this isn't sane, for the record

So last night, I finally got around to changing my yahoo and gmail passwords and set up two factor authentication. This sounds like a very boring story, and it is, trust me, but it's also an example of the password equivalent of completionist doctrine: it must all be done.

Because Heartbleed, and why not.

I have a locked and secured doc that has a full list of all my accounts and passwords because you get to the point in your online life where everything can't be happy1 or you end up writing an article about how your iPad was bricked because someone wanted your twitter name and infiltrated your entire Apple ecosystem (that article was nightmare fuel and I don't have an iPad). One of the few useful tips I got from the article is having an account that has no purpose but to be a secondary email on all my accounts; it literally does nothing but receive email about my password changes or activities on my account. I call it my keysmash yahoo account that is the recovery backup for every single account I have. The password is a modified keysmash of thirty-two characters, the username isn't much better, and I don't even know it without looking it up.

This is significant because my master doc is huge--I made an effort with anything important to make a strong password that I could also, at least nominally remember. I added app passwords eventually, so it's ridic long. I started off fixing my gmail first and then my yahoo's--each has a specific type of email it receives (one devoted entirely to Facebook and Harrods, because why not), and setting up two factor authentication (kind of fun) on everything and getting more text messages than I ever have in my life.

Here's the thing; online security was not designed for the human brain, or at least not my brain. I honestly don't know who it was designed for except someone who gets off on calculating pi for days on end or has a hardon for prime number memorization, who can think like that.

At work, I have to change the password (upper case, lower case, number, special character) every three months for my computer, PPM (for looking up defects and modifications for program testing), and my HR login to see my leave and etc. All have a two to three year password memory. My Groove messenger--like AIM, but for work--has another one that can be permanent, thank God. My secure email with Vontage--as opposed to regular email--has to have another one, and I think it has to be changed once a year. Seeing Middleware queues--where webservice calls go to die--needs to be updated every six months. For SQL queries in Oracle, the connection descriptors, usernames, and passwords for six different programs in four environments are each updated four times a year and each program has two to four users. I also have a weird encryption program on my work computer but it changes with my windows login. Oh, and VPN access so I can log in to my work computer from home, Jesus.

In a year as a tester, I will have to create or get updates for about one hundred and thirty two passwords just to log into my computer and do my job.

Online in my regular life, it's more flexible, but to secure my most important accounts, I have to have at least twenty high-security passwords with uppercase, lowercase, special character, number that I can remember off the top of my head and that doesn't count the login for my phone, tablet, laptop, my router login, my wifi login, and my server.

Facebook has an impossible one--I rarely use it, so I don't care that i have to look it up but I do care if someone hijacks it--Apple, Google Every Fucking Thing, Tumblr, DW, LJ, JF, Twitter, AO3, Hulu, Netflix, Roku, Dropbox, Evernote, Trillian, my bank app, my health insurance app, Paypal, Ebay, Sharebuilder, Newegg, my website bank login, cable, utilities, my phone, Amazon, my credit card, my retirement account at work, my health savings account through work, avast mobile security so if my phone is stolen I can erase it, McAfee, okay, I'm getting a headache. All of these have various levels of importance and security, right, because who compares your social media to your bank?

So when i was done with my password changes--smooth segue here--I was looking at my list and started working out how they were connected for vulnerabilities--remember that article I mentioned about the guy and his bricked iPad?--to see which could be considered major keys to everything.

Getting my google, I'm dead in the water, no lie; google infrastructure is like that, so that's a strong memorable password plus two factor authentication. Cracking my trillian gets you my fandom yahoo and google passwords, right, two factor the yahoos, already doing that. Which at this point, I sat down and diagrammed my online life by email address and account and how to limit the damage if one was hacked. The keysmash email seems relatively safe--you know, until fucking Heartbleed--but I ran into a problem here: I'm not a goddamn wizard. Mapping possibilities here in worst case scenario, there's no way I can do a separation that would limit hacking damage to my life to less than 20 percent without magic. For my online life--and real non-work life--I have right now eighty-nine separate passwords that are between medium and high-security needed password levels, and about twenty of them I have to be able to remember off the top of my head because I use them every day.

Modern world, I get that, but every time I read a smug security expert talking about how people are just stupid because they don't choose high security passwords for all five hundred of their online accounts and it's their fault they were hacked I want to destroy worlds or at least explain using small words this isn't (always) an issue of being stupid or lazy; the entire online ecosystem is working against you on this one.

Google alone terrifies me on a theoretical level, because it's linked to so much; Apple, same thing; Amazon, Jesus, it's growing in leaps and bounds; Yahoo, fuck my life; Microsoft, urgh; and I hate to point this out, but there's only so much separation possible. While diagramming my future hacked life, the safest measure seemed to be create a new email account for every single important account (bank, credit card, paypal, etc) to deliver to and secure each one to limit how much information a single hack can get, and it's not like there are a lot of secure online places to set up email accounts, and even if there were, we can't remember that many passwords.

I get--because it's all I know--that this is how it is, that there's no way to be invulnerable, but completionist doctrine: I spent most of last night changing all my major and medium passwords because for the life of me, I spreadsheeted my online ecosystem to figure out a way to be a smart user and limit the damage if I was hacked and I couldn't get it below compromising twenty percent of my accounts with one successful hack. I'd get notified fast--I think I got that much from keysmash yahoo account and two factor authentication--and some of the accounts are pretty minor so it wouldn't matter, but--twenty percent. I'm still working on a security model via staring at my spreadsheet and hating everything, but I keep hitting things i never thought of--my student loan account, places I shopped once or twice where I used Paypal or Google Wallet, and thought about how many places I thoughtlessly and crazily used my credit card and how they link into the ecosystem of online life and what else am I forgetting? And how many passwords I changed yesterday that I still need to memorize because sure, firefox saves passwords, Chrome saves password, IE saves passwords, but if I get hacked, those are the first against the wall, and what if my laptop is stolen or hacked?

Or I take it to a repair shop and completely didn't think about any of that because apparently in the back of my mind repair guy/customer privilege, like lawyer/client privilege, and its not he knew that file existed, or the random name, or feel any need to open it out of the thousands of files on my computer and be curious why it was protected and crack the password. Because God knows, that was a very stupid user mistake, and for four days I didn't know I was 100% vulnerable in my entire online life.

I can't tell if I'm overreacting yet. I also have five passwords >= 20 characters to memorize, which isn't helping my mood at all. Paranoia: it's totally a thing.

Further Reading
Yes, I Was Hacked Hard - welcome to my nightmare

Comments

[ratcreature]

I think your chances are good at least for your nightmare not to come true. I mean I'm not an internet security expert, but to me it seems that statistically to become a random victim, like being caught up in some data breach and then someone pulls on your threads and all unravels, is not that likely for you when you even before your latest push you had picked your passwords way better than most people, and the threads connecting them aren't too easy or all passwords set to password or such. It then becomes more of a question how likely it is that someone has real incentive and the skills to put in the effort to target you specifically. High profile tech bloggers are probably far more at risk of that than a random person, for example.

I guess I see it similarly to the risks of getting burgled. I don't secure my apartment very well, because I'm not a high value target to be picked, and my area not so crime ridden that it was inevitable just through volume. So I close and lock my front door even while knowing that and determined burglar could open that lock quickly with the right tool.

[montanaharper]

After a bunch of research online, I decided that using LastPass would be the best solution for me; it's a good balance between security and convenience. While there's no guarantee that they'd be safe from all future hacking, their system wasn't at risk when it came to heartbleed.

(I took the "opportunity" afforded by heartbleed to change all of my passwords—all 350 of them, apparently—which took me an entire day. But hey, now I'm more secure than I was before. Probably.)

[morgandawn]

Last pass all the way! That's what we use - we even paid for the smartphone/tablet version (the laptop.desktop is free)

[synecdochic]

Lastpass is definitely more secure than spreadsheet! And less likely to get compromised by being left on the hard drive when being taken in for work :)

Also, what I do to avoid the "I want your Twitter so I'm going to break into your other accounts to get enough data to get into your email" -- aside from not using Gmail -- is use my @dreamwidth.org (or, if it's an older account, my @livejournal.com) forwarding address. I know it's not going away, and it's a forwarding address, so if I do lose access to an email address I can just change my address on DW and password resets et al will go to a different place, and if anyone breaks into one of my accounts, it breaks the chain a bit and they can't keep going. (Not that they can't break into my DW, but it's hard to break into someone's DW unless they reuse passwords, since there's no secret questions and after 3 attempts there's escalating lockouts.)

[seperis]

Okay, you convinced me to try it. I figure if anyone knows security, it'd be you. *g* Downloading now and staring at it in terror and hope.

[zana16]

Did you decide against LastPass because it's an all-eggs-in-one-basket deal? Because it seems like it shares that flaw with your spreadsheet. I love that I don't even have to think of my passwords most days, other than logging in to LastPass at work and then logging into it again at home. Not a perfect solution, but it's as close as I personally am going to get to a secure system.

[nagasvoice]

This is precisely why I was so puzzled when Google originally started trying to link to all the things and insisting on real names (and now phone numbers, ick), and Facebook wants to sell our data and etc. It just seemed so blatantly insecure to me.
I've been using a fair number of fairly elaborate different passwords but beyond a certain point the escalating "new password required right now" every few weeks or months gets completely out of hand.
Whoever works out a secure system using recognition methods that are hard for computer algorithms to crack and easy for human brains to remember has really got potential to make serious bank, just sayin'.

[alexseanchai]

[nagasvoice]

Word! *pointing* This! !!??@#@!

[seperis]

Okay, funny about this; our PHP password, which is the encryption software for our hard drives, requires a passphrase of several words, specifically a fairly long sentence. We only have to enter it after a cold reboot following a major software upgrade, and I've entered it maybe five times total, and I still remember it easily.

[akacat]

I've thought about mapping out my vulnerability if one of my emails is hacked. Then I figuratively run screaming into the night, while my eye non-figuratively develops a persistent tic.

I use 1Password, though it has some issues staying synced between my PC and tablet. I'm thinking of switching to Lastpass.

[pudacat]

You gave the short and sweet version by Matt Honan. The "Wired" article is what made me take things seriously, and, like you, I don't even own an iPad, or a Mac, or have a G-Mail.

If you haven't read it, here's the story, including his convo with one of the hackers. It's chilling.

http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/

passwords

[lilian_cho]

I asked husband if he has to do this gazillion unique password changes at work (he works in software), and he said yes.

Me: "How do you remember them then?"

Him: "I come up with a new one and I forget my old one."

Me: *stares disbelievingly* "How does your brain work?!"