Category: security

But what if my password manager gets hacked?! A few thoughts on how to talk about security worries with non-experts

BLOG POST IMAGE (2)

Authentication is one of the riskiest and most misunderstood things that non-experts have to manage day in, day out, and even though there are lots of companies out to “kill” passwords, they’re not dead yet. For the foreseeable future, experts or not, we’re all stuck with making the best out of what we have, and as security practitioners, we need to continue focusing on improving security outcomes to set humans up for success instead of password reuse and failure.

One of the most common questions I am asked in 1000 different ways when I talk about password managers as a way to remove credential management burdens from users is, “Are password managers safe? What if they get hacked?” As a self proclaimed password truther, I don’t mind this at all— once upon a time, I got into an argument with an extremely intelligent guy at a friendly meetup who wouldn’t leave me alone about mutual authentication with TLS when I worked at 1Password— and, well, spoiler alert… we’re getting married this year. Continue reading “But what if my password manager gets hacked?! A few thoughts on how to talk about security worries with non-experts” →

Advertisement

How to Teach Computer Security Skills

This piece was originally published here by Educating Modern Learners.

With increasing adoption of computer technologies, schools must do a better job addressing two important issues: privacy and security. Here, education security advocate Jessy Irwin offers some first steps in learning about security. And this isn’t just a lesson for students — it’s for teachers and school leaders and parents as well. 

If digital citizens have learned anything from the web in 2014, it is that this year is the year of the hacker. While malicious black hat hackers compromised hundreds of millions of accounts across the web, their ethical, white hat counterparts uncovered code flaws like Heartbleed and Shellshock that weakened parts of the critical infrastructure of the web. In this new web order, the question is no longer “if” you will be hacked on the web, but “when.” In many schools, the primary goal of digital literacy education is to give students the skills they need to find, remix and create content on the ever-expanding worldwide web. In the quest to unlock the potential of the web and its troves of boundless content for learners, however, many educators overlook the weakest aspect of digital literacy for the average web user: security. Continue reading “How to Teach Computer Security Skills” →

On #edsec: Education’s massive security problem

Dinosaurs are a very important part of the security conference experience.
Dinosaurs: a very important part of the security conference experience.

A few months ago, I gave a talk at BSidesLV on the state of security in education technology. My talk, #edsec: Hacking for Education isn’t a hacker talk in the truest of senses— I had no l33t, sophisticated hacks to show off, no beautiful backdoors into well-maintained code to make my point. Instead, I went the route of discussing the lack of security standards, the dire state of security awareness among educators, the deplorable state of school infrastructure, and the security-averse attitude of developers within education technology .

I should have written this post months ago— I am thankful for alot of people who helped me get through my first-ever talk at a national conference— but I’ve been struggling to overcome an awful, awful feeling that in the pit of my stomach after I finished my week away at hacker summer camp. After being surrounded by people who discussed securing the critical infrastructures that make our web work, protecting medical devices from attack, and preparing for the Internet of Things that is to come, I realized that I didn’t go far enough.  Continue reading “On #edsec: Education’s massive security problem” →

A rant: Twitter, your 2-factor Authentication Sucks, or Why #Brands Get Hacked On Twitter

For the past six years, I’ve worked in online marketing. As such, I have been the holder of ALL the keys to the social media accounts for many brands I have worked for and worked with in the Silicon Valley and beyond. My biggest nightmare as the holder of the keys is waking up in the morning to find my company on the frontpage of Mashable as the latest of the #brands (I mean that hashtag ironically) who had a social media account hacked via phishing, spearphishing, or something worse. To prevent the worst from happening, I’ve implemented a variety of multi-layered security strategies over the past few years  to protect myself and my brand’s self to foil any attempts of account takeover.

Today, I logged in to my brand account to reconfigure one of these layers of security on Twitter. When I finally got to the spot in account settings where I can enable 2-factor authentication, however, I was informed that Twitter only allows use of 2factor authentication with one phone number.

Thanks, Twitter but no: THIS IS NOT OKAY. Continue reading “A rant: Twitter, your 2-factor Authentication Sucks, or Why #Brands Get Hacked On Twitter” →

This is bullshit: A rant on hacking, passwords, security and usability.

Over the weekend, a major news story broke about an iCloud attack in which hackers broke into the accounts of 100 female celebrities to steal compromising nude pictures. Every. single. time there’s a “hacking” incident, the media coverage is awful— and the security advice is even worse. Case in point:

In all of the discussion of the incident,

Continue reading “This is bullshit: A rant on hacking, passwords, security and usability.” →