or file to someone without encryption software installed and with little knowledge of computers, this is very easy to use and free, just add a password when you compress the .txt file, your recipient will only have to enter a password to read it and it will not overwhelm them if they are not too computer savvy.
Comodo Secure DNS Review
Posted by Frank in Computer Security on 24 June, 2010
Comodo Secure DNS’s server infrastructure is spread around five continents, your DNS requests will be answered by the closest available set of servers. I swapped my ISP DNS for Comodo Secure DNS nearly a year ago and everything has always worked fine, no downtime at all and excellent DNS resolution speed.
Comodo Secure DNS also blocks parked domain names giving you a warning that the page is blocked and offering yout the Yahoo search box instead, that is how they finance their free service, you also get the same warning when you type non existant URL or make a typo.
For what I have seen from Comodo Secure DNS most of the parked domain names are not blocked, my guess is that Comodo is attempting to guesswhat domains are parked by looking at the website DNS, ie some parking services use the same DNS, and if they don’t use it, which is not mandatory, Comodo Secure DNS will not detect them, over 50% of parked domains get through their filter.
Domain Name Server diagram
Comodo Secure DNS review conclusion
Setting up Comodo DNS is really simple, their site has easy to follow instructions with screenshots, best of all Comodo Secure DNS is free and their DNS speed is good, I have run some benchmark tests on Comodo DNS with NameBench and their servers get top results all the time.
The only downside I see to Comodo Secure DNS is that their filtering of parked domain names should be optional and as far as I know there is no way to change this.
The customization options for Comodo Secure DNS are non existant, if you need a family filter, you will be better off with OpenDNS.
Use Comodo Secure DNS to get around ISP censorship
If you travel to a country that filters the internet, like China, Arabia Saudi or Australia, do not just rely on a VPN to bypass ISP internet filtering, you most likely will also have to change the router Domain Name Servers given by the local ISP as well, this happened to me when I went to China for a week, Comodo Secure DNS together with Anonymizer Universal™did a great job at bypassing the Great Firewall of China (using only the VPN did not work!!).
Visit Free DNS tools and utilities
Personal Disclosure: Anonymizer Universal™ has an affiliate link code included.