Thursday, August 23, 2012

Linkedin Password goofup

LinkedIn gave up password hashes for around 8 million passwords. The leaks for the data don’t seem to include usernames, but the holders of the information state they have it.When news sites say someone  lost “encrypted passwords”, understand that Encryption allows to reverse the algorithm to get the plaintext. But with hashing algorithm, it is not possible.
The way LinkedIn stored passwords was insecure. Hashing the same data with the same algorithm produces the same result always.  It is common for security groups (blackhats, whitehats, and grayhats) to spend a lot of time computing hashes of what they believe would be common passwords and storing these in a Rainbow Table.
If I see the hash for the password “password1234” in a password dump, I know that 1) either your password is "password1234", or 2) password1234 will also work as your password. The secure way to store a password is to concatenate a “salt” to the password to make the hash entirely different before doing the hashing (and multiple rounds), and store this salt with the hash so that rainbow tables are not effective, and so brute force is required to get the password. (There are even more secure ways by keeping additional salt material outside the database, but that’s beside the point).
So out of the millions of stolen passwords, attackers have already gotten the plaintext for 60-80% of them.
So what’s the lesson? Use a password database. There are a few benefits to this: 1) Your password will likely be more secure than one you would come up with on your own, and less likely to appear in a rainbow table, and less likely to be brute-forced soon 2) When something like this happens, you don’t have to devise a new password “scheme” or just “add 1” or something - you just generate a brand new password and call it a day. 3) You can use a different password for every single thing you need a password for. So if the attackers get your email address, they don’t also have your email password (or the user ID and password you use for ebay or paypal)
 

Monday, January 30, 2012

How to be happy at Work Place!

If you're unhappy at work--or anywhere else, for that matter--it's because you've made yourself unhappy. There's an easy way to change that.

Let me start off with a little story.
I once knew a saleswoman–young, divorced–who got a diagnosis of breast cancer. She had to work and raise two kids while fighting the cancer. Even so, she managed to be happy at work, noticeably happier than her co-workers. In fact, she not only won her battle with cancer but subsequently became one of the top salespeople at Bristol Myers.
She was not, as it happens, naturally cheerful. Quite the contrary. When she started full-time work, she was frequently depressed. But she turned it around, using the techniques I'm going to provide you in this column.
That saleswoman once told me: When you're unhappy, it's because you've decided to be unhappy.
Maybe it wasn't a conscious decision; maybe it crept up on you while you weren't looking–but it was a decision nonetheless. And that's good news, because you can decide instead to be happy. You just need to understand how and why you make the decisions.
What Are Your Rules?
Happiness and unhappiness (in work and in life) result entirely from the rules in your head that you use to evaluate events. Those rules determine what's worth focusing on, and how you react to what you focus on.
Many people have rules that make it very difficult for them to happy and very easy for them to be miserable.
I once worked with a sales guy who was always angry at the people he worked with. The moment anything didn't go the way he thought it should go, he'd be screaming in somebody's face. He was making everyone around him miserable–but just as importantly, he was making himself miserable, because just about anything set him off.
For this guy, the everyday nonsense that goes on in every workplace was not just important, but crazy-making important.
I once asked him what made him happy. His answer: "The only thing that makes this !$%$#! job worthwhile is when I win a $1 million account." I asked him how often that happened. His response: "About once a year."
In other words, this guy had internal rules that guaranteed he'd be miserable on a day-to-day basis, but only happy once a year.
One of the other sales guys at that firm had the exact opposite set of rules. His philosophy was "every day above ground is a good day." When he encountered setbacks, he shrugged them off–because, according to his internal rules, they just weren't that important. When I asked him what made him miserable, his answer was: "Not much." When I pressed him for a real answer, he said: "When somebody I love dies."
In other words, the second sales guy had rules that made it easy for him to be happy but difficult to be miserable.
I'd like to be able to write that Mr. Positivity regularly outsold Mr. Negativity, but in fact their sales results were similar. Even so, I think Mr. Negativity was a loser, because he lived each day in a state of misery. His colleague was always happy. He was winning at life. He was happy at work.
Make Yourself Happier: 3 Steps
The saleswoman who had breast cancer was happy, too, and this is the method she used to make herself happy:
1. Document Your Current Rules
Set aside a half-hour of alone time and, being as honest as you can, write down the answers to these two questions:
  • What has to happen for me to be happy?
  • What has to happen for me to be unhappy?
Now examine those rules. Have you made it easier to miserable than to be happy? If so, your plan is probably working.
2. Create a Better Set of Rules
Using your imagination, create and record a new set of rules that would make it easy for you to be happy and difficult to be miserable. Examples:
  • "I enjoy seeing the people I work with each day."
  • "I really hate it when natural disasters destroy my home."
Don't worry whether or not these new rules seem "realistic"–that's not the point. All internal rules are arbitrary, anyway. Just write rules that would make you happier if you really believed them.
3. Post the New Rules Where You'll See Them
When you've completed your set of "new" rules, print out them out and post copies in three places: your bathroom mirror, the dashboard of your car, and the side of your computer screen. Leave them up, even after you've memorized them.
Having those new rules visible when you're doing other things gradually re-programs your mind to believe the new rules. You will be happy at work. It's really that simple.

(adapted)