Security: Choosing and Storing Passwords

Best: Password Manager
It's 2022. Everybody should be using a password manager to store and randomly generate different complex passwords for each website they use. There's a lot of good options on this front. Even the simple password managers built into your browser work pretty well. For most people, using Google Chrome, Mozilla Firefox, or iCloud Keychain is sufficient.

If you want to use a third party for whatever reason, LastPass served me well, although the free tier only allows you to store passwords on one device: mobile or desktop. I am now using 1Password, which is almost perfection, although it costs $3 per month.

I could write a whole article about which password manager is best, but the important thing is to use one. They generate secure passwords instantly, obviate the need to remember more than one password, store your passwords in a secure location, seamlessly sync mobile and desktop (except LastPass free tier), and tell you how secure each password is. Many password managers have other features like reporting to you when a password was found in a breach, informing you of your reused passwords, and keeping a history of used passwords.

But if you must, I'll list some other options.

How Hackers Crack Passwords
Before we get into how to generate a fancy hard-to-guess passwords, let's talk about why we're doing this and not just using "Password1!" for all your passwords.

The first way a hacker might get access to your account is to just guess your password. If it's just your name backwards, that's easy enough to guess. In fact, that was the password to my brother's electronic organizer in the 1990s (don't tell him I cracked it!). Similarly, hackers know to guess "password", "123456789", "qwerty" and other similar easy passwords.

Assuming the website you're using has good security (uses good hashes, with salt, etc.) another way a hacker might try to guess your password is to reuse one of your passwords from a website with bad security. For example, until a few months ago I still had an email account at excite.com, which had an insecure login page. That means anyone with basic hacking skills could steal my username and password for that site. Obviously, no one uses Excite for anything important anymore, but people do reuse passwords from site to site. If I reused my Excite password elsewhere, I'd be begging to be hacked at those other sites.

Lastly, a hacker might crack your password by simply trying all possibilities aka brute force. If the website you're using doesn't have very good security, a hacker can try different passwords rapidly. In fact, hackers can try a billion different passwords per second. Here's a chart showing how the speed of a cracking password is related to password complexity.

Chart from Hive Systems

This is why many websites require a password of at least 8 characters that must comprise uppercase letters, lowercase letters, numbers and symbols.

Next Best: Hidden, Secured Password Documents
As we have shown in the previous section, passwords should not be guessable, should not be reused across different sites, should have at least 8 characters, and should be composed of different types of characters.

The next best option to using a password manager is to generate these passwords yourself and keep them in a secure location. There are plenty of password generators on the Internet (ahem). The question is: how will you store your passwords securely? Your passwords are surely too complex to remember. You should also have access from your computer as well as from your phone.

For a while, I stored all my password in a text document that I uploaded to a mobile app. I changed the extension on the text document, so it wouldn't open in a word processor. The mobile app (IDrive) was secured with a password, so no one could open it without knowing one of my passwords.

This was a decent way to store my passwords, but was cumbersome and meant I had to manually sync my passwords by uploading my password file every time I changed or added a password. For those of you who don't like or trust password managers, this might work.

Perhaps Instead: Easy-to-Remember Passwords
There are several easy to guess password ideas:

• Memorable password generators
• XKCD: Four random words
• Uncommon word or phrase with substitutions (like "Tr0ub4dor&3", what XKCD was making fun of)
• Motor patterns, shortening words, etc.

In an ideal world you could simply remember your passwords using these hacks.

Actually...
But you won't. Memorable passwords won't work. The average person has 100 passwords, and whether you use the password generator or something super memorable, it doesn't matter: you simply won't remember all of your passwords. Secured storage is key and you can't get better storage than a password manager, as mentioned above. If you're very meticulous and organized, maybe you might not need a password manager, and instead can do something like I mentioned above with a hidden text file uploaded to the cloud.

But chances are you're not going to do that. You're going to have a Microsoft Word document or a physical notepad full of your passwords. And that's fine if no one ever will have physical access to your machine. But that won't fly at a professional workplace, on shared computers, or on a laptop owned by someone who travels a lot.

For most people in the modern world, a password manager is a necessity.

Code: Easy-to-Type Password Generator

Sections (between 4 and 20):
Section Length (between 1 and 20):
Default More Readable

----

People who care about security use hard-to-crack passwords, generally generated by a password generator to have a random mix of uppercase letters, lowercase letters, numbers, and symbols. Those four requirements are often required for website passwords, along with a minimum length and other requirements. However, a password like 3gK*&>5%bZY)sH:D can be hard to type, especially on certain devices. For example, typing out passwords for video game consoles is a huge annoyance, as you generally have to hunt and peck with a cursor across a software keyboard. That cursor is controlled by your video game controller. This can be more difficult than a hardware or a capacitive touch (mobile) keyboard, which are both controlled directly with your fingers and you can input multiple letters in rapid succession.

The on-screen keyboard on a PlayStation 4. You must press a button to access capital letters or for the symbol keyboard. I don't know why there are there two f's on this keyboard.

It would be easier to type such passwords with a better keyboard. But since we can't use our phones to input passwords to our game consoles, nor do we want to pay for expensive game console keyboards, it's simpler to just generate a password that's easy to type. What would make the passwords easy to type? Putting all the types of characters next to each other. Uppercase letters go in one continuous section of characters, lowercase letters go in another section of characters, numbers are colocated, and all symbols also go next to each other. This way, you're not constantly switching the keyboard type for every character you input, only each section.

What about security? You can still keep good security by having a password be long, using a crypto-safe pseudorandom selection, not only for each character, but the order of the character type sections. If you like, you can add extra sections, picked randomly of course. A password of 3045krkfEYTB{+:_ is hard to crack. A bad actor doesn't know the order of the sections, nor do they know which characters are selected within each section.

Meanwhile, you only switch keyboard types (from default to number* to lowercase to uppercase to symbols) a maximum of four times. That's way fewer than the 13 keyboard switches needed to type 3gK*&>5%bZY)sH:D, a password of equal length. It's more secure than the easy-to-type password, but the easy-to-type password is already secure enough (takes years to crack).

If you want to see exactly how secure the algorithm would be, let's compare:

Assuming you have 27 symbols, there are 27+10+26+26=89 different characters to choose from with a regular password. A password of length 16 means there are 89^16=1.5e+31 or 15 nonillion possibilities. A high number for sure.

With an easy to type password of four sections (minimum) and a length of four characters per section (default), let's first calculate the permutations on the sections P(4,4)= 24. Then each section has 4 characters, allowing repeats. For digits that's 10^4 = 10,000. Each set of letters is 26^4=456,976. Symbols is 27^4=531,441. Multiplying those together gets you 2.6e+22 or 26 sexillion possibilities. The easy-to-type password is less than a regular 16-character password by 9 orders of magnitude, but it's still quite tough to brute force. And that's if your hacker already knows you're using this generator with the default settings.

Compare it with the much more popular 8-character password, which has roughly only 3.0e+15 or 3 quadrillion possibilities (number of symbols varies). The easy-to-type password is stronger by 7 orders of magnitude. And you can play with the number and length of the sections to make it even stronger. Keep in mind, you still have to switch keyboard types many times when typing in the traditional 8-character password, even if you have to switch fewer times than with a 16-character password.

Because I was interested in this idea, I decided to code it up in JavaScript, and because I like getting to the point, I posted my implementation up above. I set the section length minimum to 1 in case users want to generate a regular-style password, but if using a section length of less than 4, I highly suggest using 8 or more sections. Passwords are generated completely client side; I don't save or send the results anywhere at all.

You can also find the code at: https://github.com/omaric/easytypepass

* I suppose there isn't a numbers-only keyboard type on most onscreen keyboards. Still, I think numbers deserve their own section in this password generator.

Tech Support: Step-By-Step Procedure for Removing Viruses and Other Malware

So, you've got a virus. Or maybe you don't. All you know is you have a Windows PC and the damned thing isn't working like it should. I’ve had this issue countless times, and approximately twice I ended up having actual malware. There’s a few ways to proceed in a situation like this.

You can call tech support for help, but that costs money and takes time. Or you can download and install Trend Micro HijackThis, run it, and post the log on some computer tech support forum. That seems to work for a lot of people, but requires finding the right forum and waiting for kind computer geeks to solve your problem.

Finally, you can try to get rid of the malware yourself using a good malware removal tool. In this article, I’ll describe this option, taking you through my usual process of diagnosing and removing a computer malware from a computer.

"Malware" is any malicious software, including worms, trojans, and viruses. "Anti-virus" is used to refer to any software that can get rid of malware. For a complete dictionary of malware types, check out Viruses, Spyware, and Malware: What's the Difference?

Diagnosing How Bad It Is
First, turn on the computer. If the computer won't turn on--like nothing shows up on the monitor--then you're kinda hosed. It probably wasn't malware. Malware that can damage hardware or wreck your firmware (i.e. your motherboard BIOS) is rare. It's likely that your hardware is broken for other reasons, like being super old or you dropping your computer down a flight of stairs. Seek help elsewhere.

If the computer turns on, but won’t boot into Windows. Several things could be wrong. It could be your hardware, or perhaps malware just corrupted your Windows installation. In any case, that’s more advanced than what we’ll try to solve here.

If the computer turns on and boots into Windows, but you have weird problems there--popups asking you to buy something to “fix” your computer, your browser has been changed to a spammy homepage, your anti-virus won’t run, etc.--then you might have typical malware.

Removing the Malware Manually
When you start up your computer, even before you open your web browser, do you get popups telling you how to fix your computer or speed up your computer? Did you install the program that’s telling you this?

If you have some unknown program that’s telling you that it can fix your computer, you have malware. This is the most common malware I’ve seen in the last few years. One example I recently uninstalled from a friend’s computer was a piece of malware called PC Fix Speed.

image from malwaretips.com

PC Fix Speed and similar fake anti-virus programs want you to be concerned about fake issues with your computer so that you’ll pay them for the full version of their software or for customer support. This type of malware is called "scareware" because the intent is to scare you into paying for their services. God knows what happens after you pay them (is the “fix” a program that uninstalls their own malware?).

Getting the Fix
Download Malwarebytes Anti-Malware. This program’s preventive anti-virus capabilities may be mediocre, but its ability to find and remove existing malware is unparalleled. In the several years I've been using it, I've found no better product for removing existing malware on a computer.

If downloading the software using Internet Explorer doesn’t work, try a different browser. Once I had to deal with malware that had hijacked Internet Explorer, making visiting any website impossible. Firefox and Chrome are a bit more secure.

If you still can’t download Malwarebytes Anti-Malware for whatever reason, you’re going to have to use a different computer to download it. Transfer the installation file (usually named mbam-setup.exe or something similar) to a USB flash drive or external hard drive and then use that to transfer it to your malware-ridden computer.

Closing the Gates
Once I no longer need the Internet, I unplug network cables from my computer and turn off the computer’s wifi, if it has wifi, in case the malicious program is spyware. Spyware can upload files from your computer so that hackers can obtain your passwords, credit card numbers and other personal data that can be used for nefarious deeds. Turning off your Internet prevents this.

Installation
Install Malwarebytes Anti-Malware. If you’re really unlucky, the malware has hijacked your registry and taken control of executable files. Installation will not work, and instead a different program will open, or the installation file won’t open at all. This happened to me once. I couldn’t open any programs at all except for the malware.

Getting Control of Your Executable Files (If Needed)

1. Boot into Safe Mode (Directions) and log in to your account or the Administrator account.
2. Click the Start button and type regedit in the Search box.
3. Right-click Regedit.exe in the returned list and click Run as administrator.
4. If a popup asks you if you want the program to be able to make changes to your computer, click Yes.
5. Browse to the following registry key: HKEY_CLASSES_ROOT\.exe
6. With .exe selected, right-click (Default) and click Modify…
7. Change the Value data to exefile.

8. Browse to and then click on the following registry key: HKEY_CLASSES_ROOT\exefile
9. With exefile selected, right-click (Default) and click Modify…
10. Change the Value data to "%1" %*
(That's quotation marks, percent sign, one, quotation marks, space, percent, asterisk.)
11. Browse to and then click on the following registry key: KEY_CLASSES_ROOT\exefile\shell\open
12. With open selected, right-click (Default) and click Modify…
13. Change the Value data to "%1" %*
14. Close the Registry Editor and restart your PC.

Directions edited from Microsoft Support.

Running Anti-Malware

Malwarebytes Anti-Malware

Once Malwarebytes Anti-Malware is installed, run it by clicking Scan Now in the bottom-right corner. Scanning takes a while. Select and remove all malware that Anti-Malware finds.

Install an Anti-Virus
Now your malware is (hopefully) gone. If you don't have a anti-virus program already, install one to prevent this from occurring again. I use Microsoft Security Essentials, but I've used Avast and AVG in the past. If you don't mind paying some money, McAfee and Norton make anti-virus programs that are probably better than the free options I listed.

Good luck!

Tech Support: How to Speed Up a Slow Computer

Occasionally, I provide tech support, and the most common issue my clients have is an excessively slow computer.  This happens to all computers over time (even Macs, but to a lesser extent I'm told).  Disk fragmentation, malware, poorly written software and memory leaks all can contribute to this problem.  What can be done to speed up an old, slow computer?  There are several options:

1. Free up disk space: Although some tech experts suggest this (e.g. Microsoft), I don't recommend wasting your time with this.  I'm mentioning only because it's commonly thought that this is an effective measure in speeding up your computer.  It isn't.  Unless you have less than, say, 10 GB of free disk space–a rarity in this day of obscenely large hard drives–this will likely do nothing to speed up your computer.  The only thing deleting files will likely do is speed up the time it takes to load whatever folder you have cleaned up, which I suppose could be noticeable if you have hundreds of files on your desktop that can be deleted or moved into other folders.

2. Defragment your hard drive: Freeing up disk space can only speed up your computer if you have very little free disk space.  However, disk fragmentation can occur even on large hard drives with lots of free disk space.  Unless you have over 50% free space or have recently defragged, I'd give defragmenting a try.

To find Windows' defragmenting utility, go to My Computer (Windows XP) or Computer (Vista), select your C:\ drive, and launch the disk properties by holding down Alt and pressing Enter.  Go to the Tools tab and press Defragment Now.  Defragmenting can take several hours.  I recommend defragging XP machines at least annually.  Newer machines with larger hard drives may not need defragging as often.

Or, for much faster defragmenting, use a 3rd party disk defragmenter, like Auslogics Disk Defrag.

3. Remove Extra Programs: The most likely cause for a slow computer is the footprint left by installing programs.  New services may be added, the registry is augmented, and new programs may run in the background, using up memory and processor time.  All these things slow the computer down.  The biggest offenders are malware and other programs that silently run in the background.

Whenever I remove programs to speed a computer, I always start with the web browser toolbars that are inevitably installed.  This doesn't do much to speed up the computer but can speed up the user's Internet browser and these toolbars are almost always unused anyway.  I then remove any other unnecessary programs, usually multiple copies of anti-virus software, anti-malware software, firewalls and other "helpful" programs.  A single computer only needs one anti-virus program constantly combing the hard drive (I use AVG Free, but I also recommend avast! Free Antivirus, Norton, or McAfee).  Other anti-malware programs are not as important, especially if you have Windows Vista or Windows 7, both of which have adequate built-in firewall and anti-malware programs.  However, if you feel the need to supplement your anti-virus program, I'd suggest Malwarebytes' Anti-Malware or something similar to scan your computer weekly or less often.  Having more than one program constantly scanning your computer is just going to bring your computer to a grinding halt.

There are other unnecessary programs that may be running in the background.  Special screensavers, custom cursors, ubiquitous hardware utilities (the things HP installs on your computer before you buy it), and other alliterative programs are all "fun" utilities that often run in the background and are launched at startup.  Check your lower-right  taskbar for these programs and uninstall them if you can, or at least stop them from running at startup.  Disabling programs from running at startup may require using MSCONFIG, which I don't recommend for anyone but advanced users.  Windows Vista and 7 can simply use Windows Defender to disable programs that run at startup.

4. Restart: This may be an obvious one for some, but I had one client who was having speed problems with his computer because he simply hadn't restarted or powered down his computer in months. PCs need to be shut down every now and then.  I'm not sure how often, but I'd recommend restarting weekly.

5. Add RAM: The problem with your computer could be hardware.  Upgrading to a faster (7400 rpm or SSD) hard drive or getting a faster processor would definitely speed things up.  However, these fixes are expensive, time consuming and sometimes difficult if you are trying to put new parts in an old computer.  The cost of getting the tech guys at Fry's to install a SSD and new processor can be more expensive than buying a new, low-end computer.  A cheap, quick fix is to simply install more RAM.  Simply find out what kind of RAM you have, buy more of it (512 MB – 1 GB is good for Windows XP, 4 – 6 GB is good for Windows Vista and 7), and pop that stick in your computer.

6. Fix your hard drive/registry: Other tech experts recommend things like scanning your hard drive for bad sectors and using registry cleaning utilities.  Most hard drives that I have scanned don't have bad sectors.  As for registry cleaning software, I've honestly never tried any.

7. Reinstall Windows: The nuclear option.  Sure, it takes a long time to back up all your files, reinstall Windows, update Windows, reload all your files, and reinstall all your programs; but this will make your computer run like new again, unless you have a serious hardware problem.  The older your computer is, the more noticeable the difference.  If this doesn't work for you, it's time to buy a new computer.