Inconsistent, misleading password meters can increase risk of cyber attacks: Study

Agencies
December 23, 2019

Washington D.C., Dec 23: Inconsistent and misleading advice offered on some of the world's most popular websites could actually be doing more harm than good, says a recent study.

Password meters">Password meters are frequently made available to help the users secure their personal data against the threats posed by cybercriminals.

The study conducted at the University of Plymouth has assessed the effectiveness of 16 password meters that people are likely to use or encounter on a regular basis.

The research says that there is a clear level of variation in the advice offered across different websites.

The study was published in the journal Computer Fraud and Security.

The main focus was dedicated password meter websites, but the study also sought to assess those embedded in some common online services (including Dropbox and Reddit) and those found as standard on some of our devices.

And while some meters do effectively steer users towards more secure account passwords, some will not pick them up when they try to use 'abc123', 'qwertyuiop' and 'iloveyou' - all listed this week among the worst passwords of 2019.

The study was conducted by Steve Furnell, Professor of Information Security and Leader of the University's Centre for Security, Communications and Network Research.

Commenting on the latest research, Prof Furnell said: "Over the festive period, hundreds of millions of people will receive technology presents or use their devices to purchase them."

"The very least they should expect is that their data will be secure and, in the absence of a replacement for passwords, providing them with consistent and informed guidance is key in the quest for better security."

"What this study shows is that some of the available meters will flag an attempted password as being a potential risk whereas others will deem it acceptable. Security awareness and education are hard enough, without wasting the opportunity by offering misleading information that leaves users misguided and with a false sense of security."

The study tested 16 passwords against the various meters, with 10 of them being ranked among the world's most commonly used passwords (including 'password' and '123456').

Of the 10 explicitly weak passwords, only five of them were consistently scored as such by all the password meters, while 'Password1!' performed far better than it should do and was even rated strongly by three of the meters.

However, one positive finding was that a browser-generated password was consistently rated strong, meaning users can seemingly trust these features to do a good job.

Prof Furnell added: "Password meters">Password meters themselves are not a bad idea, but you clearly need to be using or providing the right one."

"It is also worth remembering that, regardless of how the meters handled them, many systems and sites would still accept the weak passwords in practice and without having offered users any advice or feedback on how to make better choices," he added.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
June 29,2020

New Delhi, Jun 29: Witnessing azure skies and breathable air for the last three months, Delhi on Monday recorded deterioration in its air quality, with particulate matter with diameter of 2.5 and 10 microns -- too small to be filtered out of the human body -- standing at 52 and 297 micrograms per cubic respectively.

Gufran Beig, Project Director of System of Air Quality Weather Forecasting and Research (SAFAR), said that the sudden spike in air pollution is due to a mild dust storm blowing from Rajasthan.

"Since the wind direction is changing and moist air is coming in, the air quality in Delhi will become better by tomorrow," Beig told IANS.

Central Pollution Control Board (CPCB) data showed that the overall air quality near Delhi Technical University (DTU) area stood at 326 micrograms per cubic, followed by 308 at Narela and 307 at Mundka.

Out of 36 stations, the AQI in as many as 30 stations was above 200 micrograms per cubic till 1 pm on Monday.

The System of Air Quality Weather Forecasting and Research categorises air quality in the 0-50 range as good, 51-100 as satisfactory, 101-200 as moderate, 201-300 as poor, 301-400 as very poor, and above 400 as severe.

According to SAFAR's website, "PM 10 (coarser dust particle) is the lead pollutant. AQI is likely to improve to moderate category by tomorrow, and further improvement is expected by July 1."

Researchers indicated that PM 10 and PM 2.5 will be 170 and 47 micrograms per cubic on Tuesday.

With no vehicles plying on the roads or industries shut due to the lockdown since March 25, Delhi's air quality had improved drastically.

According to a study conducted by the Indian Institute of Technology (IIT), Delhi, if the low levels of air pollution reached during the lockdown period are maintained, India's annual death toll could reduce by 6.5 lakh.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 3,2020

Giving each and every app access to personal information stored on Android smartphones such as your contacts, call history, SMS and photos may put you in trouble as bad actors can easily use these access to spy on you, send spam messages and make calls anywhere at your expense or even sign you up for a premium "service", researchers from cybersecurity firm Kaspersky have warned.

But one can restrict access to such information as Android lets you configure app permissions. 

Giving an app any of these permissions generally means that from now on it can obtain information of this type and upload it to the Cloud without asking your explicit consent for whatever it intends to do with your data.

Therefore, security researchers recommend one should think twice before granting permissions to apps, especially if they are not needed for the app to work. 

For example, most games have no need to access your contacts or camera, messengers do not really need to know your location, and some trendy filter for the camera can probably survive without your call history, Kaspersky said. 

While decision to give permission is yours, the fewer access you hand out, the more intact your data will be.

Here's what you should know to protect your data.

SMS: An app with permission to send and receive SMS, MMS, and WAP (Wireless Application Protocol) push messages, as well as view messages in the smartphone memory will be able to read all of your SMS correspondence, including messages with one-time codes for online banking and confirming transactions.

Using this permission, the app can also send spam messages in your name (and at your expense) to all your friends. Or sign you up for a premium "service." You can see and conrol which apps have these rights by going to the settings of your phone.

Calendar: With permission to view, delete, modify, and add events in the calendar, prying eyes can find out what you have done and what you are doing today and in the future. Spyware loves this permission.

Camera: Permission to access the camera is necessary for the app to take photos and record video. But apps with this permission can take a photo or record a video at any moment and without warning. Attackers armed with embarrassing images and other dirt on you can make life a misery, according to Kaspersky.

Contacts: With permission to read, change, and add contacts in your address book, and access the list of accounts registered in the smartphone, an app can send your entire address book to its server. Even legitimate services have been found to abuse this permission, never mind scammers and spammers, for whom it is a windfall.

This permission also grants access to the list of app accounts on the device, including Google, Facebook, and many other services.

Phone: Giving access to your phone means permission to view and modify call history, obtain your phone number, cellular network data, and the status of outgoing calls, add voicemail, access IP telephony services, view numbers being called with the ability to end the call or redirect it to another number and call any number.

This permission basically lets the app do anything it likes with voice communication. It can find out who you called and when or prevent you from making calls (to a particular number or in general) by constantly terminating calls. 

It can eavesdrop on your conversations or, of course, make calls anywhere at your expense, including to pay-through-the-nose numbers, Kaspersky warned.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
June 17,2020

In a bid to help tackle rise in domestic violence during the social distancing times in India, Twitter on Wednesday launched a dedicated search prompt to serve information and updates from authoritative sources around domestic violence.

Twitter has partnered with the Ministry of Women and Child Development the National Commission for Women in India to expand its efforts towards women.

The search prompt will be available on iOS, Android and on mobile.twitter.com in India, in both English and Hindi languages, the company said in a statement.

Data shows that since the outbreak of Covid-19, violence against women and girls has intensified in India and across the globe.

"We recognise collaboration with the public, government and NGOs is key to combating the complex issue of domestic violence. Accessing reliable information through this search prompt could be a survivor's first step towards seeking help against abuse and violence," said Mahima Kaul, Director, Public Policy, India and South Asia, Twitter.

Every time someone searches for certain keywords associated with the issue of domestic violence, a prompt will direct them to the relevant information and sources of help available on Twitter.

This is an expansion of Twitter's #ThereIsHelp prompt, which was specifically put in place for the public to find clear, credible information on critical issues.

The feature will be reviewed at regular intervals by the Twitter team to ensure that all related keywords generate the proactive search prompt, said the company.

Violence against women and girls across Asia Pacific is pervasive but at the same time widely under reported.

"In fact, in many countries in our region, the number is even greater, with as many as 2 out of 3 women in some countries reporting experiences of violence," added Melissa Alvarado, UN Women Asia Pacific Regional Manager on Ending Violence against Women.

Rekha Sharma, Chairperson, the NCW, said: "With social distancing norms in place, several women are unable to contact their regular support systems. This initiative by Twitter will provide big support to the survivors, who would otherwise be easily isolated without access to relevant information and help".

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.