Scam Corner: Hacklore vs Current Computer Best Practices

Years before the internet existed, there were stories called urban myths or urban legends. These were stories that supposedly happened to a friend of a friend, but no true source of the event could be identified. Yet, like a fable, they usually had a moral to them and were just believable enough to pass along and so they continued to be spread.

With personal computers being available for around 50 years now, there are a number of suggestions that used to be best practices for computer security that have been superseded as the technology evolved. But like an urban myth, these recommendations on how to keep your computer safe keep getting passed around. These security urban myths are known as hacklore.

The problem with hacklore is that we spend time and energy doing the wrong things to keep our computers secure. Instead of spending time on obsolete or rare attacks, instead we need to spend it on what is technologically sound today.

Computer Hacklore Examples

Here are a number of security urban myths provided by security professionals:

Avoid connecting to public WiFi because others can sniff the WiFi and read everything going over the network. Always use a VPN on an open network. In the past this made sense because data was not encrypted either on the WiFi network or on the internet. The VPN (Virtual Private Network) was software that would encrypt all the traffic between your computer and the internet so that capturing the WiFi network traffic would just be gibberish. VPNs were recommended as a way to be more secure on a public WiFi network.

Now, modern WiFi products use encryption technologies to protect your network traffic even on open networks. Modern browsers now put up alerts if you try to connect to a web server without encryption. VPNs are encrypted only partway to the destination website. With almost all web traffic being encrypted all the way from your computer to the website server, VPNs offer little additional security to most users.

QR Codes can easily hack your computer and you should never scan a QR code. Curiously, QR codes were quite popular just after they were invented, but then fell out of favor for a while because of the security concern. Applications that read QR codes weren’t as robust and could take you automatically to a site you might not want to visit.

With modern QR reading applications, you have the opportunity to see what URL the QR code wants to send you to, and you can choose whether or not to follow the link. In addition, there is no evidence of widespread hacking through QR codes.

Never charge USB devices using a public USB port. This originally started with an experiment at a hacker convention where a hacker was able to access a device through the data wires of a USB port. It was a proof-of-concept, but there are no instances of “juice jacking” of devices via a public USB port. While the USB protocol has two power wires and two data wires, building and installing a hacking device on a public USB charging device would be quite difficult. There has not been any instance of finding a juice-jacking port in a public place.

Modern devices always prompt before enabling data transfer as well as requiring authentication to connected accessories. They default to a restricted charging-only mode. Even if there was something trying to get to your USB-connected device, you would know it before any data transfer happened. The bigger concern today is whether the USB port has enough current to charge your device as fast as it can be charged! With the ease of finding regular outlets to plug an adaptor into, or the use of portable power banks for charging, the need to use a public USB port for charging is fairly small.

Turn off Bluetooth and NFC. Exploits of Bluetooth and Near Field Communications are extremely rare and requires very specialized hardware, physical proximity, and devices that are not up-to-date with patches. In addition, Bluetooth requires pairing approval so you are alerted to any device that wants to connect to your device.

Regularly clear cookies to avoid websites tracking your activity. Years ago, that made sense because dropping a bit of data on your computer (a cookie) by one website could sometimes be read by another website. However, today cookies aren’t the only method of tracking and so clearing or deleting cookies doesn’t provide much in the way of reducing tracking. Tracking is done via identifiers such as single bit images and fingerprinting that doesn’t rely on cookies.

Regularly change passwords. This may be most surprising since we’ve heard that mantra to change passwords regularly for quite a long time. Comedian Michael McIntyre does a routine about the evolution of passwords where you started with a favorite word for your password and modify it as the requirements for passwords changed. It’s funny because it has a ring of truth to it.

Changing passwords, unless the password has been compromised, does not increase security meaningfully and actually lowers security as people tend to reuse passwords if changing frequently. It is more secure to make sure that passwords for every site are unique, long and complicated. Passphrases rather than passwords result in unguessable passwords.

Modern authentication technology now includes multi-factor authentication requiring something you have (a phone, an email address, or an authenticator app) as well as something you know (the password). As we transition from passwords to passkeys, the password itself will become less and less important for authentication.

Better Ways To Spend Your Computer Security Energy

Enable Multi-factor authentication. Not all of your data an access has the same value to a malicious actor. Prioritize setting up multi-factor authentication (MFA) or two-factor authentication (2FA) on accounts that have data useful to those actors. These would be accounts that have email, file storage, social media and financial systems.

When it comes to MFA, there are also good, better, and best methods of that second authentication challenge. Sending a code to email is the worst since all that is required to compromise that method is the credentials to your email. Sending a code to SMS is better, but it is still possible for criminals to take over your phone number and access those texts. (You won’t even know it until you try to use your phone and find it isn’t on the network any more.)

Authenticator apps are the best in terms of asking for a code because they are tied to the device running the app, not to the phone number.

A new technology, the passkey, is slowly becoming more common as a full replacement for the password. This involves an exchange of authentication request and response between the website you want to access and your computer. The process involves encrypting the request on one computer and decrypting it on the other computer. The passkey is stored on your computer (or phone) so that it becomes the only one that can authenticate the request to access the website you want to log into. This key can also be stored in a system that is synchronized with your devices so you can use phone, tablet, laptop or desktop to log in. Modern browsers, operating systems, and password managers can store these passkeys.

When using passwords, use strong passphrases and not just passwords. Make sure that any passwords are long (16 or more characters). Even better are whole phrases of words used that may be 50 or more characters long, although not all systems can handle long passphrases. These should also be randomly generated and not picked since humans are notorious at picking patterns that aren’t random. Finally, those passwords need to be unique for every system. Usernames should also be unique if possible.

Use a password manager. Given how difficult it is to remember unique usernames, and long passwords or phrases, and to make them random, a password manager is a great solution. These software tools can easily generate random passwords of any length. They can also store all of your unique passwords in an encrypted file and can fill in the username and password fields when requested by a website.

Another benefit of a password manager is that it will only fill in these credentials on the actual website. If a malicious actor gets you to click on a link that takes you to a look-alike website, the password manager won’t recognize the URL and won’t fill in the credentials. This can be an alert to you that you might not be on the authentic website you are trying to access.

With the evolution of the computer technology, what is important in security today is different than what it was decades ago when we first started using them as personal computers. It is important to know when a best-practice from long ago is still a best-practice and when it has become obsolete. You want to put your security energy into things that will help secure your systems and not into tasks that no longer have value.