See the best way to come up with a new username. We break down types of usernames and give you the best username ideas out there.

See the best way to come up with a new username. We break down types of usernames, why ...

How to Make a Good Username | Create a Unique and Secure Username

See the best way to come up with a new username. We break down types of usernames, why secure usernames are important, and how to create them effectively!

The 2020 EasyJet data breach was the second attack on a major European airline in less than two years.&nbsp;
In 2018, British Airways suffered a similar data breach where cybercriminals managed to steal data of 420,000 customers&mdash;380,000 of which contained credit card details.&nbsp;
The EasyJet data breach affected approximately nine million customers, but only 2,208 had credit card information stolen, including the CVV numbers.
&rlm;&rlm;&lrm; &lrm;
Don't let what happened to British Airways happen to you by trying our <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow">free trial</a>.
&rlm;&rlm;&lrm; &lrm;
<h2>What was the Fallout from the British Airways Data Breach</h2>
It's important to understand the fallout of the British Airways data breach to predict what could happen to EasyJet in the next 18 months (as of August 2021).
The UK's Information Commissioner's Office (ICO) fined &pound;27.7 million (reduced from the initial &pound;183 million) for failing to protect its customer's data. Previous to the British Airways incident, the ICO's biggest fine was to Facebook for &pound;500,000 in connection with the infamous <a href="https://teampassword.com/blog/facebook-hacks-a-history-of-security-breaches-at-facebook">Cambridge Analytica scandal</a>.
The cost to British Airways' customers was minimal, with only one report of someone trying to use one of the stolen cards to purchase goods by phone at Harrods. Fortunately, the bank rejected the transaction.
<h3>Major Class-Action Lawsuit Against British Airways</h3>
In addition to the ICO fine, law firm PGMBM filed a class-action lawsuit on behalf of 16,000 victims for &pound;800 million. The parties eventually reached an undisclosed out-of-court settlement in July 2021.
Class-action lawsuits are rare in the United Kingdom, so this settlement is significant and should serve as a wake-up call to the UK and EU-based companies.
&rlm;&rlm;&lrm; &lrm;
<h2>What Happened at the EasyJet Data Breach?</h2>
EasyJet remains tight-lipped about what happened in 2020 but said in a statement that this was a "highly sophisticated cyber-attack." The breach affected customers who booked EasyJet flights between October 17, 2019, and March 4, 2020.
EasyJet was alerted to a breach in January 2020 but only went public about the incident in May while conducting investigations. EasyJet announced that the breach compromised nine million customers, including 2,208 credit card details with CVV numbers.
In a statement from EasyJet Chief Executive Officer Johan Lundgren, he said, "There is no evidence that any personal information of any nature has been misused, however, on the recommendation of the ICO, we are communicating with the approximately 9 million customers whose travel details were accessed to advise them of protective steps to minimize any risk of potential phishing..."
It's somewhat irresponsible and presumptive for EasyJet to make such a statement. There is no way to determine where these details have ended up or who is responsible for the attack.
However, EasyJet did warn customers to be vigilant when opening any correspondence from the airline, be it text or email. The stolen information allows criminals to conduct phishing scams and other cybercrimes.
<h3>Credit Card Fraud due to EasyJet Data Breach</h3>
According to the UK cybercrime reporting agency Action Fraud, Johan Lundgren's statement is incorrect. By May 2020, there were 51 reports of credit card fraud resulting from the EasyJet data breach.&nbsp;
The estimated loss to credit card holders stands at &pound;11,752.81, including one customer losing &pound;2,750 shortly after the EasyJet attack.
&rlm;&rlm;&lrm; &lrm;
<h2>The Fallout from the 2020 EasyJet Data Breach</h2>
EasyJet's fate is still to be determined. The ICO is conducting its investigation into the matter and, judging by what happened to British Airways, EasyJet will likely receive a fine.
GDPR states that companies who fail to store personal details securely could face fines from the ICO of 4% of the airline's 2019 turnover of &pound;6,3 billion.
<h3>EasyJet Class-Action Lawsuit</h3>
To rub salt in the wounds, law firm PGMBM (the same law firm behind the British Airways class-action) plans to file an &pound;18 billion class-action lawsuit against EasyJet.
EasyJet's biggest mistake in this matter was waiting four months to go public with the breach, which could have prevented financial losses.&nbsp;
When filing the suit, PGMBM stated, "The sensitive personal data leaked includes full names, email addresses, and travel data that included departure dates, arrival dates, and booking dates. In particular, the exposure of details of individuals' personal travel patterns may pose security risks to individuals and is a gross invasion of privacy."
Under GDPR regulations, customers have the right to compensation when their information is stolen during a breach. Furthermore, EasyJet waiting four months to tell customers about the breach might appear reckless to the courts.
&rlm;&rlm;&lrm; &lrm;
<h2>How did Hackers Breach EasyJet's Systems?</h2>
EasyJet has not released any details of how hackers infiltrated their systems. But, in an interview with the BBC, EasyJet stated, "This was a highly sophisticated attacker. It took time to understand the scope of the attack and to identify who had been impacted..."
EasyJet claims it went public to protect the nine million customers who could be in danger of various cyber crimes, especially phishing attacks using spoofed EasyJet communications.
According to EasyJet, hackers were after the airline's intellectual property rather than customer data, alluding to the possibility of government or corporate espionage. If that is the case, the EasyJet breach is significantly more disturbing than your average data breach.
&rlm;&rlm;&lrm; &lrm;
Don't let hackers breach your systems with a <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow">14 day free tria</a>l with TeamPassword.
&rlm;&rlm;&lrm; &lrm;
<h2>Potential Risks to EasyJet Customers</h2>
Even if the EasyJet attack is some form of espionage, there's no stopping the attackers from selling the customer data on the black market. Some of the nine million customers are likely business email addresses, which cybercriminals can use in future corporate attacks.
<h3>Phishing Attacks</h3>
The primary concern for EasyJet customers is phishing attacks. Cybercriminals might attempt to communicate with victims through spoofed EasyJet communications, including email, SMS, or voice calls.
This communication could be as mundane as an email advertising EasyJet's latest travel packages with an offer that's too good to refuse. The links from the email will take the victim to a spoofed EasyJet website with fake flights and travel packages.&nbsp;
If a victim purchases any of these fake flights or packages, the website will capture their credit card details for criminals to use or sell on the dark web.
Criminals may also contact EasyJet customers to offer refunds, requesting credit card information to "verify their payment information to process the refund."
<h3>Malware Attacks</h3>
Criminals might send out similar EasyJet correspondence to install malware or a virus on a victim's device. With the malware installed, criminals can monitor your device, record keystrokes, activate your camera or microphone, and access sensitive information.
You can accidentally install malware without knowing, simply by clicking a link. This link might arrive as a text or email for EasyJet customers, appearing to come from the airline, increasing the likelihood of someone clicking it by mistake.
<h3>Credential Stuffing Attacks</h3>
Criminals often use credentials stolen during a data breach to access websites or applications where users might have an account. Using automation and a process of elimination, cybercriminals send out bots to test a user's email and password against thousands of websites and applications.
A recent example of a credential stuffing attack was <a href="https://teampassword.com/blog/what-happened-during-nintendos-data-breach-in-2021">Nintendo's Data Breach in 2021</a>, where hackers accessed 300,000 Nintendo Switch accounts.
&rlm;&rlm;&lrm; &lrm;
<h2>How to Prevent a Data Breach at Your Company</h2>
While we don't know the exact reason for the EasyJet data breach, there are several ways hackers can infiltrate an organization. Most breaches involve the theft of employee login credentials which criminals use to access a company's internal systems.
Using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a> like TeamPassword is an effective way to monitor access and prevent unauthorized credential sharing. TeamPassword is an affordable solution that uses state-of-the-art encryption technology for businesses of all sizes to share and manage passwords safely.
&rlm;&rlm;&lrm; &lrm;
<h2>What is TeamPassword?</h2>
TeamPassword is a password manager for companies to share login credentials with team members. Rather than share raw login credentials, you provide each team member with a TeamPassword account.
Instead of entering a password, team members use TeamPassword to log into an account&mdash;social media accounts, accounting software, development and marketing tools, content management systems, and more.
<h3>Built for Teams</h3>
Our customers love how safe and easy it is to <a href="https://teampassword.com/blog/how-to-safely-share-passwords-with-coworkers">share passwords</a> with employees, contractors, and freelancers. With TeamPassword, you can create groups to provide access only to those who need it.
For example, if you're managing social media for a client, you can create a group in <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> and add your social media team to that group. You can remove team members with just one click!
<h3>Multiple Browser Extensions</h3>
TeamPassword features browser extensions for Chrome, Firefox, and Safari, so team members will always have account access with their preferred device.
To gain access, a user navigates to the website or application they want to access, clicks the TeamPassword browser extension, and selects the relevant login credentials.
<h3>Secure Password Generator</h3>
TeamPassword's built-in password generator lets you create robust passwords with just one click. To ensure every password is unique and secure, you can generate 12-32 character passwords with uppercase, lowercase, symbols, and numbers.
When you update a password, <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> automatically updates the new credentials for all team members.
<h3>Two-Factor Authentication (2FA)</h3>
In the unlikely event that a team member's password is stolen or they lose their device, 2FA acts as a second line of defense. TeamPassword uses Google Authenticator, which is available for iOS and Android devices.
<h3>Activity Log &amp; Notifications</h3>
An activity log lets managers monitor just about any action in TeamPassword, including logins, sharing, password updates, and more. You can also set up email notifications for sensitive accounts so you can stay on top of unauthorized access and sharing.
&rlm;&rlm;&lrm; &lrm;
Explore TeamPassword's features with a <a href="https://app.teampassword.com/dashboard#signup/testimonial">14-day free trial</a> and take control of your password management today!&nbsp;

The 2020 EasyJet data breach was the 2nd attack on a major European airline in less than 2 years. What happened and could've it be prevented

The 2020 EasyJet data breach was the 2nd attack on a major European airline in less than 2 ...

What Happened at The EasyJet Data Breach?

With the advent of COVID-19, the video conferencing app Zoom soared from 10 million users in December to over 300 million by April 2020. The rapid growth meant a big payday for Zoom, but it also exposed privacy issues and security flaws.
In the first half of 2020, Zoom found itself entangled in several privacy disasters, including:
<ul>
<li style="font-weight: 400;" aria-level="1">March 2020 - Zoom caught sending user data to Facebook, which violates user privacy agreements.</li>
<li style="font-weight: 400;" aria-level="1">April 2020 - <a href="https://teampassword.com/blog/secure-password-sharing">credential sharing</a>, creating open meetings, and poor <a href="https://app.teampassword.com/dashboard#signup/testimonial">password management</a> from users led to the 'Zoombombing' phenomenon. Trouble makers would crash Zoom calls, primarily for schools and colleges, and create a nuisance&mdash;often using vulgar language or just doing whatever they could to disrupt the meeting. It got so bad that the FBI got involved, and many organizations and state departments worldwide banned using Zoom. Zoombombing now violates US law, and perpetrators could be subject to prosecution.</li>
<li style="font-weight: 400;" aria-level="1">April 2020 - A vulnerability allows hackers to steal users' Windows login credentials through Zoom's chat handle links.&nbsp;</li>
<li style="font-weight: 400;" aria-level="1">April 2020 - A Zoom bug makes it easy for hackers to take control of a user's microphone or webcam.</li>
<li style="font-weight: 400;" aria-level="1">April 2020 - Another Zoom bug gave hackers root access to macOS desktops.</li>
<li style="font-weight: 400;" aria-level="1">April 2020 - Researchers investigating Zoom discover that the app doesn't use end-to-end encryption as promised. Leaked user data included email addresses and photos.</li>
<li style="font-weight: 400;" aria-level="1">April 2020 - Zoom admits to "mistakenly" routing some free calls through Chinese servers, even when none of the participants were in the country.</li>
<li style="font-weight: 400;" aria-level="1">April 2020 - 352 compromised Zoom accounts discovered on the dark web.</li>
</ul>
Unfortunately, the headaches did stop there for Zoom and its 300 million users when 530,000 Zoom credentials showed up on the dark web
&rlm;&rlm;&lrm; &lrm;
Dont let your company have a rivacy disater <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow">click here</a> to try a free trial of TeamPassword.
&rlm;&rlm;&lrm; &lrm;
<h2>What happened at the Zoom Credentials Hack?</h2>
In early April 2020, cybersecurity firm Cyble came across Zoom credentials selling on a dark web hacker forum for $0.002 each.
Some forum users posted Zoom credentials for free, encouraging people to carry out Zoomboming and other disruptive attacks.
Cyble purchased 530,000 Zoom credentials to determine if they were authentic, only to find that many of their client's details were part of the list&mdash;including Zoom meeting URLs, users' email addresses, passwords, and HostKeys.
Cyble immediately alerted Zoom account holders through the media to change their passwords and exercise caution when using the video conferencing app.
<h3>Who Was Affected by the Zoom Credentials Hack?</h3>
Most of the Zoom credentials belonged to school and university faculty members and students. However, many big-name corporate clients, including Chase and Citibank, were also on the list.
<h3>What was the Fallout for Zoom?</h3>
Following the Zoom credential breach in April 2020, many companies worldwide banned the use of the video conferencing app.&nbsp;
Most notable organizations that banned Zoom include Google, SpaceX, Smart Communications, NASA, the Australian Defence Force, and the governments of Taiwan and Canada.
Many of these organizations have switched to enterprise end-to-end encrypted video conferencing alternatives that provide better security. Google Meet and Google Duo were popular choices for organizations moving away from Zoom in April 2020.
Overall, Zoom seems to have weathered the storm. The company has made significant security improvements since its troubling start to 2020.
&rlm;&rlm;&lrm; &lrm;
<h2>How did Hackers get Hold of Zoom Credentials?</h2>
According to Cyble, hackers most likely got these Zoom login details through a process called "credential stuffing." Credential stuffing is a cyberattack where hackers use login details stolen from one website or application to access another.
This sort of attack relies on users using the same username (or email address) and password for multiple websites and applications.&nbsp;
Suppose you use the same email and password for Facebook, Amazon, Zoom, Twitter, Instagram, and your electricity account. In that case, all a hacker has to do is breach one of these applications, and they have your login details for all six.
"If your username and password are compromised from Company A&mdash;who suffered a data breach&mdash;and you use that same username and password to login to your social media account, then that account could also be in jeopardy." A statement from the NSA following Zoom's credential hack.
<h3>How does Credential Stuffing Work?</h3>
Cybercriminals will usually attack a website or application with poor security to extract the users' email addresses and passwords. Using automation tools like Selenium, cURL, PhantomJS, the hackers then test these credentials against millions of websites and applications.
If the login details work for another account, the user's details are added to a list (in this case, a Zoom list of 530,000+) and eventually sold on the dark web.
<h3>Was Zoom to Blame for the Credential Hack in 2020?</h3>
Zoom and its users are both to blame for this credential attack. Users must practice better credential and password etiquette, while Zoom should have security measures to prevent credential stuffing.
It's actually relatively cheap and easy for websites and applications to prevent credential stuffing.&nbsp;
For example, Google's reCAPTCHA creates a problem for users to solve before verifying authentication. Although simple for humans, these problems are too complex for bots and stifle credential stuffing activities.
Another way applications can prevent credential stuffing is through <a href="https://teampassword.com/blog/password-manager-with-2fa">two-factor authentication (2FA)</a>.
So, while Zoom might not be directly to blame for the credential hack in April 2020, there are steps they could have taken to prevent credential stuffing attacks.
&rlm;&rlm;&lrm; &lrm;
Dont let hackers get a hold of your credentail with a <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow">14 day free trail</a>
&rlm;&rlm;&lrm; &lrm;
<h2>How Users can Prevent a Credential Stuffing Attack</h2>
There are several things users can do to prevent falling victim to credential stuffing, including using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a>, which can mitigate many password-related attacks.
<h3>Never Use the Same Passwords</h3>
One of the biggest mistakes people make is using the same password across multiple applications and websites. Always use a different password for every account.
Using a password manager like <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> will ensure you create a different password for every account. With TeamPassword's browser extensions, you never remember your password or store it in an unsafe place like a notepad or spreadsheet.
<h3>Never Share Login Credentials</h3>
Sharing login credentials is another way companies and individuals expose themselves to cyber attacks. Whether you're <a href="https://teampassword.com/blog/how-to-safely-share-passwords-with-coworkers">sharing passwords with coworkers</a> or freelancers (and contractors), it's always best practice to provide separate login credentials.
For accounts where you can only have a single username and password, you must use a password manager instead of sharing raw login credentials. This way, you only provide access to the password manager, giving you complete control over everyone's access.
TeamPassword's groups and sharing feature lets you securely share passwords with team members, clients, and freelancers. Create groups for specific accounts, so you only share access with those who need it.
With one click, you can revoke access for any user, mitigating the risk of unauthorized credential sharing. Because passwords are never exposed, team members, clients, and freelancers won't have access to your accounts when they no longer need it, and you don't have to worry about changing passwords every time someone leaves a project.
<h3>Create Strong Unique Passwords</h3>
Weak or commonly used passwords make it easy for hackers to guess your login details. Through phishing or researching your social media profiles, cybercriminals can gather information about your pet's names, children's names, memorable dates, or your maiden name to guess possible password combinations.
A strong password should be a minimum of 12 characters with a combination of uppercase, lowercase, symbols, and numbers. Using a <a href="https://teampassword.com/password-generator">password generator</a> is the most effective way to create strong passwords.
While a password generator is a great first step, you must ensure you safely store and share any passwords you create.
TeamPassword stores all your passwords for you and features a built-in password generator capable of generating 32-character passwords.
You can then use TeamPassword's browser extensions or native iOS and Android apps to access your accounts. You can also set up two-factor authentication to add an extra layer of protection to your password manager.
&rlm;&rlm;&lrm; &lrm;
<h2>Key Takeaways from the Zoom Credentials Hack</h2>
Rule number one, always use a unique password for every account. If every person practiced this password technique, the Zoom credential hack would not have happened in 2020.
Reset your passwords regularly. TeamPassword recommends changing passwords at least every 90-180 days. If you ever suspect suspicious activity on any account, change the password immediately and contact the application or website's customer support.
Activate two-factor authentication for every account that allows it. The extra step might be annoying, but nothing is worse than being hacked, especially if you lose money in the process.
Use a password generator to create strong, unique passwords that are near impossible to guess. Use a minimum of 12 characters with uppercase, lowercase, symbols, and numbers.
&rlm;&rlm;&lrm; &lrm;
<h2>TeamPassword - A Password Management Solution</h2>
TeamPassword is a robust tool for businesses to manage all of their passwords in one place. With advanced encryption, you never have to worry about sharing passwords with team members.
&rlm;&rlm;&lrm; &lrm;
Let TeamPassword take care of security so you can focus on delivering the best products and services to your customers. Get started with a <a href="https://app.teampassword.com/dashboard#signup/testimonial">free TeamPassword trial</a> today.

The video conferencing app Zoom soared due to the pandemic, but with that rapid growth, security flaws were found. What were they?

The video conferencing app Zoom soared due to the pandemic, but with that rapid growth, security flaws were ...

What Happened With The Zoom Credentials Hack?

The 2020 Twitter spear-phishing attack is a sobering reminder that cybercriminals will use every tool in the shed to infiltrate an organization.
On July 15, 2020, cybercriminals hacked Twitter's systems through social engineering to send Tweets from high-profile accounts, including Joe Biden, Barack Obama, Bill Gates, Elon Musk, Warren Buffett, Kanye West, Apple, and Uber, to name a few.
The Tweet from Barack Obama read:
"I am giving back to my community due to Covid-19! All Bitcoin sent to my address below will be sent back doubled. If you send $1,000, I will send back $2,000! Only doing this for the next 30 minutes! Enjoy."
All of the Tweets were in a similar vein. Encouraging people to act fast to donate money via Bitcoin under the guise of "doing good."
Twitter is referring to the incident as a "phone spear phishing attack" but is vague about the details of how cybercriminals <a href="https://www.teampassword.com/blog/the-biggest-data-breaches-of-2020">breached</a> the social network's systems.
&rlm;&rlm;&lrm; &lrm;
To keep yourself and your data protected try our <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow">14 day free trial</a>
&rlm;&rlm;&lrm; &lrm;&lrm; &lrm;
<h2>What is a Spear Phishing Attack?</h2>
You are probably familiar with a phishing attack, where cybercriminals send out a "spoofed" message (sometimes a phone call) encouraging the victim to click a link or share sensitive information.&nbsp;
In a typical phishing attack (a type of social engineering), criminals will send these messages en masse and see who "bites." There's no specific target.
A spear-phishing attack is far more sophisticated and targeted. Cybercriminals research an individual or an organization to find vulnerabilities.
These vulnerabilities might be personal information about an individual or how an organization communicates internally. With this information, criminals can customize their spoofed communication to convince the victim it's genuine.
&rlm;&rlm;&lrm; &lrm;
<h2>Twitter's Phone Spear Phishing Attack</h2>
For security reasons, Twitter is withholding the exact details of how the July 2020 spear-phishing attack happened. But from a July 30, 2020 statement, Twitter reveals phone spear-phishing was the method of attack:
"The social engineering that occurred on July 15, 2020, targeted a small number of employees through a phone spear-phishing attack. A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools."
It appears that criminals initially targeted a small group of employees via a phone phishing attack to access Twitter's systems. It's unknown if this was through text or voice calls.
In an official statement, the Department of Justice (DOJ) noted, "...the Twitter attack consisted of a combination of technical breaches and social engineering."
Speculation is that criminals contacted this small group of employees and tricked them into <a href="https://teampassword.com/blog/how-to-safely-share-passwords-with-coworkers">sharing their login credentials</a>.&nbsp;
They then used these credentials to infiltrate Twitter's internal support tools to target employees with higher access privileges.
With these high-level credentials, hackers were able to access individual Twitter accounts and unleash their scam.
&rlm;&rlm;&lrm; &lrm;
<h2>What Information was Compromised in the July 2020 Twitter Hack?</h2>
Given the breach of high-profile Twitter accounts and the level of access these criminals had, the consequences of this attack were actually reasonably minor.
The July 2020 Twitter spear-phishing attack by the numbers:
<ul>
<li style="font-weight: 400;" aria-level="1">130 Twitter accounts targeted.</li>
<li style="font-weight: 400;" aria-level="1">45 accounts Tweeted from.</li>
<li style="font-weight: 400;" aria-level="1">36 accounts had the DM inbox accessed.</li>
<li style="font-weight: 400;" aria-level="1">8 accounts downloaded "Your Twitter Data." A feature that allows a user to download a snapshot of their account, including account personal information, login history, linked apps and devices, and interests and ads data.</li>
<li style="font-weight: 400;" aria-level="1">383 Bitcoin transactions were sent to the scammer's account.</li>
<li style="font-weight: 400;" aria-level="1">12.86 BTC (US$117,000 at the time) stolen from victims following the Tweets' instructions.</li>
</ul>
It appears the attackers got away with a minimal amount of data&mdash;36 DM inboxes and the eight accounts where hackers downloaded "Your Twitter Data."&nbsp;
According to Twitter, "None of the eight were verified accounts." Meaning that the data downloaded wasn't from any of the high-profile accounts with the verified "blue checkmark."
&rlm;&rlm;&lrm; &lrm;
<h2>Who was Behind the 2020 Twitter Spear-Phishing Attack?</h2>
To date (August 2021), four people have been arrested for the Twitter spear-phishing attack.&nbsp;
The mastermind behind the Twitter attack is Graham Ivan Clark of Tampa, Florida, only 17 at the time of the attack. Authorities believe Clark is responsible for the spear-phishing attack on Twitter employees, where he gained access to internal systems.&nbsp;
Clark then posed as a Twitter employee on chat forums selling Twitter handles and account access to the other three perpetrators who carried out the Bitcoin scams.
19-year-old Mason Sheppard and 22-year-old Joseph O'Connor of the United Kingdom were responsible for the Bitcoin scam, while 22-year-old Nima Fazeli acted as a broker for Clark.&nbsp;
O'Connor was the only perpetrator known to authorities before the 2020 attack. Under the online handle, PlugWalkJoe, O'Connor was allegedly involved in SIM-swapping attacks to access social media accounts.&nbsp;
In a bizarre interview with the New York Times shortly after the 2020 attack, O'Connor confirmed he was PlugWalkJoe and that Twitter staff credentials were stolen during the 2020 attack. He went on to say, "I don't care. They can come arrest me. I would laugh at them. I haven't done anything."
The police decided to take O'Connor up on that offer and arrested him in Estepona, Spain, on July 21, 2021. O'Connor is waiting for extradition to the United States on multiple cybercrime charges.
&rlm;&rlm;&lrm; &lrm;
To keep yourself protected from spear-phishing attacks <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow">click here</a> to try TeamPassword's free trial.
&rlm;&rlm;&lrm; &lrm;
<h2>What was the Fallout of the Twitter Spear Phishing Attack?</h2>
It's alarming how easy it was for a lone 17-year-old low-level hacker to access Twitter's systems. Tweeting from these authoritative accounts can crash financial systems or start wars, which is why the full arm of the law came down on these four young perpetrators.
The Twitter spear-phishing attack involved multiple federal agencies, including the FBI, IRS, US Secret Service, and Florida law enforcement. Not to mention the British and Spanish agencies responsible for apprehending the two British nationals involved.
There was a mix of anger and confusion from the public and those targeted. The most perplexing thing for many was that most of the verified accounts had <a href="https://teampassword.com/blog/password-manager-with-2fa">two-factor authentication</a> set up on their accounts.
The criminals could change email addresses, and contact numbers on the accounts without a notification sent to the account holder. According to two ex-Twitter employees, more than 1,000 Twitter employees and contractors had access to change user accounts settings.
Edward Amoroso, a former chief security officer at AT&amp;T, told Reuters, "That sounds like there are too many people with access...In order to do cybersecurity right, you can't forget the boring stuff."
By Twitter providing such broad access, it makes it difficult to prevent an attack like this. Twitter has a logging system to aid with investigations but, at the time of the attack, nothing to alert or notify relevant departments when someone makes changes to a user's account internally.
&rlm;&rlm;&lrm; &lrm;
<h2>Action Taken by Twitter</h2>
In a blog post from July 30, 2020, Twitter announced they had taken access to limit access to internal systems. For a short time, some of Twitter's features were unavailable while they made security improvements.
"Since the attack, we've significantly limited access to our internal tools and systems to ensure ongoing account security while we complete our investigation... We are also improving our methods for detecting and preventing inappropriate access to our internal systems and prioritizing security work across many of our teams."
Twitter is also working on programs to educate its workforce on cybersecurity and how to avoid phishing.
&rlm;&rlm;&lrm; &lrm;
<h2>Is Your Business Protected Against Spear Phishing Attacks?</h2>
If this sort of spear-phishing attack could happen at Twitter, it could happen to any business. Luckily, it's not difficult to put simple measures in place to mitigate a breach like the Twitter hack of 2020.
<h3>Using a Password Manager to Control Access</h3>
Using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a> is a secure way to share access with employees and freelancers. With TeamPassword, you can grant and revoke access with a simple click.
You can create groups inside your TeamManager account, so you only share access with those who need it. If you hire a <a href="https://teampassword.com/blog/should-i-share-data-with-freelancers">freelancer or contractor</a>, you can add them to the group and remove them when they complete the job.
A detailed log records every action and user's activity, and you can set up email notifications for just about any action on TeamPassword. This tracking would allow you to stay ahead of any unauthorized sharing or access.
<h3>Secure 2FA</h3>
TeamPassword features 2FA to add an extra layer of security to your password manager. By adding an extra layer of protection, you minimize the risk of unauthorized access, even if an attacker steals an employee's password.
<h3>Creating Secure Passwords</h3>
One of TeamPasswords best features is its built-in password generator. Create robust 12-32 character passwords for any social media account, website, or application, and then share access to all users with just one click.
With TeamPassword, the passwords aren't visible to team members, so no need to worry about unauthorized sharing. When someone leaves your team, simply delete them from TeamPassword, and they no longer have access.
&rlm;&rlm;&lrm; &lrm;
<h2>Secure Your Business with TeamPassword</h2>
If there is one thing we have learned from Twitter's spear-phishing attack, it's crucial companies actively promote <a href="https://teampassword.com/blog/cyber-security-awareness-month-and-teampassword">cybersecurity awareness to employees</a> and put systems in place to prevent cybersecurity vulnerabilities.

Start your<a href="https://app.teampassword.com/dashboard#signup/testimonial"> free TeamPassword trial today</a> and build a robust working environment with TeamPassword.

On July 15, 2020, Twitter was hacked using a spear-phishing attack. How did they do it? And how can Twitter protect its self in the future?

On July 15, 2020, Twitter was hacked using a spear-phishing attack. How did they do it? And how ...

What Happened During The Twitter Spear-Phishing Attack?

Nintendo has had a run of cyberattacks in recent years. In 2017 they were infamously hacked by a security researcher, Zammis Clark, who stole over two terabytes of data, including game source files, prototypes, game emulators, unreleased products, and more, some of which dated back to the 80s!
In April 2020, Nintendo was again at the center of a cyber-security controversy, this time involving 300,000 Nintendo Network ID (NNID) for Nintendo Switch accounts. Initially, Nintendo claimed it was only 160,000, but it discovered another 140,000 compromised accounts after further investigation.
While more than 300,000 Nintendo users were hacked, less than 1% were used to make fraudulent transactions. Nintendo has been vague about how attackers acquired user logins but did mention in a statement that data was "obtained illegally from other than our service by some other means."
&rlm;&rlm;&lrm; &lrm;
Try TeamPassword by trying a&nbsp;<a href="https://app.teampassword.com/dashboard#signup/testimonial">free trial</a>&nbsp;and see for yourself what TeamPassword can do for you.
&lrm;
<h2>A Rough Timeline of Events</h2>
<ul>
<li style="font-weight: 400;" aria-level="1">April 9, 2020 - Much to the confusion of its followers, Nintendo randomly Tweets: "You can help secure your Nintendo Account by enabling 2-Step Verification." with a link to instructions.</li>
<li style="font-weight: 400;" aria-level="1">April 19, 2020 - Founding editor of LootPots, a Nintendo fansite Tweets: "I suspect Nintendo may have had a major security breach. My account was accessed numerous times overnight. My password is a unique string, and my PC is definitely clean (not that I ever login via it). Lots of similar reports on Reddit/Twitter. Unlink PayPal &amp; enable 2FA folks!"</li>
<li style="font-weight: 400;" aria-level="1">April 24, 2020 - Nintendo releases an official statement confirming 160,000 accounts have been compromised.</li>
<li style="font-weight: 400;" aria-level="1">April 27, 2020 - Nintendo confirms they have discovered another 140,000 accounts, taking the total to 300,000.</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2>What Account Information Was Compromised?</h2>
According to Nintendo, the NNID data breach included:
<ul>
<li style="font-weight: 400;" aria-level="1">The account owner's full name</li>
<li style="font-weight: 400;" aria-level="1">Email address</li>
<li style="font-weight: 400;" aria-level="1">Date of birth</li>
<li style="font-weight: 400;" aria-level="1">Their country of residence&nbsp;</li>
</ul>
Fortunately, the billing information is hidden and cannot be extracted but can still be used to make purchases. Some users with linked payment methods reported fraudulent transactions at the My Nintendo Store or Nintendo eShop.
These transactions triggered initial suspicions of account breaches, with some users reporting strange behavior and purchases as early as March 2020.
&rlm;&rlm;&lrm; &lrm;
<h2>How Did Hackers Access Nintendo User Accounts?</h2>
For "security reasons," Nintendo hasn't disclosed how hackers access NNID accounts, but they do confirm there wasn't a breach of their servers, leaving three possible scenarios.
<h3>Credential Stuffing</h3>
Hackers use usernames (or email addresses) and passwords stolen from one application to perform automated large-scale application logins. These credentials are often stolen from the servers of games or applications with weak security.&nbsp;
Hackers rely on the fact that many people use the same username and password for multiple accounts. One possibility is that hackers may have gained access to a chatroom or application frequented by Nintendo users and stolen login credentials.
Cybercriminals would then need to test each username and password and see if anyone has used the same credentials for their Nintendo account.
We know that Nintendo encouraged users to use different passwords for their NNID and Nintendo Account to <a href="https://teampassword.com/blog/are-hackers-really-trying-to-steal-your-password">minimize the risk of credential stuffing</a>.&nbsp;
<h3>Phishing</h3>
Another likely scenario, and one that's very common, is that Nintendo users may have been victims of a phishing attack. In a phishing attack, cybercriminals use a "spoof" message (text, email, etc.) to trick a user into clicking a link or revealing sensitive data.
On first inspection, phishing attacks are challenging to identify because hackers will mimic correspondence or even build a replica application or website login.
<h3>Brute Force Attack</h3>
A brute force attack is essentially a guessing game where hackers systematically try passwords until they gain access. They often start with common phrases and combinations and then use phrases relevant to a user's name or personal information.
Nowadays, most websites and applications prevent brute force attacks by limiting the number of times you can enter a correct password or requiring <a href="https://teampassword.com/blog/password-manager-with-2fa">two-factor authentication (2FA)</a>.
&rlm;&rlm;&lrm; &lrm;
<h2>The Fallout of Nintendo's User Breach</h2>
Nintendo users were understandably upset, taking to Twitter and Reddit to vent their frustrations. Not only was this the second major breach for Nintendo in the space of three years, but the Japanese giant's lackluster response seemed to fuel anger and frustration.
Users were given no real explanation of how this happened, which would help knowing where they might be vulnerable.
Nintendo did offer to cancel and refund any fraudulent purchases, but according to several Reddit posts, this has not been easy with Nintendo denying some requests.
Nintendo now requires users to use two-factor authentication to prevent this type of breach from happening again.
&rlm;&rlm;&lrm; &lrm;
<h2>Protecting Yourself Against Unauthorized Logins</h2>
While companies are responsible for protecting our data, we must also take responsibility to protect ourselves. That means better <a href="https://app.teampassword.com/dashboard#signup/testimonial">password management</a>.
Companies will do everything they can to avoid refunds, so if they can prove you were negligent, there's a high likelihood you might never recoup some or all of your losses.
<h3>Stronger, Secure Passwords</h3>
The first step is creating <a href="https://teampassword.com/blog/how-secure-is-my-password">secure passwords</a> for all of your accounts. A secure password should be unique, complicated, and ideally no less than 12 characters, so it's near impossible to guess.
One way to create stronger passwords is by using a <a href="https://teampassword.com/password-generator">secure password generator</a>. These password generators produce a complicated series of randomized characters for you to copy/paste.
With <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a>, you get a built-in password generator capable of creating 32-character secure passwords. You can choose to include uppercase, lowercase, numbers, and symbols to ensure you get robust passwords every time.
<h3>Create a Different Password for Every Account</h3>
Another huge mistake people make, using the same password across multiple accounts. Even if you have a 32-character, ultra-secure password, you should never use it more than once.&nbsp;
If a hacker steals that password during a breach or you fall victim to a cyberattack, criminals will have access to all of your accounts.&nbsp;
By creating a separate password for every account, website, and application, you're limiting your exposure and minimizing potential losses.&nbsp;
<h3>Two-Factor Authentication (2FA)</h3>
Once you have secure passwords and use different credentials for every login, you'll want to add another layer of security. Two-factor authentication (2FA) will prevent anyone from accessing your accounts, even if they have your login credentials.
<h4>What is 2FA, and How Does it Work?</h4>
2FA is a two-step process for logging into an account. The primary step is your password, while the second step is an action you need to take, which could include:
<ul>
<li style="font-weight: 400;" aria-level="1">Possession factor - an authentication method linked to a person such as a 2FA device, text message, email, or application on one of your devices. For example, when logging in to your bank account, you might receive a text message with a code to enter after your password.</li>
<li style="font-weight: 400;" aria-level="1">Knowledge factor - authentication through a memorable word or phrase. For example, your mother's maiden name or the name of your best friend in high school.</li>
<li style="font-weight: 400;" aria-level="1">Biometric factor - authentication through fingerprints, retina shape, or facial and voice recognition.&nbsp;</li>
</ul>
Most applications use Google Authenticator (possession factor) to facilitate 2FA, but some companies might send a text or email or have their own applications or devices. Google Authenticator is popular because it's free and available for iOS and Android.
TeamPassword uses Google Authenticator for 2FA, and you can also generate backup codes to ensure you never get locked out.&nbsp;
&rlm;&rlm;&lrm; &lrm;
<h2>TeamPassword - A Comprehensive Password Management Solution</h2>
TeamPassword allows you to take the guesswork out of creating and saving passwords. With 2FA and backup codes, your accounts are more secure with TeamPassword.
We use the highest levels of security with the most up-to-date encryption technology.
<h3>Accessible Anywhere</h3>
With TeamPassword, you can access and manage your passwords anywhere and from any device. We even have Chrome, Firefox, and Safari extensions so you can log in to any account quickly and securely.
<h3>Groups and Sharing</h3>
One major vulnerability comes when you need to share logins and passwords. TeamPassword was built for collaboration allowing you to allocate credentials with other users securely. You can also remove a user with one click, providing maximum security and efficiency.
<h3>Built-In Password Generator</h3>
A built-in password generator allows you to generate robust, 12 - 32 character passwords on the fly quickly. TeamPassword will automatically save your new passwords, so you never have to remember or store them outside of the application.
<h3>Activity and Logging</h3>
When you manage teams with access to your accounts and those of your clients, it's crucial to keep track of who is logging in, viewing passwords, or sharing access.&nbsp;
With TeamPassword's activity log, you can keep track of all that data to minimize unauthorized access. You can also set up email notifications to get immediate activity updates, perfect for monitoring highly sensitive applications and data.
&rlm;&rlm;&lrm; &lrm;
Avoid becoming another data-breach statistic! Try TeamPassword with a <a href="https://app.teampassword.com/dashboard#signup/testimonial">free trial</a> today and take control of your password management!

Nintendo has had a run of cyberattacks in recent years, but what happened in 2021? What data was compromised? How could it be prevented?

Nintendo has had a run of cyberattacks in recent years, but what happened in 2021? What data was ...

What Happened During Nintendo's Data Breach in 2021?

What Happened During Nintendo's Data Breach in 2020?

Ransomware attacks&nbsp;happen all the time, with an estimated 4,000 attacks happening every day (one every 11 seconds). The Colonial Pipeline ransomware attack is just the most recent high-profile attack on a U.S. company, but it also sheds light on the real and present dangers of criminal hackers abroad.&nbsp;&nbsp;
At&nbsp;TeamPassword, we offer a Password Manager for teams. It&rsquo;s a fast and easy way to lock down your passwords and secure logins, so your team is in sync with your company&rsquo;s projects and directives, no matter where they are. So sign up to try out the&nbsp;<a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">free trial</a>.
<h2>What Happened in the Colonial Pipeline Cyberattack?&nbsp;&nbsp;</h2>
On May 7, 2021, a hacker attacked Colonial Pipeline, the largest American pipeline for refined oil products. The cyberattack affected the company&rsquo;s computer network, which forced Colonial Pipeline to shut down its operations as a precaution. Their cessation of fuel distribution, which amounts to approximately 45% of the East Coast fuel supply, quickly led to panic buying and widespread fuel shortages.&nbsp;&nbsp;
Colonial Pipeline worked with the Federal Bureau of Investigation (FBI) to respond to the hacker&rsquo;s ransom note, with the payment of $4.4 million, or 75 bitcoin, shortly after the ransomware attack. The hackers sent a software application that slowly restored the network to Colonial Pipeline&rsquo;s control. The company took more than a week before returning operations to something akin to normalcy.&nbsp;&nbsp;
<h2>What Is a&nbsp;Ransomware&nbsp;Attack?&nbsp;</h2>
A ransomware attack is&nbsp;really&nbsp;just&nbsp;an extension of a hacker&rsquo;s malware attack. The attacker&nbsp;hacks into a computer system by exploiting security vulnerabilities and&nbsp;then seizes control over the device(s) and data. The ransomware occurs when the hacker demands a huge payout to release their hold on the company&rsquo;s network and devices.&nbsp;&nbsp;&nbsp;
Ransomware attacks are especially dangerous because hackers can easily bypass security and access the company&rsquo;s computer network, with all its apps, files, databases, etc., without top-level admin access.&nbsp;&nbsp;
<h2>Who Was Responsible for the Ransomware Attack?&nbsp;&nbsp;</h2>
The FBI indicated that&nbsp;DarkSide, a Russian hacker group that&rsquo;s been under investigation, was responsible for the cyberthreat and ransomware attack, which shut down Colonial Pipeline and its 5,500 miles of distribution network.&nbsp;They are not the only famous <a href="https://www.teampassword.com/blog/who-can-hack-your-business-passwords" target="_blank" rel="noopener">hacking group</a>, but they have managed to quickly make a name for themselves.
DarkSide&nbsp;claims to be apolitical, without ties to any government or political group. They&rsquo;ve been around since August 2020, with the continued and ongoing pursuit of huge payouts&nbsp;via ransomware attacks on companies in the U.S. and Europe. They hack in and gain access to the network and all data, which they&nbsp;then use to extort money from companies with threats that they&rsquo;ll release the personal info.&nbsp;&nbsp;
<h2>What Makes a Company Susceptible to Ransomware?&nbsp;</h2>
Companies already face so many challenges even in the scope of&nbsp;&ldquo;normal&rdquo; business processes and procedures. After all, some of the biggest companies in the world have been attacked by ransomware, so it may seem impossible to stop a cyberattack.&nbsp;&nbsp;
The good news is that you can take steps to <a href="https://www.teampassword.com/blog/are-your-passwords-hacker-proof-a-checklist-to-help-you-decide" target="_blank" rel="noopener">minimize the risk of ransomware attacks</a> on your organization. First, you must&nbsp;understand that many of the challenges related to cybercrime and&nbsp;ransomware attacks are not impossible to stop. Still, you must also be willing to acknowledge that you will need to invest in data protection and security measures not only for your network but also&nbsp;for your team.&nbsp;&nbsp;
You must address the most basic misconceptions about cybercrime first. Then, with growing experience, awareness, and understanding of what you&rsquo;re facing, you can begin the concrete&nbsp;steps to address the lapses in security and training that make you most vulnerable to a cyberattack.&nbsp;Here&nbsp;are some top tips that should help you protect your company from ransomware and cyber threats.&nbsp;&nbsp;
<h3>Back-Up Your Files&nbsp;&nbsp;</h3>
It&rsquo;s not just a matter of backing up your files once a year or even once a month. You should back up files at least once a day, if not more, but you should also set up external&nbsp;backups that are offsite and offline to fully protect your company from cyberattacks. Ultimately, Colonial Pipeline was able to get back up and running with their own backups, even after they paid the hackers.&nbsp;&nbsp;
Hackers can more easily maintain long-term control of a company&rsquo;s network when there are no current&nbsp;backups. If you think about it, the company may be over a barrel when they are not able to access current company records, including sales information, customer details, and inventory breakdowns.&nbsp;&nbsp;
<h3>Update Your Security Protocols and Systems</h3>
You should use top-notch cybersecurity measures for your network and computers, including up-to-date antivirus software. Regularly check those computer measures and verify that you have the latest versions for your operating system, along with the patches for all the software applications, widgets, and programs you and your team use.&nbsp;&nbsp;
Part of updating your security should include training as well as frank and ongoing discussions with your team and with any individual associated with your company, including board members. People are your greatest vulnerability, which is why hackers are so often able to take advantage of security lapses and risks that are directly related to the people who work for a company.&nbsp;&nbsp;
<h3>Use Strong Passwords</h3>
It&rsquo;s often easier and even faster to reuse passwords across an organization. Then anyone can access the files you all use, without the hassle and slowdown of copying, sharing, or looping others into the workflow. Of course, we now know that the ransomware attack on Colonial Pipeline succeeded because of their lapses in password security.&nbsp;&nbsp;
It&rsquo;s important to use strong passwords, but also to <a href="https://www.teampassword.com/blog/common-password-problems-faced-small-organizations" target="_blank" rel="noopener">change them regularly and keeping them secure</a>. Creating and maintaining insecure passwords is one of the most basic ways that a hacker can successfully break into a company&rsquo;s network and cause havoc, which is why Team Password offers a&nbsp;<a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">free trial</a>&nbsp;to show you just how much a comprehensive password manager will help your team with its password security needs.&nbsp;&nbsp;
<h3>Test for a Cyberattack</h3>
With so many attacks happening every day, your company is under constant threat. While there&rsquo;s not a lot you can do to prevent hackers from trying to break&nbsp;into&nbsp;your network, you can continually test your security measures to make sure that you&rsquo;ve got them locked down as much&nbsp;as possible.&nbsp;&nbsp;
The more you do to prepare, prevent, and mitigate the effects of a cyberattack, the better off your company will be when a hacker launches a full-scale attack. Constantly testing and being aware of new cyber threats also means that you&rsquo;ll be more likely to see incursions into your network security and be prepared to stop them.&nbsp;&nbsp;
<h2>What Was the Resolution of the Colonial Pipeline Ransomware Attack?&nbsp;&nbsp;</h2>
Ransomware attacks can bring a company&rsquo;s operations to a standstill. The true resolution of a ransomware&nbsp;attack breaks down in a few different ways. In the case of the Colonial Pipeline ransomware attack, the company paid the hackers nearly $5 million, but that wasn&rsquo;t the end of the story.&nbsp;
The U.S. Department of Justice (DOJ) was able to recover part of the ransom money. Still, it&rsquo;s also a wake-up call for not only Colonial Pipeline but also all major companies and corporations. This case has blown up in the news because it is such a serious breach. The event was also not something that Colonial Pipeline could easily hide, with the fuel shortage and the potential for further damages.&nbsp;&nbsp;
<h2>What Makes the Colonial Pipeline Ransomware Attack Different?&nbsp;&nbsp;</h2>
When hackers attack prominent companies, it&rsquo;s not always public knowledge that it&rsquo;s happening. In fact, some of the most prominent cases weren&rsquo;t publicized until long after the incidents happened. It&rsquo;s understandable in most cases that the company wants to keep the security breach quiet, particularly when the customer data at major financial institutions have been compromised.&nbsp;&nbsp;
In the Colonial Pipeline incident alone, the hackers stole 100 gigabytes of data and threatened to release it on the internet. We&rsquo;d have to assume that the hackers still have possession of all that data or can use it for their own&nbsp;purposes. It&rsquo;s important to recognize that cases like this happen every day, but that this case encouraged us all to talk about what we can do to prevent cyberattacks like this from happening.&nbsp;&nbsp;&nbsp;
<h2>Next Step: Sign Up for a Free Trial at&nbsp;TeamPassword&nbsp;</h2>
The&nbsp;Colonial Pipeline ransomware attack highlights the importance of maintaining excellent digital &ldquo;hygienic&rdquo; practices. In other words, it&rsquo;s important to do everything you can to protect your company from attack. Still, some of the most basic principles of digital security (like password reuse) can be overlooked. That&rsquo;s where&nbsp;TeamPassword&nbsp;comes in.&nbsp;&nbsp;
At&nbsp;TeamPassword, we offer the tools to ensure that your&nbsp;team has the safest and most secure passwords and logins possible with our Password Manager for teams. It&rsquo;s our goal to make sure that one of the basic security measures (making sure you don't reuse passwords) is locked down.&nbsp;
Our goal is to help you protect your company and your team, so you can focus on the other essential aspects of supporting your company&rsquo;s growth and development. Find out more about how your&nbsp;<a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">free trial</a>&nbsp;can help your team combat the dangers of cyberattacks today!&nbsp;&nbsp;
<a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">Sign Up for a Free Trial at TeamPassword </a>&mdash;<a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener"> Secure Your Company&rsquo;s Future Against Cybercrime</a>

The Colonial Pipeline ransomware attack demonstrates how reusing passwords can affect your company’s cybersecurity and private information.

Colonial Pipeline Ransomware Attack: Don't Reuse Passwords

The biggest data breaches of 2020 show the importance of taking cybersecurity seriously. What can you learn from these incidents?

The biggest data breaches of 2020 show the importance of taking cybersecurity seriously. What can you learn from ...

The Biggest Data Breaches of 2020

Password encryption is essential to store user credentials stored in a database securely. Without password encryption, anyone accessing a user database on a company's servers (including hackers) could easily view any stored passwords.
Even a strong 32-character password created using a <a href="https://teampassword.com/password-generator">secure password generator</a> is useless without password-encryption! If someone can read your password on a server, they can use it simply by copy/pasting it&mdash;no matter how long or complicated the password might be!
Encryption scrambles your password before saving it on the server. So, if someone hacks the server, instead of finding password123, they find a random series of letters and numbers.
In this article, we're going to explore the world of password encryption, why <a href="https://teampassword.com/blog/tips-and-tricks-to-create-a-strong-password">strong passwords matter</a>, and how you can practice better password management!
<a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> is the password management solution for small businesses! Create, store, and share login credentials safely with employees, contractors, and clients. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> today!
&rlm;&rlm;&lrm; &lrm;[Table of Contents]
<ul>
<li><a href="#understandingpasswordencryption" rel="follow">Understanding Password Encryption</a></li>
<li><a href="#howdoespasswordencryptionwork" rel="follow">How Does Password Encryption Work?</a></li>
<li><a href="#5commonpasswordencryptionmethods" rel="follow">5 Common Password Encryption Methods</a></li>
<li><a href="#whystrongpasswordsmatter" rel="follow">Why Strong Passwords Matter</a></li>
</ul>
<h2 id="understandingpasswordencryption">Understanding Password Encryption</h2>
To explain password encryption effectively, we must first grasp the language. Several terms might be unfamiliar, so here is a quick intro to password encryption terminology.
<ul>
<li style="font-weight: 400;" aria-level="1">Key: Used to lock and unlock passwords using a random string of bits. You get private and public keys that crypt and decrypt data differently, but we won't get too deep in the weeds with keys!</li>
<li style="font-weight: 400;" aria-level="1">Bits: A logical state with one of two possible values, including 1/0, true/false, yes/no, or on/off as typical examples.</li>
<li style="font-weight: 400;" aria-level="1">Block (block cipher): A deterministic algorithm operating on fixed-length groups of bits, called blocks.</li>
<li style="font-weight: 400;" aria-level="1">Hash function: The algorithm that uses the key to create password encryption and decryption. A hash function is essentially a piece of code that runs every time someone saves a password or logs into an application.&nbsp;</li>
<li style="font-weight: 400;" aria-level="1">Hash: A random series of numbers and letters representing your password. The hash function uses your hash instead of the raw password for authentication.</li>
<li style="font-weight: 400;" aria-level="1">Salt: Additional letters and numbers appended to the hash</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2 id="howdoespasswordencryptionwork">How Does Password Encryption Work?</h2>
When you save a new password, a hash function creates a hash version and saves that on the server.&nbsp;
Every time you log in using your password, the hash function recreates the hash to see if it matches what's stored. If the hashes match, the algorithm passes the authentication and logs you in.&nbsp;
For example:
<ul>
<li style="font-weight: 400;" aria-level="1">Original password: Pa$$w0rd123</li>
<li style="font-weight: 400;" aria-level="1">Hashed password: 6AF1CE202340​FE71BDB914AD5357​E33A6982A63B</li>
</ul>
While this might seem secure, simple hashed passwords aren't hack-proof.
The hash function only creates a unique hash for each password, not each user. So, if multiple users have the password, Pa$$w0rd123, the hash will be exactly the same.
To overcome this encryption vulnerability, engineers salt passwords so each hash is unique, even if the passwords are identical.
<h3>How Salt Works</h3>
A salt appends a unique value of 8 bytes (16 characters) to the password before the hash function creates a hash. This way, even identical passwords are unique before the hash function.
For example:
<ul>
<li style="font-weight: 400;" aria-level="1">Two identical passwords: Pa$$w0rd123</li>
<li style="font-weight: 400;" aria-level="1">Salt value one: E1F53135E559C253</li>
<li style="font-weight: 400;" aria-level="1">Salt value two: 84B03D034B409D4E</li>
<li style="font-weight: 400;" aria-level="1">Password one before hash: Pa$$w0rd123E1F53135E559C253</li>
<li style="font-weight: 400;" aria-level="1">Password two before hash: Pa$$w0rd12384B03D034B409D4E</li>
<li style="font-weight: 400;" aria-level="1">Password one hashed value (SHA256): 72AE25495A7981​C40622D49F9A52E4F15​65C90F048F59027BD9​C8C8900D5C3D8</li>
<li style="font-weight: 400;" aria-level="1">Password two hashed value (SHA256): B4B6603ABC670​967E99C7E7F1389E40​CD16E78AD38EB1468E​C2AA1E62B8BED3A</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2 id="5commonpasswordencryptionmethods">5 Common Password Encryption Methods</h2>
<h3>1. Data Encryption Standard (DES)</h3>
While applications no longer use Data Encryption Standard (DES), it's important to mention this password encryption method because of its history and influence on more secure modern standards.
IBM developed DES as a 56-bit encryption technology in the early 1970s. The NSA adopted and improved DES before it was approved worldwide as the encryption standard.
However, since the late 70s, hackers have been able to break DES encrypted passwords. In 1999, ethical hackers managed to break a DES key in under 24 hours.&nbsp;
To make DES more secure, engineers created Triple DES and later Advanced Encryption Standard (AES), which we still use today.
<h3>2. Triple DES</h3>
Triple DES uses three 56-bit keys (blocks) to create 168-bit encryption (some security experts argue that Triple DES is only 112 bits strong). Although Triple-DES is slowly being phased out, many financial institutions still use it to encrypt ATM PINs.
<h3>3. Advanced Encryption Standard (AES)</h3>
AES is the new encryption standard&mdash;trusted by the United States Government and many other prominent organizations globally. At 128 bits, AES is sufficiently secure, but most organizations prefer heavy-duty 256-bit encryption.
At <a href="https://teampassword.com/security">TeamPassword</a>, we use 256-bit encryption to store passwords, ensuring the highest levels of security for our clients. We're also a <a href="https://teampassword.com/security">secure hosting provider</a> holding multiple security accreditations.
Hackers can only break an AES encrypted password through a brute-force attack&mdash;trying password combinations to find the right one.
To counter brute-force attacks, applications will lock an account after a certain number of attempts or use tools like Google's reCAPTURE.
<h3>4. Blowfish</h3>
American cryptographer, Bruce Schneier, designed Blowfish in 1993 as an antidote to the weak DES encryption. Blowfish uses a 64-bit block and variable key length of 32 to 448 bits.
Although Blowfish is more robust than its DES predecessor, the 64-bit block is still vulnerable to attacks, most commonly birthday attacks&mdash;a cryptographic attack that exploits the mathematics behind the algorithm.
To solve Blowfish vulnerabilities, engineers created Twofish in 1998 (128-bit blocks with 256-bit keys) and Threefish in 2008 (256, 516, 1024-bit blocks with 256, 516, 1024-bit keys).
<h3>5. Rivest-Shamir-Adleman (RSA)</h3>
RSA is one of the oldest and widely used to transfer data securely. The encryption works with two keys, two large prime numbers, and an additional auxiliary value.
Due to the complicated encrypting and decrypting process, there is no known method for breaking RSA encryption.&nbsp;
Although widely used for transferring data, RSA is slow and not suitable for password encryption.
&rlm;&rlm;&lrm; &lrm;
<h2 id="whystrongpasswordsmatter">Why Strong Passwords Matter</h2>
Password encryption can only prevent criminals from viewing saved credentials stored on a server&mdash;but cannot prevent hackers from guessing weak/commonly used passwords. If you <a href="https://teampassword.com/blog/colonial-pipeline-ransomware-attack-dont-reuse-passwords">reuse the same password for multiple accounts</a>, this also puts you at risk!
Encryption is most effective when users create robust, unique passwords for every account. For example, a random 32-character password with letters, numbers, and special characters hashed and salted is near impossible to guess or decode, even using a computer!
In another scenario, let's assume you have a strong 32-character password, but you use it for every account. If hackers manage to steal that password, they have access to every account using the same credentials! Your strong password is effectively useless.
<h3>Improving Your Password Management</h3>
Now that you understand password encryption and the associated vulnerabilities, you can see why strong passwords are essential.
Effective password management is crucial to protect yourself against cyberattacks or in the highly likely event of a data breach where hackers steal your credentials.
Criminals are after the low-hanging fruit&mdash;people who use weak passwords!
5 tips for creating stronger passwords:
<ol>
<li style="font-weight: 400;" aria-level="1">Create strong passwords for every account. The easiest way to do this is using a password generator. <a href="https://teampassword.com/password-generator">TeamPassword has a free password generator</a> anyone can use to create passwords from 12-32 characters using uppercase, lowercase, numbers, and special characters. We recommend creating passwords as long as the application will allow.</li>
<li style="font-weight: 400;" aria-level="1">Never create passwords shorter than eight characters, with 12 being our recommended minimum.&nbsp;</li>
<li style="font-weight: 400;" aria-level="1">Never reuse the same password for multiple accounts.</li>
<li style="font-weight: 400;" aria-level="1">Never create passwords with your name, family member's names, or pet's names. With social media, this information is freely available. Criminals can add those names to algorithms for brute-force attacks.</li>
<li style="font-weight: 400;" aria-level="1">Don't store passwords in digital notepads or spreadsheets. We recommend using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager like TeamPassword</a> to create and store your credentials.</li>
</ol>
&rlm;&rlm;&lrm; &lrm;
<h2>Why You Need a Password Manager like TeamPassword</h2>
We have so many accounts these days; it's almost impossible to create unique, memorable, secure passwords for each one. A password manager solves this problem.
Instead of remembering the credentials for every account, you only need to memorize the one to log into your password manager.&nbsp;
TeamPassword keeps all of your credentials safely stored and encrypted, so you never have to memorize a password again. Instead of entering your credentials, you use one of TeamPassword's browser extensions (Chrome, Firefox, and Safari) to log into accounts.
<h3>Built for Teams</h3>
TeamPassword's best feature is its ability to share credentials with team members securely. Instead of sharing passwords, you provide access through TeamPassword.&nbsp;
Employees <a href="https://app.teampassword.com/dashboard#signup/testimonial">use TeamPassword</a> to log in, meaning you never share raw passwords&mdash;no more worrying about unauthorized access or sharing.
You can create groups in TeamPassword to share access with employees, clients, contractors, and freelancers. When someone no longer needs access, remove them from the group with a single click. No need to change passwords every time someone leaves a project!
<h3>Built-In Password Generator</h3>
TeamPassword features a built-in secure password manager so you can create robust passwords for every account. TeamPassword also ensures you never reuse the same credentials so that you won't fall victim to credential stuffing attacks!
With a built-in password generator, you can change passwords regularly, and TeamPassword will update the new credentials for all users!
<h3>Monitor Login Activity</h3>
TeamPassword's activity log keeps track of every action across all of your accounts&mdash;logins, password changes, new team members, sharing access, and more.
You can also set up email notifications for all TeamPassword actions so that you can react fast to any suspicious activity.
<h3>Get Your Free TeamPassword Trial</h3>
Password encryption is not enough to protect your business from password vulnerabilities! You need a robust password manager like TeamPassword to create, store, and share credentials securely.
&rlm;&rlm;&lrm; &lrm;
<a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> and let TeamPassword secure your company's digital assets.

Password encryption is the number one component of password security. TeamPassword encrypts passwords with state-of-the-art technology to keep passwords safe.

Password encryption is the number one component of password security. TeamPassword encrypts passwords with state-of-the-art technology to keep ...

What is password encryption and how much is enough?

What is password encryption and how does it work?

Over the last decade, the gig economy boom has allowed professionals worldwide to switch to freelancing and build a network of international clients.&nbsp;
According to Upwork, 1 in 3 US workers engaged in freelance work during 2020. Some of the most successful freelancers earn hundreds of thousands of dollars per year through platforms like Upwork, Freelancer, and Toptal.
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
Does your company hire freelancers? How do you <a href="https://teampassword.com/blog/should-i-share-data-with-freelancers">share passwords with freelancers</a>? TeamPassword is an affordable password management solution for small businesses, startups, and agencies to share credentials securely with team members and freelancers. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> today.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h2>10 Successful Freelancers</h2>
Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in their given field with excellent track records&mdash;many have worked with the biggest companies in the world!
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>1. Scott Luscombe - Graphic Designer / Shopify Expert / Website Developer / Copywriter&nbsp; - Canada</h3>
Scott Luscombe is a freelance graphic designer, Shopify expert, website developer, and copywriter from Uxbridge, Canada. He holds a degree in Illustration from Sheridan College and a degree in Marketing from the University of Toronto.
Scott has been a freelancer for most of his professional career and has earned over $500k on Upwork. He has completed over 311 jobs and worked&nbsp;10,956 hours!&nbsp;
Scott's work includes graphic design and branding, illustration and icons, copywriting, website design and development, UX/UI, and printing and packaging. He also provides freelance coaching and consulting. Scott is a Top Rated Upwork Freelancer currently charging $99 per hour for various creative gigs.
Some of Scott's most notable work includes designs for Coca-Cola, the Canadian Cancer Society, Nickelodeon, and Wallet Ninja (to name a few).&nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>2. Kathy Edens - Marketing Consultant / Freelance Copywriter - United States</h3>
<a href="https://www.upwork.com/freelancers/~016177d19f0624c1a7?viewMode=1">Kathy Edens is a Top Rated Upwork Freelancer</a> with over $300k platform earnings! Kathy has been self-employed as a marketing consultant and freelance copywriter for almost ten years from her home in Ohio, United States.
She holds a Bachelor of Science in Professional Writing and Psychology from Oregon State University, which she says "...helps me understand how to reach your target audience with words."&nbsp;
Kathy has ghost-written several non-fiction books on various topics, including social entrepreneurship, healthcare, real estate investing, and the cannabis industry, to name a few.
Kathy also writes web content, sales pages, email marketing content, case studies, white papers, brochures, press releases, and more. Kathy's rates start at $86 per hour for her writing and marketing services.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h3>3. Koen van Oeveren - UX designer - Netherlands</h3>
Koen van Oeveren is a freelance UI &amp; UX designer from North Brabant, Netherlands, with almost ten years of experience. Koen works with several design agencies in the Netherlands, designing apps, websites, and eCommerce experiences for many international brands.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
Koen holds a Bachelor of Applied Science in Communication and Multimedia Design from Avans University in the Netherlands. Koen's <a href="https://www.koenvo.com/index.html">portfolio website Koenvo</a> was nominated for a <a href="https://www.awwwards.com/sites/koenvo-ui-ux-portfolio">2021 awwwards. Award</a>.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h3>4. Pascal Strasche - Product / UX designer - Germany</h3>
Pascal Strasche is a product and UX designer with more than ten years of design experience from Germany. He holds a Master of Arts in Interaction Design and a Bachelor of Arts in Graphic Design, both from HAWK University of Applied Sciences and Arts.
For almost a year over 2020/2021, Pascal worked as the sole product designer to design Con Cubo's SaaS tool that helps complex organizations visualize and manage teams. He's also worked with German steel giant XOM Materials to find product solutions to digitalize&nbsp;Germany's steel industry.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
In 2019, Pascal founded Product Design Resources, a growing archive of 800+ design resources, weekly updated for the design community.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>5. Paul Hunkin - Developer - New Zealand</h3>
Paul Hunkin is a freelance software consultant and developer from Tauranga, New Zealand, but currently living in Portugal.&nbsp;
Paul has over ten years of experience as a software developer with an impressive work history, including Google, NASA, InfoSys, and the Chinese aerospace industry leader COMAC.
He's worked with several early-stage startups designing everything from high-performance big-data systems to complex web applications to 3D rendering engines. He's also built a lot of the foundational code for independent games on Android.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
Paul is a Top Rated Upwork Freelancer with over $400k in platform earnings. His rates start at $120 per hour for software development. <a href="https://paulh.consulting/">Check out Paul's website</a> for more about his impressive portfolio and work history.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>6. Jana Galat - Writer / Brand Strategist - Canada</h3>
Jana Galat is a freelance copywriter and brand strategist from Ontario, Canada. She holds a Bachelor's Degree in Management and Organizational Studies from King's University College and an Honors in Business Administration from Western University.
Jana has extensive experience writing landing pages, email campaigns, social media ads, and print materials and says, "I am obsessed with creating copy that sells..."
After several years of professional work experience, Jana went freelance in 2019 and has quickly built a reputation as a <a href="https://www.upwork.com/freelancers/~01bfa17a48301876dd">Top Rated Upwork Freelancer</a> with over $70k in platform earnings. Jana's rates start at $100 per hour for copywriting and brand consulting.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>7. Kate H. - Logo Designer / Branding Expert - United States</h3>
Kate is a freelance professional logo designer and branding expert from Maryland, United States. Kate&nbsp;ran her own green wedding brand which she sold to mywedding.com in 2014, allowing her to focus on helping small&nbsp;businesses figure out what they want (and who they are) and translate that into design.
She holds a Master's degree in Environmental Management from Yale School of The Environment, and a J.D. in environmental law from Pace Law School.&nbsp;
Kate's skillset includes redesigning and updating material to make it easier to understand, building a consistent brand from a simple starting point like a logo, and creating unique logos that guarantee results.
Kate is a Top Rated Upwork Freelancer, and her rates start at $225 per hour. You can find out more about Kate on her <a href="https://www.upwork.com/freelancers/~013ce73876c1c18126" rel="follow noopener" target="_blank">Upwork profile</a>.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>8. Marcos Rezende - UX designer - Canada</h3>
Marcos Rezende is a UX Designer from Ontario, Canada, with more than 13 years of experience. Marcos has worked in over 30 industry sectors for multinational organizations in the United States, Canada, Germany, and Brazil.&nbsp;
Some of Marcos' notable projects include apps for Ontario's COVID-19 dashboard, Urban Master Planning collaboration platform, and Reaction (kid's e-learning app), to name a few.&nbsp;
Marcos loves sharing his industry expertise with aspiring UX designers and regularly writes for the popular UX publication Career Foundry. Total recognizes Marcos as part of its "Top 3%" of global freelancer talent&mdash;a title given to elite freelancers in their given field.
We don't have access to Marcos' rates, but the best UX designers on Upwork earn upwards of $100 per hour. As a Toptal Top 3% freelancer, Marcos likely charges $200-$300 per hour.
<a href="https://www.marcosrezende.com/">Marcos Rezende's website</a> was nominated for the prestigious <a href="https://www.awwwards.com/sites/ux-portfolio-marcos-rezende">awwwards.</a> in 2021.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>9. Tanya Litvinova - UX/UI Designer - United States</h3>
Tanya Litvinova is a freelance UX/UI designer from New York City, United States. She holds a Bachelor of Fine Arts in Advertising Design / Communication Design from the Fashion Institute of Technology.
Tanya specializes in product, mobile, and web design as well as user experience flow, research, and validation.
"I have a passion to make the complex simple, shape behavior, design, plan, and strategize. Aiming for the best user experience, all the while balancing the needs of business and technology to create engaging, habit-forming digital products."
Tanya has worked with Fortune 100 &amp; Fortune 500 companies and successfully delivered business-transforming data-driven analytics, responsive BI dashboards, enterprise web apps, and management systems. Some of Tanya's notable clients include KOCH Industries, BlackRock Financial, BCG Group, and FireEye, to name a few.
<a href="https://www.upwork.com/freelancers/~0165035041b26e96df">Tanya is a Top Rated Upwork Freelancer</a> with more than $200k platform earnings. Her current rate starts at $162.50 per hour.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>10. Guangming Lang - Data Scientist - United States</h3>
Guangming Lang is a freelance data scientist from Michigan, United States. He holds a Bachelor of Arts in Mathematics from New College of Florida and a Master of Science in Biostatistics from the University of Michigan. Guangming has also completed several Coursera courses in data science and machine learning.
Guangming has been a freelancer since 2013 and has worked across several industries, including fintech, trading, medicine, biotech, advertising, and HR.&nbsp;
Guangming is a Top Rated Upwork Freelancer with over $400k in platform earnings. He's completed 216 jobs on Upwork totaling 3,805 hours! Guangming's current rates start at $200 per hour.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h2>Secure Freelancer Workflows With TeamPassword</h2>
No matter how talented or reputable the freelancers and contractors you hire, your company must use secure workflows to protect your digital assets.
Freelancers often need access to shared accounts and tools. Using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a> is the first step to securing these accounts and platforms. You can also use a password manager to share credentials with employees, clients, and other stakeholders to ensure you never expose raw passwords via email, spreadsheets, chat apps, and other non-secure methods.
<a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> lets you create groups to share access with only those who need it. When they're done, revoke access with a single click. No need to change passwords every time someone leaves the team.
If you do need to change a password, TeamPassword's built-in <a href="https://teampassword.com/password-generator">password generator</a> lets you create secure passwords between 12-32 characters using numbers, letters (uppercase/lowercase), and symbols.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
Ready to onboard clients and freelancers securely with TeamPassword's robust <a href="https://app.teampassword.com/dashboard#signup/testimonial">password management solution</a>? <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a free trial</a> to secure your company's digital assets today!

Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in their given field.

Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in ...

10 extremely successful freelancers and what they do

Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in their given field with excellent track records—many have worked with the biggest companies in the world!

In an increasingly digital world, we&rsquo;re switching more and more of our daily lives over to the Internet. While this brave new world is exciting and convenient, it&rsquo;s not without its problems.&nbsp;
The issue of unsafe passwords has been around for a while. But have you ever thought about where and how to store them?
Most of us have several passwords, and we&rsquo;re encouraged to never duplicate them. Some people simply write them all down on a piece of paper &mdash; which is fraught with danger. But others store their passwords electronically.
As you&rsquo;re about to find out, not all electronic systems of password storage are <a href="https://www.teampassword.com/blog/10-things-you-need-to-do-to-keep-passwords-safe" target="_blank" rel="noopener">safe</a>. Here are five of the most dangerous ways to store your passwords.&nbsp;
But before we begin:
Avoid bad idea passwords and dangerous storage methods with TeamPassword. This advanced <a href="https://www.teampassword.com/blog/why-you-need-a-password-manager" target="_blank" rel="noopener">password manager</a> features a selection of security features, including password encryption and two-step verification. Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow">free trial</a> today.&nbsp;

<h2>1. Email</h2>
Have you ever emailed yourself a password to ensure you&rsquo;re never without it? Great idea, right? Actually, emailing yourself your passwords is a really bad idea, and here&rsquo;s why:
<ul>
<li>Emails are usually sent in plain text. Without encryption, your passwords are susceptible if your email account is ever compromised.&nbsp;</li>
<li>Unsafe passwords sent via email often pass through several systems and servers. There&rsquo;ll also be a copy in your sent folder. If someone else can access your email account, your passwords become vulnerable.&nbsp;</li>
<li>Some email platforms store data locally on a drive. If someone steals your computer, phone, or tablet, your passwords become vulnerable.</li>
</ul>
A really bad idea for passwords is to send them via email &mdash; either to yourself or someone else. <a href="https://www.teampassword.com/blog/have-i-been-hacked-how-to-know-for-sure" target="_blank" rel="noopener">Hackers </a>and scammers are more resourceful than ever, and they can often steal your information before you realize you&rsquo;ve been compromised.&nbsp;
It&rsquo;s tempting to send a quick email to yourself containing unsafe passwords when you sign up for new online services. For the sake of an extra minute or two, don&rsquo;t give fraudsters easy access to your accounts. Use an encrypted email vault to safeguard all your passwords.&nbsp;
<h2>2. Online Documents</h2>
A lot of people like the convenience of saving crucial information using online document systems such as Google Docs. But this is a bad idea for passwords, as these systems are designed for text &mdash; not sensitive data.
Yes, a password might protect your online document manager from unauthorized access. But what happens if that password is compromised? Many document software platforms don&rsquo;t offer encryption, two-step verification, or even the most basic security measures.&nbsp;
If you use online documents regularly, you&rsquo;re probably accessing your account on a regular basis &mdash; across several devices. What happens if you step away for a moment to buy a coffee, speak to a friend, or use the bathroom?
A criminal can access an unattended online document platform in seconds. And if this happens, it doesn't take a lot of effort to steal your unsafe passwords.&nbsp;
<h2>3. Instant Messaging Service</h2>
Instant messaging services provide us with a convenient way of staying in touch with friends and family. WhatsApp, Facebook Messenger, and Snapchat were designed for private online conversations &mdash; not for storing passwords.
People who store their passwords on these apps do so because they believe they&rsquo;re fully encrypted. While that&rsquo;s often the case, it&rsquo;s important to remember that instant messaging services are often left open and operating in the background.
Imagine someone picks up your phone while you&rsquo;re not paying attention. If you left your device unlocked, that person would be able to access your password in seconds.
It&rsquo;s always a bad idea when passwords are stored on instant messaging services. By nature, these apps are designed to operate in the background &mdash; alerting you when someone sends a message. And because they&rsquo;re open, anyone with the device in their hand might be able to steal your unprotected passwords.&nbsp;
Don&rsquo;t fall into the trap of utilizing bad ideas for password storage. Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">free trial</a> with TeamPassword, and give your unsafe passwords the protection they require.
<h2>4. Online Note-taker</h2>
Developers design online note-takers for everyday lists and reminders. While they&rsquo;re great for creating to-do and shopping lists, they&rsquo;re not so good for storing unsafe passwords.&nbsp;
An app such as Apple Notes is easy to use, accessible, and convenient. But it doesn&rsquo;t offer two-step authentication, encryption, or any sophisticated form of security.&nbsp;
If your computer or mobile device is unlocked, your saved passwords are vulnerable. In many cases, a criminal would simply need to open the app to gain access to your sensitive information.&nbsp;
OK, you might be extra vigilant when it comes to keeping your phone or computer locked. But hackers are resourceful, and they&rsquo;re very good at discovering unsafe passwords. Once they access your phone, any passwords stored in your note-taking app become vulnerable.&nbsp;
<h2>5. On a Non-Password-Protected Device</h2>
Of all the bad ideas for passwords, storing them on non-password-protected devices is about the worst. You might think that your tablet or laptop never leaves your side. But if your device is ever stolen, you&rsquo;ve given the criminals the easiest possible opportunity to access your saved passwords.&nbsp;
If you&rsquo;re determined to store passwords on a physical device &mdash; which is never a good idea &mdash; make sure the device password is a complex combination of letters, numbers, and symbols. And it should contain at least 12 characters.&nbsp;
<h2>Use TeamPassword for Extra Protection</h2>
Remembering and safely storing a dozen or more passwords isn&rsquo;t a simple task. By locking away all your passwords in a digital vault, you get maximum protection and easy access.&nbsp;
TeamPassword offers a range of <a href="https://www.teampassword.com/security" target="_blank" rel="noopener">security features</a> &mdash; designed to keep your passwords safe. Offering two-step authentication and encryption, this powerful protection system solves the problem of unsafe passwords with ease. Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">free trial</a> to see these exciting features for yourself.&nbsp;

Storing passwords inappropriately can leave you open to fraud and theft. Avoid these storage methods at all costs. | TeamPassword Blog

Storing passwords inappropriately can leave you open to fraud and theft. Avoid these storage methods at all costs. ...

TeamPassword Blog

Browse our carefully created articles about Information Security, Password Management, Product Information, and Modern Business, all written with your team's safety and success in mind.

Most popular articles

Password Management

October 24, 2023 ∙ 11 min read

How to Make a Good Username | Create a Unique and Secure Username

What is password encryption and how does it work?

10 extremely successful freelancers and what they do

Top 5 Dangerous Ways to Store Your Passwords

News

August 10, 2021 ∙ 9 min read

What Happened at The EasyJet Data Breach?

News

August 10, 2021 ∙ 9 min read

What Happened With The Zoom Credentials Hack?

News

August 10, 2021 ∙ 9 min read

What Happened During The Twitter Spear-Phishing Attack?

News

August 3, 2021 ∙ 9 min read

What Happened During Nintendo's Data Breach in 2020?

News

June 29, 2021 ∙ 8 min read

Colonial Pipeline Ransomware Attack: Don't Reuse Passwords

News

April 13, 2021 ∙ 41 min read

The Biggest Data Breaches of 2020

The Password Manager for Teams

Product

Support

Channels

Legal