Staying Safe Online

Home computing

Large companies employ IT professionals to ensure their computer systems are kept clean and secure. Home users do not have the luxury of the same assistance easily. Therefore here are some basic tips to help stay safe and secure at home, especially when purchasing online. The following slants towards Windows users in a couple of places. Apologies to Mac and Linux users.

Home computing

Large companies employ IT professionals to ensure their computer systems are kept clean and secure. Home users do not have the luxury of the same assistance easily. Therefore here are some basic tips to help stay safe and secure at home, especially when purchasing online. The following slants towards Windows users in a couple of places. Apologies to Mac and Linux users.

Anti virus software

Many people have antivirus software from one of those listed here. I know some home users who have free versions on their laptops. Once taking their laptop to public places or on holiday, they thought they remained safe. This is not true and can result in bringing an infected laptop home. A free version is a lot safer sat behind a home router. Outside of the home, the antivirus software should be upgraded for use on a public domain, eg, “AVG Internet Security”.

Anti virus software

Many people have antivirus software from one of those listed here. I know some home users who have free versions on their laptops. Once taking their laptop to public places or on holiday, they thought they remained safe. This is not true and can result in bringing an infected laptop home. A free version is a lot safer sat behind a home router. Outside of the home, the antivirus software should be upgraded for use on a public domain, eg, “AVG Internet Security”.

Passwords

Many security hackers know that mothers often use the names of their children. Words can be memorable but do not use those in dictionaries. Generators exist such as at nexcess.net to create memorable, meaningless passwords. While some very powerful computers exist to crack passwords much faster than in the table shown, good websites have counter measures against “brute force” attacks. However, it is good practice if the password length is about 12 characters with at least one capital letter, number and a wild card symbol (eg, !$%&# etc). Add 2-factor authentication if available.

Passwords

Many security hackers know that mothers often use the names of their children. Words can be memorable but do not use those in dictionaries. Generators exist such as at nexcess.net to create memorable, meaningless passwords. While some very powerful computers exist to crack passwords much faster than in the table shown, good websites have counter measures against “brute force” attacks. However, it is good practice if the password length is about 12 characters with at least one capital letter, number and a wild card symbol (eg, !$%&# etc). Add 2-factor authentication if available.

Anti keylogging software

Secure passwords are important as described already but there still exists malicious programs designed to record user key strokes (which can include be people’s passwords for banking and other sites), if a computer becomes infected. However, software also exists to prevent this and complements anti-virus and anti-spy software. I have tried several anti keylogging apps ( incl Zemana, SpyShelter and KeyScramber) but I am best pleased with Ghostpress by Schiffer and many positive reviews.

Anti keylogging software

Secure passwords are important as described already but there still exists malicious programs designed to record user key strokes (which can include be people’s passwords for banking and other sites), if a computer becomes infected. However, software also exists to prevent this and complements anti-virus and anti-spy software. I have tried several anti keylogging apps ( incl Zemana, SpyShelter and KeyScramber) but I am best pleased with Ghostpress by Schiffer and many positive reviews.

http vs https
HTTP is not secure. HTTPS is secure meaning that other parties cannot see,  eavesdrop or tamper with the website content that people are browsing. The address in the top bar may or may not be preceded with https:// or https://. And it may not say “secure”. So keep with #3 and #4 (lock and icons) if you have passwords, banking or payments involved. Functionally there is no difference between #3 and #4, other than the icon, which Google Chrome introduced in Sept 2023.

Surprisingly there are still insecure websites selling merchandise. I would not buy from these sites.

#1 may also appear with the ⚠ icon instead of the ⓘ icon. I have often accessed ⓘ sites carefully for viewing only.
https vs https

HTTP is not secure. HTTPS is secure meaning that other parties cannot see,  eavesdrop or tamper with the website content that people are browsing. The address in the top bar may or may not be preceded with https:// or https://. And it may not say “secure”. So keep with #3 and #4 (lock and icons) if you have passwords, banking or payments involved. Functionally there is no difference between #3 and #4, other than the icon, which Google Chrome introduced in Sept 2023.

Surprisingly there are still insecure websites selling merchandise. I would not buy from these sites.

#1 may also appear with the ⚠ icon instead of the ⓘ icon. I have often accessed ⓘ sites carefully for viewing only.
Website reputation ratings

Also known by other names such as URL scanning. Not all antivirus programs provide alerts to shady websites and those containing disreputable advertisers. However, there exists specialist sources that use very varied means to expose dubious websites. Two such sources providing reputation ratings of other websites are mywot.com and urlvoid.com. Free browser extensions also exist from “McAfee WebAdvisor”, “Malwarebytes Browser Guard” and the “WOT” extension.

Website reputation ratings

Also known by other names such as URL scanning. Not all antivirus programs provide alerts to shady websites and those containing disreputable advertisers. However, there exists specialist sources that use very varied means to expose dubious websites. Two such sources providing reputation ratings of other websites are mywot.com and urlvoid.com. Free browser extensions also exist from “McAfee WebAdvisor”, “Malwarebytes Browser Guard” and the “WOT” extension.

Suspicious emails

Despite the measures already mentioned, there are all kinds of viruses or bugs that can come via emails, usually inviting people to link to a dodgy website. These sites can look very authentic and convincing whilst being completely bogus. I get many such emails. When hovering over the alleged sender in any inbox, a small box appears as in the example shown. This often exposes suspicious emails and domains.

Suspicious emails

Despite the measures already mentioned, there are all kinds of viruses or bugs that can come via emails, usually inviting people to link to a dodgy website. These sites can look very authentic and convincing whilst being completely bogus. I get many such emails. When hovering over the alleged sender in any inbox, a small box appears as in the example shown. This often exposes suspicious emails and domains.

Win 7 and Win 10

Much is already written that support for Windows 7 ended in Jan 2020, meaning no more security updates. One lesser known caveat is that new security updates to Win 10 and 11 are well publicized and this information is exploited by rogue hackers to write malware for Win 7 and Win XP computers, many of which are still used in homes and businesses. See www.microsoft.com/en-us/windows/end-of-support.

Win 7 and Win 10

Much is already written that support for Windows 7 ended in Jan 2020, meaning no more security updates. One lesser known caveat is that new security updates to Win 10 and 11 are well publicized and this information is exploited by rogue hackers to write malware for Win 7 and Win XP computers, many of which are still used in homes and businesses. See www.microsoft.com/en-us/windows/end-of-support.

Router security

Most home users have a modem (providing internet connection) and a router (that routes the internet data to devices in the home). The modem and router are often combined into one box. This box also contains software and can be hacked and is a favourite target for rogue hackers nowadays. Normal antivirus software will not help. This is a big subject but, if a router comes from the internet provider, ask them how the software is updated, automatically by them or if the home user has to do it. Some old routers also have default admin passwords making it easy for rogue hackers to gain access and alter the settings.

Router security

Most home users have a modem (providing internet connection) and a router (that routes the internet data to devices in the home). The modem and router are often combined into one box. This box also contains software and can be hacked and is a favourite target for rogue hackers nowadays. Normal antivirus software will not help. This is a big subject but, if a router comes from the internet provider, ask them how the software is updated, automatically by them or if the home user has to do it. Some old routers also have default admin passwords making it easy for rogue hackers to gain access and alter the settings.

Trashing computers

If a computer is trashed responsibly at a household waste tip, don’t assume the hard drive or solid state drive won’t end up in the wrong hands. I know of one person who carefully deleted the hard drive and emptied the recycle bin first. It found its way to Nigeria where people had the means to read the “ghost” data left behind and extracted their bank details.

There exists specialist recycling facilities in most cities who can physically shred drives (see before and after). Some drives also have components deemed toxic. Drilling many holes in disk drives may still miss some tracks.

Trashing computers

If a computer is trashed responsibly at a household waste tip, don’t assume the hard drive or solid state drive won’t end up in the wrong hands. I know of one person who carefully deleted the hard drive and emptied the recycle bin first. It found its way to Nigeria where some people had the means to read the “ghost” data left behind and extracted their bank details.

There exists specialist recycling facilities in most cities who can physically shred drives (see before and after). Some drives also have components deemed toxic. Drilling many holes in disk drives may still miss some tracks.

Shredding digital documents

Many people will likely have personal data on digital documents in their home computer. There are software routes for shredding digital documents in hard disk or solid state drives. This is more secure than ordinary deletion but shredded data can be recovered by a determined expert with advanced forensics, even if the disk was re-formatted. There also exists companies who specialize in recovering shredded or deleted data from drives. Many antivirus programs have options available to (say) shred all data from the PC Recycle Bin such as from McAfee, making recovery more difficult. Or use a free app from fileshredder.org. This is certainly better practice than ordinary deletion until the computer or drive is no longer needed. However, when the drive is of no more use, shredding the physical drive as shown above is “bullet proof”.

Shredding digital documents

Many people will likely have personal data on digital documents in their home computer. There are software routes for shredding digital documents in hard disk or solid state drives. This is more secure than ordinary deletion but shredded data can be recovered by a determined expert with advanced forensics, even if the disk was re-formatted. There also exists companies who specialize in recovering shredded or deleted data from drives. Many antivirus programs have options available to (say) shred all data from the PC Recycle Bin such as from McAfee, making recovery more difficult. Or use a free app from fileshredder.org. This is certainly better practice than ordinary deletion until the computer or drive is no longer needed. However, when the drive is of no more use, shredding the physical drive as shown above is “bullet proof”.

Check data breaches

People can search their email address or phone number on haveibeenpwned.com to check if they were on a database that has been breached by malicious hackers. If so, they can go to those websites and use another email address (say) or just change their email password. Click here for independent review by Malwarebytes.

Check data breaches

People can search their email address or phone number on haveibeenpwned.com to check if they were on a database that has been breached by malicious hackers. If so, they can go to those websites and use another email address (say) or just change their email password. Click here for independent review by Malwarebytes.

Credential stuffing

Oddly this stems from data breaches and is a growing problem where attackers use data acquired from old breaches, mentioned above, to breach more websites. It relies on users who use the same usernames and passwords across multiple services. There are many tools available online to help the attacker do this. So if people use a strong a password and use it on many sites, they may be at risk still. There are 4 remedies –

➢  Avoid or restrict re-use of passwords.
➢  Use multi-factor authentication where possible such as SMS.
➢  Use a password manager.
➢  Regularly check there are no data breaches (as described above).

Credential stuffing

Oddly this stems from data breaches and is a growing problem where attackers use data acquired from old breaches, mentioned above, to breach more websites. It relies on users who use the same usernames and passwords across multiple services. There are many tools available online to help the attacker do this. So if people use a strong a password and use it on many sites, they may be at risk still. There are 4 remedies –

➢  Avoid or restrict re-use of passwords.
➢  Use multi-factor authentication where possible such as SMS.
➢  Use a password manager.
➢  Regularly check there are no data breaches (as described above).

Internet Service Provider (problem)

Also called an ISP. They route all user internet activity through a DNS (Domain Name System) first. Therefore, whilst an ISP cannot see anyone’s activity in detail, they will know what sites people are going to. Some ISPs then sell this information, so that the list buyer can target computer users in some way. However, users can prevent ISPs knowing what websites they visit if they wish. It’s free and easy and described next below.

Internet Service Provider (problem)

Also called an ISP. They route all user internet activity through a DNS (Domain Name System) first. Therefore, whilst an ISP cannot see anyone’s activity in detail, they will know what sites people are going to. Some ISPs then sell this information, so that the list buyer can target computer users in some way. However, users can prevent ISPs knowing what websites they visit if they wish. It’s free and easy and described next below.

Internet Service Provider (solution)

The section immediately above describes how ISPs work. Here we describe a solution to control your selection of DNS so that your ISP can’t see where you go. Its easy to install a utility from Sordum called DNS Jumper which is easy to use and provides control over which DNS people visit. In the picture immediately left, we recommend selecting the Cloudflare DNS. Click here for more information on Cloudflare. It’s useful that DNS changes using this app does not require a computer re-boot. Currently Sordum software is Windows only. Presumably there is something similar for Mac and Linux users.

Internet Service Provider (solution)

The section immediately above describes how ISPs work. Here we describe a solution to control your selection of DNS so that your ISP can’t see where you go. Its easy to install a utility from Sordum called DNS Jumper which is easy to use and provides control over which DNS people visit. In the picture immediately above, we recommend selecting the Cloudflare DNS. Click here for more information on Cloudflare. It’s useful that DNS changes using this app does not require a computer re-boot. Currently Sordum software is Windows only. Presumably there is something similar for Mac and Linux users.

Children safety

Whilst not strictly related to this article on “Buying Online Safely”, Sordum have another free utility called DNS Angel which is specifically to help parents save their children from seeing any of the vast array of uncensored material on the internet that is particular unsuitable for young minds. Cloudflare is featured here again. Again, no re-boot required and for Windows only currently.

Children safety

Whilst not strictly related to this article on “Buying Online Safely”, Sordum have another free utility called DNS Angel which is specifically to help parents save their children from seeing any of the vast array of uncensored material on the internet that is particular unsuitable for young minds. Cloudflare is featured here again. Again, no re-boot required and for Windows only currently.

Leave a Reply

Your email address will not be published. Required fields are marked *

Get in touch

Hey, let’s talk. Questions of any kind about any of our products are very welcome and we will respond as quickly as possible.