RNZ National – Tech Tuesday with Jesse Mulligan – Is Password Management Lastpass breach cause for concern?

RNZ National – Tech Tuesday with Jesse Mulligan – Is Password Management Lastpass breach cause for concern?


 

Jesse (00:00): Well, it's time for Tech Tuesday now. I'm joined by Daniel Watson, Founder and Managing Director of Vertech IT Services. He volunteers his time every couple of weeks to share his thoughts on all things tech, you're on the Gold Coast, Dan, how's it going over there?

Daniel Watson (00:16): It's overcast. It's not all it's cracked up to be.

Jesse (00:17): Oh, really?

Jesse (00:17): More happy where you are, I'm sure. It's a couple of degrees warmer there, that's about it.

Jesse (00:22): Okay, interesting conference you're at?

Daniel Watson (00:24): Yeah, it's one of those conferences for peers, so it's a bunch of IT business owners and you talk about your problems and everybody's got the same kind of issues. It's like that in every industry, but it's so useful to actually talk with people who've either had the problem you had a couple of years ago and they share their wisdom with you. It just saves a lot of time of wailing and gnashing of teeth trying to figure stuff out for yourself the first time.

Jesse (00:47): Yeah. Oh, that's nice, so there's a few things happening in the world of tech. Tell me about the LastPass breach.

Daniel Watson (00:54): Yeah, okay, so LastPass is a password management tool. It's quite a popular one that's got several tens of millions of users. It's fairly reputable. They had their source code breached through their development environment, and whilst that sounds kind of scary, they haven't actually had any customer information exposed, so nobody's passwords have been looted, as it were. So that's probably the main thing to put out there is that you shouldn't be put off using them necessarily, because nothing of yours has been exposed or even could have been exposed because the way that these tools generally work is that they're, while as storing your passwords in the cloud, they're fully encrypted. And it's like a lump of raw metal that they're just holding there, useless until somebody takes a hammer and smashes it into the shape of an actual password.

So, yeah, the only thing about source code is it just makes it easier for somebody to have a look and understand how their program works, right? Which might lead to vulnerabilities, been found in the future but people can do that in reverse engineer, their actual code from downloading the software off the internet, anyway, so it's not the worst thing in the world to have happened but [inaudible 00:02:14]

Jesse (02:13): So the message from you is don't panic, and if you see a headline-

Daniel Watson (02:13): Yeah.

Jesse (02:17): That this cloud-based password service has been hacked, don't worry. You still recommend people use a service, if not this one, a service like this, where instead of-

Daniel Watson (02:28): Oh, absolutely.

Jesse (02:28): All your passwords and probably having two passwords and an easy one and a hard one, you leave it all in the cloud.

Daniel Watson (02:35): Yeah, yeah, because a good password manager is going to make good password use simple for you. It's not going to let you the same password twice, it can remember thousands of incredibly good passwords for you and make it easy for you to deploy them. And another really cool thing that I hadn't thought of until just recently, is that phishing links where people are trying to you con you into going to a website that looks like the website.

Jesse (03:02): Yes.

Daniel Watson (03:02): You think you want to go to, well password management, because the way it just, it looks at the actual address of the password and goes, "I have a password for this or I don't," right? So if you think you are logging into your banking website and the password manager is not saying, "Hey, I've got password for that." That should be a bit of an extra warning sign like, "Oh, hang on, what, I have to do this manually for this web?" And that's not right. So yeah, there's loads of ways that can help protect you across all sorts of tools like that.

Jesse (03:33): Yeah, sometimes Google will offer to create a big password for me, and my only problem with that is that it's a bit hit and miss when it remembers it and when it doesn't, I think probably, something to do with our system here at work, where you log onto a computer and often it's like you're logging on for the first time and all that sort of convenience stuff like autofill passwords isn't there, so if I really want a [inaudible 00:03:58] using, yeah.

Jesse (04:01): Using your browser to remember passwords like that, if you're not logging into that browser with your account, like Gmail account or something with it.

Jesse (04:09): I know, so even [inaudible 00:04:11] when I do, since-

Daniel Watson (04:11): It's a shared use computer.

Jesse (04:12): Yeah, however-

Daniel Watson (04:14): The other side of that is it's actually quite easy to recover passwords out of browsers, so I don't recommend using those at all.

Jesse (04:22): Okay, so if you're going to put within the cloud, use a devoted service. One that a lot of our listeners will use is WhatsApp, and there's been some users on this application as well.

Daniel Watson (04:34): Oh yeah, it's something I just noticed recently is that they've actually released a full version of a native Windows application, right? So, one of the things that always annoyed me about WhatsApp, although it's very useful on your phone is that, you couldn't have it both on your phone and your laptop so you can't synchronize stuff, so I mean, often I'm like, "Oh, I just want to send that person the document," but it's a bit of a pain to do that through your phone. Now, you can use WhatsApp on your laptop without your phone even having to be on.

Jesse (05:02): Wow.

Daniel Watson (05:02): Which is one of the previous restrictions as well. So that is very useful for those of us who are involved in multiple groups and trying to coordinate stuff with documents and all the rest, as many of us are.

Jesse (05:16): Yeah, I'm pretty sure. Well, I know that you've been able to do it on Mac up until now, but being able to do it on Windows is a big deal, right?

Daniel Watson (05:25): Yeah, yeah, it's quite useful. Yeah, and they've got good secure communications end-to-end and it's tremendously useful, especially when you're traveling and you don't necessarily have a good roaming plan. You can always use those kind of tools for when you can connect to wireless hotspots at hotels and such to do what you're calling.

Jesse (05:47): We have just, here in the afternoon's team, slightly changed the way we communicate with each other. And it's a change that I know a lot of businesses made a few years ago. A few others sort of waited until the pandemic lockdown and were forced to do it, but we are using basically a chat function and there's various examples of them. Slack and Teams, Google chat, I think is one, so instead of a thousand emails, we're all in the same chat and we are sharing things and everyone can see everything and it's quite a big change for us, but having done it, I think we are all really enjoying it. Are you the same at your work?

Daniel Watson (06:28): Yeah, absolutely. We pretty much using Teams as our internal communication, email is really only for external communication because with the Teams, it's so much more persistent, you have to load a lot of extra functionality in there that you don't get with plain, old email.

Jesse (06:43): Such as?

Daniel Watson (06:44): Yeah. Oh, come put me on the spot. Well the app mentions so that you can, people get lot notifications if you go @jesse , so.

Jesse (06:52): Yeah.

Daniel Watson (06:53): Within a chat stream, having the files embedded in there so that they can go back and reference and see, look at where those files were because they will stay within the sheer point environment.

Jesse (07:03): Yeah right, whereas if someone forwards a document to me and then I reply to them and then they forward it, someone else the document's lost along the way, did you know that-

Daniel Watson (07:14): Oh, or you get huge known as a variance of it and it's hard to keep track of.

Jesse (07:18): Right.

Daniel Watson (07:19): Easily.

Jesse (07:19): Did you know that Slack, which is another form of that Teams' team chat is actually an acronym?

Daniel Watson (07:25): No, it actually didn't, what's an acronym for?

Jesse (07:30): Slack is an acronym for searchable log of all conversation and knowledge, and when you know that, that kind of highlights, why people are moving to that sort of format, whether it's Slack or another one, because you can search it easily.

Daniel Watson (07:39): Yeah, great point.

Jesse (07:40): Because-

Daniel Watson (07:41): Yeah.

Jesse (07:41): If a team member joins and they want to catch up, they don't need to have received all the emails. They can just go onto the Slack channel or the team's channel and take a look at some... Yeah, it's kind of seems to be where office life is going, but you just need to give everyone a bit of a G up to move on to it because actually anything new, particularly with something like email where you're so used to it and you're such a master of it, it's quite challenging to get people to try something else. So my team's been amazing, but I know that it's been a big issue in other offices.

Daniel Watson (08:15): I think most people will get basic facility with it. It's the kind of running joke that I have is that there's a new version of the Office suite, which comes out every three or four years or so. But most people only mastered the features that were in office '97 and haven't really progressed since then.

Jesse (08:30): That's so true.

Daniel Watson (08:32): So I still come across people where I show them control, control+C and control+V for copy and paste and it blows their mind because it saves them four or five mouse clicks every time.

Jesse (08:32): Yeah, but no.

Daniel Watson (08:44): Yeah, that's kind of how that rolls. [inaudible 00:08:47].

Jesse (08:48): No point in introducing tech, if people aren't going to give it a go and adopt it and use it right, it becomes pointless. It's only as good as how much it's adopted.

Daniel Watson (09:00): Sometimes the team only moves forward as fast as the slowest member-

Jesse (09:05): So man, I hope I'm not that member.

Daniel Watson (09:07): But you can't just leave them behind. Yeah, you just help them along. There's one cute little tech tip I've got for you, which is everybody upgrades their phones every three years or something like that, whatever, the Vodafone or the big telcos have their deals.

Most people have got a couple of phones sitting in their drawer. There is a free web app called critter.camera, if you just put that critter.camera into your web browser on an old phone, you can turn it into a trail camera that can just-

Jesse (09:40): Yeah.

Daniel Watson (09:41): If you want to see what the dogs are up to at home during the day when you're not there, grab an old phone, plug it to the power, open up, go on the browser to critter.camera, press the start button. And it will calibrate, you make sure you're not in the room at the time. And it'll look at the room and go calibrate to make sure has a good idea of what's in there. And then if anything happens during the day, it'll take photos of all the changes and then you can come back later on, just have review of the little photos.

Jesse (10:11): Great, that's cute.

Daniel Watson (10:12): Doesn't go anywhere. It's just all sitting on the phone.

Jesse (10:15): Great.

Daniel Watson (10:15): So it's not-

Jesse (10:16): Yeah.

Daniel Watson (10:17): Uploaded to anything else.

Jesse (10:18): Great tip to finish Tech Tuesday, Dan Watson from Vertech IT services. Enjoy your time on the Gold Coast and thanks for your time.

Daniel Watson (10:25): Cheers bud.

 

Have you had a security incident in the past and you have a nagging feeling that not much has changed to prevent it happening again?

See our cybersecurity services

Explore our co-managed IT services

Need help with process optimization?

Join our systems coaching