Join us as we gather around the hedge,
where we dig into technology,
business, and culture with the finest minds in
computer networking.
Hello, Russ. How are you doing today? Seems
you're a little under the weather. I am
a little under the weather, but, yeah, it's
okay. I mean, the doctors are trying to
take care of me
as much as they can and, you know,
I think it'll work itself out eventually.
A little bit of a frightening week, but,
you know.
Okay. Okay. Well, we're hoping for you quick
recovery.
And today, we are joined by Carl Buell.
So, Carl,
can you take just a second? Let us
know where where are you at physically?
Well, I'm located in Bradenton, Florida. And so
we're on the, Gulf Coast,
and we're just South Of Tampa and North
Of Sarasota.
Awesome. Awesome. Well, thanks for joining us today,
Carl. So today pleasure. We wanted to we
wanted to talk a little bit about passwords
today. So so just to get us started,
I think, let's let's start with this. What,
what would you say makes a good password?
Well, obviously,
good password
includes,
more characters as opposed to fewer characters
and a combination
of letters
as well as numbers as well as,
special characters.
So would you say more characters is more
important than randomness?
And and,
like, longer is more important than randomness, or
would you say
they're equal? Or how would you how would
you scope those out? Yeah. That's a good
question.
Randomness,
I think,
has to rank number one.
Because if you have a 30 character password
and it's your,
home address with your wife's name
and, your son's birthday at the end of
it. It's maybe thirty, forty characters,
but
it,
it can be easily once people find that
one password, if it's not if you don't
change the password
for
really every account,
you you're vulnerable.
And we know from
statistics,
I looked up some things before
we got on the on the call
here. 68%
of Americans,
reuse their passwords,
and that is according to security.org.
So randomness
and
differentiation,
has to rank number one.
So when you say reuse, do you mean
maybe use the same password literally with no
changes, or are we talking about
I I use the same password, but I
change the date?
I change four numbers or
something like that and think I'm doing unique.
Well, when when I say reuse passwords,
they're reusing
the same password for multiple accounts,
but they're also using
variations
of passwords,
variations of the same password
for multiple accounts. So
I've got my address
and, my wife's name,
and, I'll put her birthday on the end.
And maybe I'll change it, and I'll put
my birthday on the end. So a lot
of people
do variations on a theme by that,
like that, I mean. And and the reason
for that is if you look at how
people
remember passwords or how they store those passwords,
38
to 40% of people,
just keep them in memory, believe it or
not.
And
we're seeing an increasing
trend
toward people using
password vaults.
30 I think about 33%
store their passwords
in a in a password manager or in
a
browser.
Obviously, some browsers,
keep those passwords. I don't trust those.
20 to 25%
keep them on what I call snippies.
My wife is a snippy gal.
She has little, snippies of paper
all over the place.
Yep. And, you know, those post it notes
and those little notebooks where you keep write
things down. The problem with that is,
the house burns down. You lose your passwords.
You mentioned that an increasing number of people
are using password vaults. Why do you think
that is?
Well, I think people are catching on. Look.
Cybersecurity,
has become
so increasingly important just over the last twelve
to eighteen months relative to how we thought
about it, eighteen to twenty four months ago.
Do you know anyone
who hasn't been hacked?
That's a good that's a question from not
hype hypothetical, but a real question for both
of you.
Do you know anyone who hasn't been hacked?
Yeah. I do.
Okay. That's good. Well, they're lucky
because most people are getting hacked,
all across the board.
And the hackers are coming at, you know,
they used to go at big corporations
where
the
ransomware
was, and continues to be millions of dollars.
Now they're targeting
increasingly small business
and individuals as well.
You know, one thing I've,
I have, thought about
wanted to get your take on it. I
I think a lot of people, maybe some
people, are using password vaults just because the
sheer number of credentials that we have to
have.
I wonder how many people are just like,
well, there's too many, so I'll just put
them in a vault. Rather than I wanna
be super secure, I wonder if it's just,
you know, I've got hundreds of passwords. I
have to put them someplace, so I might
as well put them in a vault. I
don't know. What do you think?
Well, I that's a good question.
I I looked at my passwords. I've been
using password vaults for,
five eight, maybe ten years, and, I probably
have close to a thousand passwords for all
my different accounts.
But I think that the,
you know, the the the tendency
to
people who are using password vaults
understand the risk, and they understand
going back to our topic a few minutes
ago
requiring
randomness
for multiple passwords and multiple accounts and differentiation,
even though
most people try to keep those passwords in
their heads,
you get to a point where
I think, Tom, your point is well taken.
There's a break point there,
and it's like, I I can't remember this
stuff, and I can't carry my snippies around
wherever I go. And so, therefore,
I'm going to use a password vault.
But
the,
challenge is that most people
start look. We all did.
When we started with passwords,
I had my favorite password.
I think we all did.
And my favorite password was
not very complex. It was it was a
six letter word with with two numbers on
the end.
And
at one point,
somebody
I discovered that one of my accounts was
they were trying to hack my account with
a with an old password,
and and that's when the
moment came to me that I realized,
I gotta get serious about this.
I, I thought for a second there you
were gonna tell us what that password was,
and that was gonna feel kinda weird.
It was on the tip of my tongue,
but I withheld it.
Nice. I I I probably still have some
accounts
floating out there from years ago with that,
with that one password. So now it's going
to mean it's going to be secret.
Good. Good.
So
yeah. So these
so when people change over
to a password manager,
is there evidence that they use
randomization
more,
or
do they just keep using what they're using?
Boy, that's a good question, and I don't
know the stats on that. But I I
would say that's an open question because
my guess is that
people approach
password faults
with the same kind of habitual
tendencies that they do,
when they have their snippies,
which is I got my 10 passwords, and
now I'm gonna do variations on a
theme. And that that turns out to be,
a lot of how people vary their password.
They have their favorite password, and then they
they do
some minor variations. And so
my guess is that goes into the vault.
You know, that brings up an interesting question
because
I've looked into this.
Some password
manager vaults
provide
randomization
password generation for free.
But
what we're also seeing now is here's you
know, I need a password. Here's a a
way to monetize
password generation.
I use one password. They wanted to charge
me a subscription to do a password generator,
to to use their password generator. Wow. And
I emailed I emailed them, and I said,
are you guys crate you're crazy.
And and the guy said, well, why? And
I said, well, if you have people who
don't wanna pay for your password manager or
password generator,
you're sending them outside your ecosystem.
Why would you do that?
You know? So these companies aren't thinking it
through,
but,
there are random,
great random generator passwords
out there password generators out there.
And, I think that's,
you know, it's it's part of changing your
your bad habits
into good habits.
Just to figure out what software you need
to do that.
So what are your thoughts about because some
some websites, you you sign up for your
account, and they will suggest a password to
you that is sufficiently complex that meets their
requirements.
What do you think about that?
That's also that's very interesting question. I don't
trust anything
that has been generated on the Internet,
even if it's a secure count account.
I
use a password generator.
Let's see. I'll look it up here.
I use,
something called PasswordTech.
PasswordTech is an open source
password generator, and it's a download you can
download it for free off the source forge,
and you can customize it. So my preference
and my advice
is
you don't wanna generate a password over the
Internet
because you just don't know who's listening or
watching,
and that's an easy way to compromise it.
Agreed. So so if you have a password
generator that's,
on your phone
or on your computer,
I think, you know, you're significantly
reducing the probability unless somebody's monitoring,
everything that you do on your computer.
You're significantly
reducing that probability that somebody else is gonna
get it. So what I do is I
I use
that password generator
to generate
passwords,
and, then I put them into my vault.
I I load them in manually.
So what do you make of the,
their the conversation going on that, passwords are
passe and
the real thing now is pass keys? What's
what's your thought on all this?
Boy, I I really subscribe to that
because,
passkeys
are,
technically superior
to passwords.
They're superior well, the way passkey works is
your device
creates a unique
private public key pair
specifically for each website.
The private key, just like any kind of
encryption
system,
never leaves your device,
and the public key gets stored
by the website. So when you log in,
the site issues a challenge that only your
private key can solve
without transmitting
your actual credentials.
So the benefit of that is that it
it I would say it almost eliminates
password theft because your private key never leaves
your device.
It removes the human error because,
you're not reliant on weak passwords anymore,
and it's simplifying the authentication
process. Now the the challenge with this is
that it's fairly new technology, and not all
websites
have adopted it, but we're starting to see
more and more. But I'm a you know,
when you if you don't any know anything
about pass keys, it's like, what's a pass
key? How do I use this? I'm
As a matter of fact, it that's being
implemented by different websites in different ways. Some
websites use the pass key as a two
factor authentication.
Others use it as the primary password.
I that's kind of weird to me.
Like, it seems like it should be the
primary
password,
and you add two f a if you
want to.
Right. But not but it shouldn't be the
two f a.
Right.
Yeah. Yeah. If you're gonna bring hardware into
it, it should be a pretty,
pretty specified purpose. It should be very,
intuitive.
You know, I just tried
to use pass keys. I just started using
pass keys probably within the last twelve months
or so.
And
you see passkeys, what's a passkey, and then
so you do a little bit bit of
research about it, and then you find out,
oh, well, this is how it works. And,
again, these password vaults, most of them,
use passkeys and adapt
to having that passkey technology built right into
their vault so that that it makes it
really, really simple.
In addition,
some password
managers
again,
I use one password.
They're it's not the best necessarily. There are
a lot of them out there.
One password has multifactor
authentication
built into it, which I really like as
well. So instead of if I'm using
two factor authentication
to log in to a site instead of
having to pick up my phone and
put in the password and go to the
the generator or the, you know, protecting software
that gives me the
certification of the the number,
I can just flip over on my computer
to one password and then copy the,
code and then paste it in. So that's
that's really convenient as well. Do you think
it's as secure, though?
I know there's a big argument about this.
Some people say that is not as secure.
I'm thinking about that question,
and I I don't know the answer to
it.
I don't
I mean, offhand,
I don't know that the,
the the cogeneration
algorithms
in a in a password vault would be
any different than the cogeneration
algorithms
for for Google or or Microsoft. So I
would think they'd be comparable unless you can
convince me why there's a security problem there.
I think the gap people talk about is
if I break into your password manager
I now I now have your two FA.
Well, that
yes.
Absolutely.
Yeah. Absolutely. So, you wanna make sure that
that one
password that you use to get into your
vault,
is not kept anywhere where anybody else can
get, and you probably wanna change that
regularly.
And as a matter of fact, that same
criticism applies to passkeys.
We just don't think about it. If I'm
storing my passkeys in a vault,
if somebody breaks into my vault,
they have my private keys.
That's true. Yeah.
So there there is no
a %
safe guarantee for anything anymore.
You know, my dad I grew up,
in a suburb of Chicago.
My father was a, a German immigrant,
and
he raised mink.
That was his business, and
he had a safe in the basement.
That was his that was his thing, and
we've evolved
significantly from that.
Well, I don't know if we've evolved. We've
changed.
Yeah. I I would agree.
What about what about,
what about pass phrases? I I always like
it when a system allows me to use
a pass phrase, but there are many that,
just don't wanna deal with that. The length
is limited severely.
I don't know. What are your what are
your thoughts on? Describe the difference before we
go there because
to a lot of people, a passphrase is
just a long pass password.
Well, yeah, you can,
that that I have
I have morphed, to answer your question, Tom.
I I used to have my password generator
generate these,
32
character, 36
character,
texts,
symbols,
numbers.
And and that gets fairly complicated
when you are sitting in front of your
television,
and the
app you wanna get in
to through
Roku,
Roku, or Xbox is saying put in your
password
because we, you know, we just did a
system update or whatever.
And you're sitting there on your phone, and
you're trying for the tenth time
to put in those 36
that 36 character string,
that's why I
moved away from that to phrases.
And,
that's another nice thing
about the password generator that,
I,
recommended or I am using called password tech.
You can configure it however you want. So
you can I've configured mine for phrases of
just different words
with,
a a spacer in between, and then you
can add your special characters and you can
add
your numbers or whatever you want.
It just makes it a little bit easier
to,
to put it in,
in that kind of situation. Now I couldn't
tell you the
statistics
of
we all know that the bad guys now
are incredibly
sophisticated.
They are using
software,
obviously,
and
social engineering
and
AI
to try and figure you out. So
what an example of that, you're constantly
posting,
about your dog, Fido, on Facebook
and your wife,
Lisa,
and her birthday was yesterday.
So now the bad guys have a lot
of significant information,
about you to start to use software
to kinda guess
your favorite
combination. Now over on my screen here, I'm
gonna
I have I put something up just,
to talk about when this came up. Password
components,
how people come up with,
words to use in a password.
What is
this is a bit of a trick question.
What is the number one,
category of word or words that people use
in passwords,
password generation
coming in at 42%.
This is like technical jeopardy.
And if you don't wanna guess, that's okay.
Surprise me. Curse words.
Yeah.
42%
use curse words. But let me go down
the list.
21%
use a birth year.
18%
use a pet's name.
18%
use age,
first name, child name, acronyms, dictionary words. Gets
a little more random as you go down
the list.
But back to my social engineering point,
if somebody is
you know, they they're monitoring everything now. They're
monitoring Facebook. They're monitoring x. They're monitoring,
any kind of,
digital footprint you might have. And they take
all that information,
and,
they're using
large servers and large computers.
Who are they? Well, we know it's the
Russians. It's the North Koreans. It's the Chinese.
It's the Iranians.
It's, you know, our favorite people on the
planet.
And not that those people
as a category are bad people, but those
nation states are certainly not, you know, friendly
towards us.
And so they're using all of this social
information
to try and figure out what our passwords
are. So,
you know, thus the random generation,
more secure, passkeys, more secure, the more you
can mix it up. But you have to
change it. You have to keep changing.
You can't keep things static.
I think it's interesting that you talk about
changing passwords
because that's not a habit I have. It's
changing my passwords on a regular basis.
Right. Because I figure I'm using a password
vault.
I use random long pass phrases
for most everything,
and every account has a different password.
I never reuse them. So what's the value
of changing
if
that's the position?
Like, what am I gaining,
by doing that?
You're gaining security. You're gaining you're increasing randomness,
and you're gaining security through that.
We all have
this
predilection
to default back to our one favorite password.
And so
we have to fight
hard to break that habit, and
we, I think, get lulled into
different levels of
false senses of security,
by thinking that
I got it in a password vault.
My
my my 10 favorite passwords are there, and
I don't have to worry about it anymore.
So you just you just have to keep
thinking about it and keep randomizing it.
I
had,
I have another company that I'm a a
partner in, and I do,
the technology
and and security
for that company.
And when I realized
that
my three other partners and the three other
gals in our company
were all using
their same
password
for everything,
and this was, you know, within the last
year,
I tried to
I I hired a company out of Michigan
that does
cybersecurity
training for small business, And I thought this
this might be a good way
to approach this rather than me
telling them what to do.
Here here's this program, and the program was
pretty simple. The program was
you have to watch a three to five
to seven minute video
once a month,
so not too
drastic.
And the videos were about the topics we're
talking about.
It's about
password strength, it's about
password security,
phishing what does a phishing attack look like,
etcetera, etcetera.
And
what
happened was after a couple of months,
not only did I get
resistance,
people got very angry at me.
And because I I couldn't get them to
watch the video, so I'd say on our
team call, did you watch video? No.
I'd send an email reminder because I could
go into the
monitoring system and see who was watching, who
wasn't watching.
I'd send an email. I'd send them a
text. You know, I kinda mix it up
a little bit, try and keep the pressure
on in a friendly way.
And, people just got really angry at me,
and I I was very
surprised by that. I mean, I there was
so much resistance
that I had to kill the program. It
wasn't worth it.
We were wasting money.
And,
as I thought about that,
I thought, you know, why
woah. Why? Why why wouldn't you wanna learn
how to protect yourself? Why wouldn't you
wanna take these proactive steps to keep your
money safe and your everything, your email safe
and whatever?
And what I realized
from that is that
there are
layers of
humanity
that we overlay on top of this simple
thing called a password.
So I can't
Tom, if you're
if you have bad
behavior, I can't just
call you and say, Tom, you really should
use a password vault.
That's gonna fall that's gonna be like water
off of a duck. And so but why
is that? Well,
when we all started
as cavemen and women or cave whatever,
back in the days when we had one
password,
what do you do? You type that same
password in
how many times a day, 10 times a
day, 20 times a day,
and you repeat that over the week, and
you repeat that over the months, and you
repeat that over the years.
And what happens is
you build
not only
psychology
of I
just this is how I use passwords
but it becomes
physiological
and
what I mean by that is you're it's
the muscle memory. You're repeating this pattern over
and over and over and over again.
And
your mind decides that you just I you
know, you just automatically
default to using the same password. That's the
psychology of it because it's easy.
And you type it in a hundred times
a day. That's the physiology, and it creates
a pattern
of behavior
of behavior, and that becomes the habit.
And the problem is that over time,
this process
gets wired into our neuropathways,
making this behavior
automatic.
And
neuroscientists
refer to this as neuroplasticity.
And so,
you know, when I thought about this and
I started
thinking about it, researching it, you know, why
is there so much resistance?
It's because of this
layered human behavior, the psychology, the physiology,
the habitual
habits that we have.
Very hard. You have to break those first
before you can form new ones.
So that was an interesting lesson learned,
from that. Do you think there also might
be something to it where people say,
no. I actually do a really good job
of picking passwords.
Like, you know, there's, like, a a defensiveness
to it.
Oh, of course. Absolutely.
And I I think that,
we trick ourselves, we fool ourselves there
by thinking that we can,
pick our own random passwords.
Because
what do we do
subconsciously?
We default to
curse words, birth years, pet names, ages, and
etcetera.
And so you can't trust yourself
to,
be as random as a random generator.
Don't trust yourself.
Okay.
That's that's our lesson for today. Don't trust
yourself.
And I think that's a good lesson, actually.
So is there anything else you wanted to
hit before we wrap this up, Carl? Is
there, like, more to the psychology of passwords,
or have we kinda hit what you wanted
to talk about? Yeah. I I think I
think we really hit it.
I I there's another interesting set of statistics
I'll give you before we wrap this, which
is that,
of this survey that was,
done that I referred to by security.org,
they found that at least thirty eight percent
of the survey participants
had at least one password hacked.
And so they looked at the subset of
people who had hacked passwords
to find out if they had changed
their behavior,
and their behavior
was
worse.
I mean, I guess,
after getting hacked, they still didn't change their
behaviors.
Eighty nine percent
still use the same password
or a slight variation thereof.
Seventy four percent shared passwords.
Sixty one percent had
characters less than their, passwords with less than,
eight characters.
So I I guess the moral of the
story is
we
this is sort of like to a degree,
I think it's like
Alcoholics Anonymous
or any kind of addiction.
You have to realize you have a problem
before you can start to address the problem.
And so that is,
I know, Russ, you saw my blog on,
that I posted.
So I would just finish
in saying that,
I've decided
as a result of this experience with my
business partners and business associates.
I've decided to write,
a book about personal cybersecurity,
and
it's gonna be, I think, a little bit
different in two ways. One, I'm gonna start
by talking about the human
sociology,
physiology,
psychology of it
to kinda set the stage. But then
at part two,
I'm going to try and give people who
are nontechnical
just a step chapter by chapter, step by
step.
And the point is,
don't read this book like War and Peace,
if anybody actually reads War and Peace anymore.
But just take it a step at a
time. Take a chapter. Do a couple things.
Everything you do
is gonna take you in the right direction.
And
a month,
six months, a year from
starting,
you're gonna be much further off. So I'll
just plug my book is my pen name
is
Adventures of a Sage,
which is
a kind of a tongue in cheek
brand about discovery.
And,
the blog is on adventuresofasage.us,
and I'm posting
three cybersecurity
tips
every week right now. So if you're interested
in learning more,
please take a look and, you know, you
can sign up for
more news along the way. I do appreciate
the opportunity
to, speak with both of you, and, thanks
very much. Yeah. Yeah. Thanks for joining us,
Carl. It's been great. My pleasure.
So any any place anything else you wanna
throw out? Any other social media or anything
that you're listening to?
Well, I have, I do I do posts
on,
Facebook. It's, n x.
It's,
Sage Adventures
with the number one on Facebook and x,
and I'm on LinkedIn as Carl Buell, and
you can follow me there as well. Alright.
Excellent.
Russ, where can people find you?
LinkedIn
x
routing geek
and here at the hedge.
Alright.
Well, my name is Tom Ammon. I'm,
on LinkedIn as well. And you can find
me there and you can, of course, find
Russ wherever you find him. He's everywhere. And
thanks for joining us for the hedge. Thank
you, especially Carl, for joining us. And we
know your time is is important and your
attention is important, and we appreciate you sharing
some of that with us today.