Questions :

  1. How secure & protected is our data?
  2. Our provider is one of the most popularly attacked companies, how can we be sure our data will not get into the wrong hands?

These are all good questions.

Let us firstly consider that the data is accessible only through your login, which creates an ‘https’ tunnel directly into your data’s place on the area’s account. This (‘https’) protocol is theoretically possible to crack, but in a practical sense nearly impossible to crack. Without incredible (country/state level) resources, this will take many many person(s) lifetimes to achieve. Most attackers know this and consider breaking http’s SSL layer as impractical, opting for easier means.

Now, about the ‘where’ of your data. Here’s some information to consider about YOUR data.

Simple access to our email / drive systems is, from a security standpoint, kinda like whistling in the wind (“aint it grand the wind stopped blowing”). I did some looking into google. While our data is not being accessed, it is considered as being in an ‘in rest’ state – that data is encrypted @ 128 bit AES encryption. When our data is being accessed and worked with, it is considered as ‘active’ and is encrypted at 256 bit AES encryption.

So, what does that AES encryption information mean?
I did a quick look on the web and asked the question, ‘How long to crack 128bit AES encryption?’ The answer was quite illuminating. With a brute force attack utilizing a supercomputer, it would take 1 billion billion years to crack the 128-bit AES key. Wouldn’t we all like to get a coin with that number on it.

For 256bit AES, this is what I was able to find…

There are 984,665,640,564,039,457,584,007,913,129,639,936 (that’s 78 digits) possible combinations. No Super Computer on the face of this earth can crack that in any reasonable timeframe. Even if you use the fastest supercomputer in the world, it will take millions of years to crack 256-bit AES encryption.

So, I hope this gives you some assurance to how secure & protected YOUR data really is. Additionally, let us also consider this.

Most security experts will tell you there is no such thing as completely 100% secure with these services, only what we do to ensure safety & security. So, all this encryption is worthless if we do not utilize some data security policies (on our own side) like, strong passwords & multi-factor authentication.

What are these and what can I do?

Firstly, strong passwords. This means using at least 12 (or more) characters long and contains at least lower case (like ‘asdf’), upper case (like ‘ASDF’), numbers (like ‘1234’) and symbols (like ‘!@#$’). Long passwords with different characters make it harder for password breaking tools to get in … its make the number of different combinations grow exponentially. A good site to generate a strong password (or any size you decide) can be found here.

Secondly, utilize 2-Step (or multi-factor) authentication.
What does this mean? A factor is a method. Strong passwords are a method. So, what we are saying is using strong passwords and some other factor for authenticating. Most major web tech companies (especially Google) either support a specific multi-factor authentication system or make one themselves (ie .. Google Authenticator).

What does this do?
When you login and enter your password, it essentially says ‘Yes, they appear to be who they say they are – but lets just be certain’. At this point, the 2nd Step Authenticator asks you for a ‘double checking’ code, which if you are the actual person who should be able to access the data, you should be able to provide. Once this check passes – then you can access the data. However, if this check fails for any reason, then you CANNOT get in. This means that without you & your authentication access, your data is un-reachable (ie secure).

What does this mean for people wanting to get to (aka steal) my data?
It means that they need to employ what is called, ‘social engineering attacks‘. It means that they need to do some extra digging around social media and other sites to find out information about you so that they can start to try to ‘guess’ what they password might be. It means that the more information they can find, the more data points they can utilize to engineer a method to trick you to give them the data they want. Meaning that they send you an innocuous email (on a subject they can see you are passionate about) with a link that when you click it starts doing nasty things to your system. Or, try to tap into your phone (via a txt message with a link attached) and get the info that way. Social engineering attacks are the most common way data is breached, so using the methods mentioned above provides an effective combat to this, but people are people and breaches CAN occur.

So, what do I do if I suspect the data is compromised (breached)?

  • Firstly, reset your password to another strong password
  • Second, remove your multi-factor authentication system tied to your account and then re-add them (this re-sets the key stored in the application).
  • Third, notify your webmaster (at webmaster@area72aa.org)

What can I do to combat this in the future?

Changing (routinely / regularly) passwords, and making sure they are not easy to hack, is the best way to combat this. If there is ever a case where the multi-factor authenticator is hacked, it is their responsibility (actually its required) to let you know, that comes in the terms of service you agree to when you add their application. Furthermore, when they DO notify you, there should be steps to fix the problem included – please follow them exactly – then you should be OK again.