A rant: Twitter, your 2-factor Authentication Sucks, or Why #Brands Get Hacked On Twitter

For the past six years, I’ve worked in online marketing. As such, I have been the holder of ALL the keys to the social media accounts for many brands I have worked for and worked with in the Silicon Valley and beyond. My biggest nightmare as the holder of the keys is waking up in the morning to find my company on the frontpage of Mashable as the latest of the #brands (I mean that hashtag ironically) who had a social media account hacked via phishing, spearphishing, or something worse. To prevent the worst from happening, I’ve implemented a variety of multi-layered security strategies over the past few years  to protect myself and my brand’s self to foil any attempts of account takeover.

Today, I logged in to my brand account to reconfigure one of these layers of security on Twitter. When I finally got to the spot in account settings where I can enable 2-factor authentication, however, I was informed that Twitter only allows use of 2factor authentication with one phone number.

Thanks, Twitter but no: THIS IS NOT OKAY. Continue reading “A rant: Twitter, your 2-factor Authentication Sucks, or Why #Brands Get Hacked On Twitter” →

This is bullshit: A rant on hacking, passwords, security and usability.

Over the weekend, a major news story broke about an iCloud attack in which hackers broke into the accounts of 100 female celebrities to steal compromising nude pictures. Every. single. time there’s a “hacking” incident, the media coverage is awful— and the security advice is even worse. Case in point:

In all of the discussion of the incident,

Continue reading “This is bullshit: A rant on hacking, passwords, security and usability.” →

On safety + personal space while being a woman

giphy

Last night, I took to Twitter to yell about something complicated, anger-inducing, emotional and downright frightening: the recent, persistent violation of my personal space that I’ve endured in San Francisco. Sometimes when I have a problem that needs solving, quick, short bursts of concise text help me get to the center of the issue: in this case, I’ve lived here for a few years now, but have never felt as physically threatened and violated as I have in finding my way through its streets as of late.

Until just a few weeks ago, I’ve been lucky– I’ve walked the streets of this city relatively unimpeded for 3.5 years, purposely blending in and not sticking out from the crowd. After yet again having a person lay his hands on me without my permission and without good reason for the sixth time in a month yesterday evening, I couldn’t bottle it up anymore.

So I let loose… Continue reading “On safety + personal space while being a woman” →

This is why your “Women in Tech” event sucks

giphy (1)

A few weeks ago, my friend Leah wrote a thoughtful post about how to get more women into technology and STEM careers. In her post, she says:

Enticing women to tech isn’t about making it “diva-fied” or “girlification.”… Reducing women in tech from engineers to “web divas” pushes us into superficial territory and marginalizes our skills and contributions.  Instead of looking up to women in tech as problem-solvers and visionaries we get looked down upon as interlopers far from home.

Women are not all the same.  We don’t all want pink and flowers and glitter.  We don’t all think the same. We aren’t one dimensional creatures who will be drawn to the tech world because someone sent us a flier with pretty purple letters and butterflies.  We don’t all enter the tech world the same way and any strategy that relies on all women being alike is doomed to fail.

Continue reading “This is why your “Women in Tech” event sucks” →

A must-read for educators: privacy, ethics, and educator responsibility in #edtech

There are some exciting tools out there that allow students to do amazing things, but test them out first of all with a dummy account and cast a critical eye over the ethics of the service before you encourage students to start using it.

If you’re an educator, this post by Cameron Hocking is a great place to begin thinking critically about the tools you use and the responsibility you have in protecting your students data: Educational Conferences and the ethics of EdTech.

STOP! Don’t even think about upgrading to iOS 8 today!

 beyonce

If you were on earth today and you use technology, you might be excited about iOS 8 because you read about it on a tech blog or heard something about it on the news. You might even want it now, because there are tons of blog posts telling you how you can get iOS 8 right now. You’re wondering if it’s worth $99 to sign up for that developer account and see if all of those tech bloggers know what they’re talking about, and if the future we’re being promised on our Apple devices is really as great as everyone says it is.

I’m here to tell you one very important thing: DON’T. Don’t do it, gurl, don’t do it! Do not upgrade to the developer version of iOS 8 unless you’re a developer working on an app or something else for the platform.

Developers are a highly-evolved species of skilled digital nitpickers (ed note: I mean this with love) who are well equipped to give feedback, find security vulnerabilities, and report bugs that will affect their own software creations before this release finds its way to the public. I’ve worked for and advised a few iOS developers, and have upgraded twice to beta versions of iOS software in the past.

I am here to tell you that you don’t want iOS 8 because iOS 8 isn’t ready for your jelly you just yet. Here’s why:

1) Beta software is notoriously buggy— because it’s a first draft of a piece of tech that hasn’t yet been put through the ringer, and then shined and polished for its intended audience. There are lots of buttons and interactions that just won’t work, because the lines of code that make them run still need a bit of work to make magic happen.

2) There’s no going back. Once you upgrade to the beta version of iOS 8, you’re stuck there– there’s no way to roll back the install and revert to fully-functional iOS 7 if you decide that you can’t handle it.

3) Your most loved and frequently used apps weren’t built to work with iOS 8.  If you’re the kind of person who wants to watch  your apps CRASH CRASH CRASH until the full release, you’re more than welcome to upgrade– for everyone else, just don’t do it.

4) Your phone could lose major functionalities for the unforseeable future. Last year, I was unable to use my camera for an entire weekend and couldn’t open Mail to save my life for three days. And that doesn’t even touch the intermittent issues that popped up with both Bluetooth and wi-fi in the beta period.

5) Security. New software and programming languages are, by definition, full of security problems. Apple does an audit before they release something into the wild… but do you really want to use something before white hat hackers have had a couple of months to sniff out all of the operating system’s 0day vulnerabilities and other potential weaknesses? (In case you’re wondering, “No” is the correct answer to this question.)

6) iCloud problems, you’re gonna have them. In this particular release, iCloud is changing everything– and that means it will probably be changing server environments, too. It’s very highly likely that your device, if upgraded, will stop synching/communicating with Mavericks and iOS 7 devices. No bueno!

Today’s WWDC keynote was a show-and-tell session of some pretty exciting stuff, a, but it’s important to note that Apple’s iOS 8 was released to a community whose feedback, over the next three months, will help them polish and refine the work they’ve been doing since last Fall’s public release.

Still thinking about downloading that hot new OS? You’re not going to get to the singularity or any other fully digitally connected cyborg future by downloading the latest operating system before anyone else has it, and by putting yourself through unnecessary pain to boot. So cool your heels, put down the credit card, and wait to install iOS 8 with the rest of us when it is in full release this Fall.

We (the regular people) will need all of the help we can get crashing Akamai’s servers (if Apple hasn’t replaced them with their own CDN)  two years in a row ;)

Did I miss any other good reasons to wait before updating? Let me know in the comments!

What To Do When You’re a Teacher Being Cyberbullied #edsec #edtech #edchat

Image

A few days ago, a good friend approached me about a difficult situation taking place in her classroom. After noticing that a student had given her a disparaging nickname in an email, she was devastated when she came across numerous mean-spirited, false comments made about her by that student on a social network.

This wasn’t the first time it had happened in her school– but it was the first time it had happened to her, and she wasn’t sure how to bounce back from something that has marred the last few weeks she had with her students this year. What should she do to protect herself from this in the future? Continue reading “What To Do When You’re a Teacher Being Cyberbullied #edsec #edtech #edchat” →

How Educators Can Protect Students’ Data from Security Breaches

This article was written for MindshiftKQED, where it appeared here.

getty

By Jessy Irwin

Every day, teachers are responsible for maintaining numerous logins, passwords, data, and other private information about their students. As chief technology officer in the modern century classroom, an educator’s role becomes more complex (and potentially overwhelming) as more tablets, computers, and web tools are put in the hands of students. With so many tools, security and privacy are often an afterthought despite the increasing number of websites that fall victim to data breaches and security vulnerabilities each day.

Last week, researchers discovered Heartbleed, a massive security flaw in an encryption tool used to protect data across some of the most popular sites on the web. For almost two years, this hole in OpenSSL may have quietly left two-thirds of the web vulnerable to eavesdropping, leaking private data including logins, passwords, and other information stored in Web servers to anyone who might be listening. Given the enormous amounts of information entrusted to teachers about their students, colleagues, and their communities, here are a few important measures teachers can take to protect themselves from Heartbleed.

  • Don’t login to a site or attempt to change your passwords unless you’re certain that a vulnerable site has been fixed. Though most major web companies have fixed the Heartbleed bug, it’s important to note that logging in and changing passwords on a vulnerable site will leave you vulnerable to the likelihood of an attack.

  • There are numerous resources that can help you determine whether a site is vulnerable or if it has been patched. If you use Google Apps for Education, Yahoo! Mail, Pinterest or Minecraft in your classroom and you haven’t changed your passwords in the last week, it’s safe to do so now. For Android users, this tool from mobile security firm Lookout will help identify whether your operating system is susceptible to Heartbleed. Alternately, there are many tools that can check encrypted sites for the bug here, here, and here.

  • Your online accounts are more likely to be compromised by a phishing attack that attempts to steal account credentials than a hacker exploiting Heartbleed to steal data from servers. Because public awareness of Heartbleed is high, malicious hackers will do their best to make the most out of this situation as they can. For maximum security, educators should be manually accessing the sites they use when they want to login and change passwords instead of clicking through links within an email.

  • If you’re using the same password for multiple accounts on the web, it is safest to assume all of the accounts using that password have been compromised. In the wake of major data breaches, criminals can and will employ tools that attempt to break into any online accounts they can. If you are one of many educators exercising this insecure habit, now is an excellent time time to break it. Password managers like LastPass, 1Password and KeePass are valuable tools that can help educators to generate, store, and audit passwords for all of your web accounts.

  • Heartbleed may be affecting your school or district network, too. Security engineers are beginning to discover that firewalls, switches, virtual private networks, servers and other important network hardware are also susceptible to the hole in OpenSSL. In some cases, the records of your current and former students stored in an SIS are vulnerable, and sensitive information could be leaked without a trace to the rest of the web. District technology leaders, technology coordinators, and anyone maintaining databases full of student information should double check with hardware vendors to confirm whether their systems need patching or not.

Though technologists and engineers have patched many of the sites vulnerable to Heartbleed, it’s impossible to determine if sensitive user data may have leaked onto the web. While there is no such thing as being completely safe from hacking and data breaches on the web, there are many preventative measures that can be taken to protect sensitive data and online accounts. If there’s a lesson that can be taken away from Heartbleed, it’s this– there’s never a bad time to be proactive about online security.

Jessy Irwin is a privacy and security advocate who once integrated technology and social media into a class of 3,000 students.

 

 

How Educators Can Protect Students’ Data from Security Breaches

This article was written for MindshiftKQED, where it appeared here.

getty

By Jessy Irwin

Every day, teachers are responsible for maintaining numerous logins, passwords, data, and other private information about their students. As chief technology officer in the modern century classroom, an educator’s role becomes more complex (and potentially overwhelming) as more tablets, computers, and web tools are put in the hands of students. With so many tools, security and privacy are often an afterthought despite the increasing number of websites that fall victim to data breaches and security vulnerabilities each day.

Last week, researchers discovered Heartbleed, a massive security flaw in an encryption tool used to protect data across some of the most popular sites on the web. For almost two years, this hole in OpenSSL may have quietly left two-thirds of the web vulnerable to eavesdropping, leaking private data including logins, passwords, and other information stored in Web servers to anyone who might be listening. Given the enormous amounts of information entrusted to teachers about their students, colleagues, and their communities, here are a few important measures teachers can take to protect themselves from Heartbleed.

  • Don’t login to a site or attempt to change your passwords unless you’re certain that a vulnerable site has been fixed. Though most major web companies have fixed the Heartbleed bug, it’s important to note that logging in and changing passwords on a vulnerable site will leave you vulnerable to the likelihood of an attack.

  • There are numerous resources that can help you determine whether a site is vulnerable or if it has been patched. If you use Google Apps for Education, Yahoo! Mail, Pinterest or Minecraft in your classroom and you haven’t changed your passwords in the last week, it’s safe to do so now. For Android users, this tool from mobile security firm Lookout will help identify whether your operating system is susceptible to Heartbleed. Alternately, there are many tools that can check encrypted sites for the bug here, here, and here.

  • Your online accounts are more likely to be compromised by a phishing attack that attempts to steal account credentials than a hacker exploiting Heartbleed to steal data from servers. Because public awareness of Heartbleed is high, malicious hackers will do their best to make the most out of this situation as they can. For maximum security, educators should be manually accessing the sites they use when they want to login and change passwords instead of clicking through links within an email.

  • If you’re using the same password for multiple accounts on the web, it is safest to assume all of the accounts using that password have been compromised. In the wake of major data breaches, criminals can and will employ tools that attempt to break into any online accounts they can. If you are one of many educators exercising this insecure habit, now is an excellent time time to break it. Password managers like LastPass, 1Password and KeePass are valuable tools that can help educators to generate, store, and audit passwords for all of your web accounts.

  • Heartbleed may be affecting your school or district network, too. Security engineers are beginning to discover that firewalls, switches, virtual private networks, servers and other important network hardware are also susceptible to the hole in OpenSSL. In some cases, the records of your current and former students stored in an SIS are vulnerable, and sensitive information could be leaked without a trace to the rest of the web. District technology leaders, technology coordinators, and anyone maintaining databases full of student information should double check with hardware vendors to confirm whether their systems need patching or not.

Though technologists and engineers have patched many of the sites vulnerable to Heartbleed, it’s impossible to determine if sensitive user data may have leaked onto the web. While there is no such thing as being completely safe from hacking and data breaches on the web, there are many preventative measures that can be taken to protect sensitive data and online accounts. If there’s a lesson that can be taken away from Heartbleed, it’s this– there’s never a bad time to be proactive about online security.

Jessy Irwin is a privacy and security advocate who once integrated technology and social media into a class of 3,000 students.