No security is infallible

Roughly one year ago the security my online existence was compromised. A site I visit was hacked, and usernames and passwords were stolen. I know there is nothing I could have done to prevent this from happening. Not only was the security of this data out of my control, but I also know that no security is infallible. While certain forms of security might seem unbeatable, the truth is they can all be defeated. Safes, for example, are rated by how long they can resist the efforts of a safe cracker... in minutes.

It is not a question of whether or not they can be opened, they are designed to be opened. How else could we retrieve our possessions when we want them? The inherent vulnerability of this design is what allows safe crackers to gain unauthorized access. Online security is similar, for our accounts to function we must be able to access them; and where there is access, there is the possibility of unauthorized access. It happens almost every day. Odds are, if you were to perform an internet search for "security breach" right now, the most recent result would be a news story about a massive breach of personal information that took place (or was disclosed) yesterday or today. That is the inherent vulnerability of accessible information at work. Security experts can try their best to prevent these breaches, but no security is infallible.

Hackers will get access to some of our information. There is nothing we can do about this. What we can do is prevent hackers from using some of our information to gain access to all our information, and this is where I failed.

I knew all the tips.
At this point I think everyone has heard most, if not all, of these:

• Don't use passwords based on personal information which can be easily accessed or guessed.
• Don't use words found in any dictionary of any language.
• Use both lowercase and capital letters.
• Use a combination of letters, numbers, and special characters.

And most importantly:

• Use different passwords on different systems/sites.

But I didn't.

I had about six variations of two passwords that I used on every site that I visited. Including my email address. The only e-mail address I had. With years worth of archived emails from every site I visit.

This could have been a disaster. In just a few hours, a hacker gained access to, and changed the passwords of every site I visit.

In the end I was fortunate. No money was stolen. Nothing was purchased on my credit cards. No new accounts opened in my name. Nothing ridiculous was posted to Facebook or Twitter. None of my MMO characters were deleted or mined for gear or gold. The hackers didn't even add Rick Astley to all my Pandora stations.

I suffered nothing more than a few hours of inconvenience regaining access to my accounts.
As is often the case, I got lucky.

Because I know I'll never get this lucky again, I now use protection:

• I use a password manager to keep track of passwords
• Every site has a unique and highly complicated password
• I have multiple email addresses that are used for unique purposes
• I no longer honestly answer "secret questions"1

Until now, this story was mostly unknown to my friends and family. In their minds, I am "the computer guy" and what you've just read could never happen to me because "I know better".

And they're right, It shouldn't have happened to me.

Don't let it happen to you.

Learn from my mistakes!

1. Often the secret questions/answers are not stored as securely as username/password and credit card information. Answering these questions honestly can give hackers access to personal information like my mother's maiden name, or my favorite movie, where I went to school. Hackers can then use this information to gain even more access to, or knowledge of, my life. By "making up" a nonsense answer for these questions, I do not give out more information about myself that could be used against me.

Basic rules for life

The goal of "The Pursuit of Technology" is to help other people avoid some of the many mistakes I have made with technology over the years.

However, I have made many mistakes over the years. Many, many mistakes. Not all of them were technology related. So, before we dive into me deleting my config.sys and autoexec.bat files, here is some basic life advice I wish I had followed, because every time I failed to follow these rules I have paid a terrible price.

Learn from my mistakes.

Obey Wheaton's Law: Don't be a dick.

Follow my father's rules for driving:

• Keep your car on the road
• Don't fucking hit anything!

Want to stay healthy?

• Don't smoke
• Wear your seat belt
• Use condoms

Last year I lost 90 pounds. How did I do this?

I used the power of Math!

Weight loss or gain (assuming you are otherwise healthy) is just math.

If you eat more calories than you burn on a daily basis you will gain weight.

If you eat fewer calories than you burn on a daily basis you will lose weight.

To lose weight, all you have to do is:

1. Count the calories of everything you eat
2. Don't eat more than you burn off everyday

But on the news they were talking about "that thing" and how bad it is for you. So what should I eat?

Michael Pollan answered this beautifully in his article Unhappy Meals a few years ago. It's very simple. Eat:

• Food
• Not too much
• Mostly plants

That's it. Simple rules that everyone can remember.

Next up: Internet Security - Wherein a hacker gains access to my entire online identity after stealing my username and password from one site.