Twitter’s security meltdown has done a fantastic job of publicizing how vulnerable a modern, cloud-based startup can be to a determined hacker. 

I have been surprised that in the numerous articles about how to protect yourself against hacking, I have seen very little mention of the powerful technique that we discussed in The Virtual Handshake.  Here’s a slightly updated version of what we wrote in the book:

Use a different user ID and password for all of the important sites you visit. If a thief knows your password on one site, it’s too easy for him to then use that password on many other sites. (That homogeneity is what broke down Twitter’s security.)  A good way to keep unique passwords for every site is to develop a standard method for creating a password from the name of the site. For example, to create a unique password for Orkut.com:

1. Pick a standard word for use with all your sites.  We’ll use "jade."

2. Split it in half. In the middle, insert the number of letters in the domain name. "Orkut" has 5 letters, so we write "ja5de."

3. Add a letter at the beginning that is the first letter of the domain name. "Orkut" = "O," giving us "Oja5de."

Although this allows you to easily calculate the password, a hacker cannot readily deduce a pattern because each site has its own unique password. Of course, you need to create your own algorithm; do not use this one! To avoid confusion from an excessive number of passwords, it’s okay to use the same password on all Web sites for which security is not critical, e.g., newspaper sites.

One weakness in this approach is the use of a common word as a base.  Christopher Faulkner, CEO of C I Host, suggests pick a line from a song or popular phrase, and use the first letter of each word. For example, "Four Score and Seven Years Ago" becomes "4s&7YA" .

I’d heard this was going on, but I just received my first one of these, so I figured I’d better share it with everybody. I received an email that looks like a Twitter direct message notification:

I was a bit suspicious of the message and URL (http://twitterblog.access-logins.com/login), and Google Chrome (my new default browser since Firefox went crazy on me) was kind enough to give me a possible phishing alert when I went to the site.

The site looks exactly like Twitter — the URL is the only give-away. But if you put your user name and password in, you’ve just let someone hack your Twitter account.

The notification will appear to be from someone you know — the follower data is publicly available if your profile is open. It doesn’t necessarily mean their account has been hacked. If uou only get an email notification, not an actual Twitter DM, then their account is probably OK. If you receive one of these as an actual Twitter DM, then they’ve probably been hacked and should immediately change their password.

On the topic of passwords, I know a lot of people use the same password everywhere. BAD IDEA!!!

I hope it’s obvious why you shouldn’t do it. The problem, of course, is trying to manage/remember multiple passwords. One approach is to use some kind of password management software, but that only works from your own computer, and you’re in trouble if you want to log on from somewhere else.

In Chapter 16 (pp. 140-141) of The Virtual Handshake (free download or buy at Amazon), we offer a simple scheme for creating passwords that are unique for each site, but not easily decipherable if someone obtains a single password. I’ve found, though, that more and more sites are requiring longer passwords — sometimes 8 characters — and also doing things like requiring both numbers and letters in the password. A couple of years ago, I posted a little more complex password scheme that should meet those requirements.

Developing a secure password management scheme is one of the single best things you can do to protect against online identity theft.

Let me say first off that I am, generally, a MySpace fan. I’m active on there, and my teenage son and my two older stepsons all have accounts.

But you’ve got to be careful on there. Last Thursday I spent the better part of a day cleaning off spyware and a Trojan virus from my son’s machine. I had some precautions in place, but obviously not enough. I won’t go into the whole story, but we’re about 98% sure that it came not directly from MySpace, but from the page of someone who sent my stepson a private message.

It was a particularly nasty virus, known as a keylogger, which records keystrokes from your computer and sends anything interesting — user names and passwords, credit card numbers, social security numbers, etc. — to a hacker somewhere who collects them, presumably for identity theft purposes.

Turns out there’s another little disturbing fact about MySpace that I was unaware of… it seems you don’t have to actually have a valid e-mail address to use MySpace. In fact, apparently you can register under someone else’s address, as Auren Hoffman writes about in Assuming an Identity on MySpace:

That’s right … I can sign up on MySpace under your email address and assume your identity. MySpace does send an email to verify the email address – but you do not have to click on the verification email to use MySpace. You can still do everything on MySpace you’d always do – like creating an account, adding pictures, adding friends, and generally being active on MySpace. You can assume anyone’s identity on the number one site in America. But this is only if that email address was not used to sign up for an account.

He goes on to note that many people will just ignore the verification e-mail from MySpace, thinking that it’s not a valid one – perhaps a phishing scam – since they didn’t sign up themselves. If they ignore it, though, then someone else now has a MySpace account in not only their name, but their e-mail address as well.

The danger? Auren explains:

Though this can be fun and tame … like me signing up as Clark Kent @ superman.com … it can also be used for malicious purposes. Someone can assume another person’s identity, get people to trust them, and be fooled when that person goes to verify their email address in MySpace (which is the only way to verify someone today).

So what can you do to protect yourself?

First, install good anti-virus and anti-spyware software. If you just want to pay for this, you’re welcome to, but there are some excellent free solutions out there. I have tried most of them, and the ones that in my experience consistently find and fix things the others can’t are AVG Anti-Virus and Anti-Spyware.

Beyond that, MySpace offers some safety tips, but they fall way short. At the other end of the spectrum, I think some of the parent-oriented sites and privacy-advocate sites go a little overboard. I recommend Rock Safe from MyCityRocks, which offers practical and realistic guidelines to help users of social networking software protect their identity and participate safely.

Finally, download a free copy of The Virtual Handshake and read Chapter 16 on Privacy & Safety.

Have fun, be safe, and feel free to stop by and connect with me on MySpace.