The mystical art of password hacking just isn't as mystical as it once was. With a number of powerful free programs, a person can easily gain access to most computer systems. A number of articles claiming "Recover Lost Passwords" have sprung up recently claiming to help users do just that. I would like to argue that all these articles do is peek the interest of ordinary computer users and giving them the tools to do serious damage. A recent post on lifehacker.com is a great example: http://lifehacker.com/394039/recover-lost-passwords-with-free-tools
I urge everyone to read this so they understand just how vulnerable those passwords you lock away really are.
My lesson to you:
1. No computer is secure when a malicious user has physical access to the system.
2. Wireless networks are easily compromised.
3. Data going over wireless networks is not secure.
4. Think about your network (is it secure), the users on that network (do you trust them), and the application you are accessing (do you trust the app provider) before transmitting any sensitive information over the net.
And just for good measure an example:
I want to check my bank account, my email, and IM with a friend and i'm at my local starbucks. Starbucks has an open wifi network which you must be a subscriber to in order to access the internet. There are three other people sitting in the corner with laptops open.
1. Is my network secure? NO !!! Anyone can access the network and start capturing packets. All my passwords may become exposed if they are transfered in clear text.
2. Do I trust my fellow network users? NO !!! 3 strangers sitting in a starbucks hidden behind laptop screens. They might be doing something malicious, then again they might not.
3. Do I trust the app provider? Maybe !!! My bank encrypts the data transfer so it's probably safe. But am i trusting them to encrypt all the information on each webpage? Maybe there is a targeted add or an account number is not encrypted? I would not check my bank account and instead wait until i was on a trusted network.
So what should you do?
Encrypt all the data going through your computer. You can do this by signing into a VPN (such as USC's). It should be noted that USC wireless is also completely open and unsecured and ITS even recommends using their VPN client for any sensitive data communications.
