Mashed Articles

Scandals like the recent Sony hacks, LulzSec takedowns and breaches at seemingly half the world’s game companies should ideally be focusing global attention on the difficulties of staying secure in the digital age. Instead, they’re another distraction.

They change the question from ‘How do we stay safe?’ to ‘How do we catch these people?’ regardless of the fact that showboating hackers are – for the most part – a short-term nuisance rather than a serious threat to anyone.

The real threat is that modern security is useless. No matter how well files are encrypted, no matter how many levels of protection are in place, these systems inevitably have one key flaw: being designed around algorithms and policies that work on paper, not how people work.

Nobody can remember all the passwords they’re expected to memorise. Nobody is helped by being forced to think more securely, like having to choose a password with numbers, capital letters and symbols in it. It’s all well and good to say that we should use different logins for everything, never write them down anywhere and all that stuff, but please. That’s just not going to happen, and we know it.

The web particularly is a minefield of stupid security. Most online banking services still have weaker security than World of Warcraft of all things, which offers two-tier authentication via your mobile phone. The average hack has nothing to do with slamming every word in the English dictionary into a password field (something there’s no excuse not to detect and stop on the server side anyway), but rather tricking people into logging into a fake site and harvesting the details, or targeting the software and databases behind the scenes.

The frustrating thing about all this is that if you do get hacked – especially an embarrassing hack, like your credit card address being used to buy porn or similar – the assumption will always be that you did something wrong. Despite the fact that it’s increasingly obvious the weakest links are often out of users’ hands.

Sony, for instance, was caught storing everyone’s usernames and passwords in plain text format. Dropbox always claimed that its staff had no access to user uploaded files, only metadata, before a subpoena led to it admitting that it really meant it had policies in place to prevent people getting into accounts rather than an actual wall…

Most recently, the company suffered a humiliating four-hour lapse in which it turned out that no accounts had any form of protection on them at all.There’s no one-size-fits-all solution to security problems. Nobody wants to have to punch in a number from their phone just to post a message on Twitter.

A good start, however, would be for the world to admit that 100 per cent protection is impossible and design systems accordingly. For example, an online forum has no business asking what your mother’s maiden name is, nor your date of birth. A simple checkbox to say ‘I am over 18’ would be more than sufficient, especially since anyone who isn’t is going to lie anyway.

There’s no reason that a digital purchase made via PayPal needs to ask for your home address, nor that every last web service should demand a password for the sake of it, rather than because they have anything to protect.

The less information a site has, the less can be stolen. It’s only recently that online service Instapaper started insisting new accounts have passwords due to behind-the-scenes trouble, but up to that point 82 per cent of its users were happy to go without, simply because there was nothing that needed padlocking. Even now, passwords can be a single character.

Going further, I’d love to see more centralised logins, like Facebook, Google and OpenID, as used on oh-so-many web services at the moment. That kind of thing opens up a whole fresh can of worms in terms of trust, and I’d never use any of them for, say, online banking. Even the companies who dabble in this often don’t do it properly, taking far too many rights and privileges, or scraping data they have no right to.

Still, with that tightened up, it seems like a better fix for second-tier sites and services that do need to be protected but don’t actively matter that much to anyone. If nothing else, having a simple screen to revoke permissions and it deleting data would be far preferable to having to trust some server admin to flick the switch if they can be bothered.

Would it fix all the problems? No. But in a world where complicated passwords and sneaky Post-It notes aren’t getting the job done either, it’s worth a try.