Ask Leo! #630 – My Backup Origin-Story, Moving OneDrive, Human Relation Skills, and more…

Leo, if you really are intending to keep using your Samsung Galaxy Note 7, I hope you're on Verizon.

The Register published this article today:

http://www.theregister.co.uk/2016/12/09/samsung_note_7_to_be_killed_dec_19/

I mentioned elsewhere, but my Note 7 has been returned. I was waiting for something equivalent, and the Google Pixel XL fit the bill. :-)

"Do you have a good source of finding out if a password is a secure password where a hack will be almost impossible?" - This:

https://howsecureismypassword.net

Password length/complexity is actually not as important as many people think. Passwords mainly get compromised in one of three ways. Database theft and phishing are by far the most common, and the complexity of the password does nothing to help in such scenarios (a complex password can be stolen or phished as easily as a simple password). The third way is for it to be guessed or otherwise discovered by a dishonest friend/family member/co-worker. In this scenario, complexity does help, but a password does not need to be enormously complex to defeat the attacker.

Password checkers, such as the one I linked to above, assume that somebody will be running cracking tools against your password. In the real world, however, that simply does not happen (unless, that is, you're specifically targeted because your laptop is loaded with trade secrets worth millions).

To be clear, I'm not suggesting that strong, long passwords shouldn't be used - it's easy to do, so you may as well do it - simply that it's not necessarily as important as people think.

Actually there is an argument for complexity - or at least length - in the case of database theft: brute-force (or rainbow tables) in conjunction with poor password database design. The shorter/simpler your password is the more likely it is to be able for a hacker to try all possible passwords against a stolen database. At a minimum it's trivial for them to try huge databases of known or common passwords. As I said, good database design can make this significantly more difficult - but the opposite, poor database design, can also make it next to trivial for the hackers. And, sadly, we keep hearing about compromises where it turns out the stolen database was implemented poorly.

This is one of the reasons I've started promoting length over complexity. A short 8 character password can now be compromised no matter how complex it is. The odds of a longer (say 16 character) password being compromised in that manner are significantly smaller.

It's shocking. Too many people adopt the position, "So what? I've got nothing to hide." But as Edward Snowden very rightly said, "Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.'

The societal implications of mass surveillance are enormous. In fact, it could very well turn out to be the biggest issue of our time.