CATEGORY: Security

How to set up Two-Step Verification on your Name.com account

With the abundance of news about compromised cyber security and hacking schemes, it’s natural to want to take extra precautions to keep your online information safe.

Two-Step Verification keeps your account extra secure by requiring a time-sensitive code in addition to a traditional login. As opposed to solely relying on a username and password, which can be guessed or figured out by an experienced crook, Two-Step Verification adds an extra layer of security.

Better yet, getting Two-Step Verification set up for your Name.com account is a simple task that can be done in a matter of minutes. Let’s walk through the steps.

Announcing some important updates to our Two-Step Verification feature

We recommend Two-Step Verification to everyone, as it’s the most fool-proof way of keeping the domains in your Name.com account secure – and it’s totally free. It’s especially important for people who have hundreds or even thousands of domains in their accounts, as they’re more likely to be targeted by bad dudes trying to hijack domains.

The basics of our Two-Step Verification process are still the same—create a unique credential for your account, and then use a smartphone app to generate unique login codes—and it remains a totally free feature for all Name.com customers. However, if you were previously using Namesafe we’ve made some changes that will require you to update your verification credentials by March 5, 2015 to keep your account secure.

Keep your mitts up: How to protect against unauthorized domain transfers

This post is meant to give you recommendations on how to prevent a potential domain hijack before it happens, because once a domain transfers to another registrar it can be difficult to re-acquire, especially if the transfer was in compliance with ICANN policy. If the registrar is not willing to transfer the domain back into your control then your options for recovery become very limited.

Google is making SSL Certificates a bigger priority in search rankings

google-ssl-header

Google has just published an interesting blog post about SEO best practices on its Webmaster Central Blog, and one interesting detail is that Google is going to start ranking sites with SSL Certificates higher. Google is making this move because it believes in making the internet a more secure place, and a more secure web starts with more secure website connections.

What is two-factor authentication?

namesafe

Two-factor authentication is a service that keeps your account extra secure by requiring both a standard memorized username and password, as well as an additional time-sensitive code to enter your account. Because usernames and passwords could theoretically be guessed, adding two-factor authentication to the mix adds an unmatched level of security to your accounts. To retrieve your security code or token from your account, you use an app that will display a set of numbers for a brief period of time.

At name.com, our free two-factor authentication, NameSafe, uses Versign VIP Access to issue a temporary account security code. The security code changes every 30 seconds and can only be retrieved from one device.

Here’s a tutorial on how to get started with NameSafe. Again, it’s a totally free service, and it makes it practically impossible for someone to access your Name.com account unless they have access to your mobile device.

How to protect your Name.com account with an extra password

Passwords can be pretty tricky to guess as long as you’re not lazy when creating them. By keeping a few best practices in mind, you can create a password that will be extremely tough to crack.

But it’s a big bad internet world, and there’s still a chance your username and password combo could be compromised. That’s why we provide a 100 percent absolutely free way to add an extra layer of protection to your account. It’s called Two-Step Verification.

Don’t Get Hacked: Password Lessons from the Flame Broiler

It lasted for over an hour and was so ugly that even their competitors were sending out empathetic Tweets.

mcdonalds empathy burger king

Burger King’s Twitter account had been hacked, and not only were the hackers sending their own racially-charged tweets about Burger King employees “crushing and sniffing Percocet in the bathroom,” but they also changed all the branding from BK to McDonalds. They even went so far as to promote McDonald’s new Fish McBites.

burger king twitter hacked

So with this kind of nightmare playing out in real life in front of the whole world, we thought it was time to contribute a quick, legitimate  piece to the “how to come up with a great password that’s memorable and fun and makes you feel safe” articles that will be swirling around the ‘net. From our staff we compiled dozens of tips all shrunk down to this one convenient list of tips and tricks for a better, safer, more memorable password.

Caroline Temple, our Affiliate Marketing Manager, knocked out 8 quick pointers for better Internet security:

1. Well – duh – we’ve got the free 2-step verification.

2. Don’t use words like “H3LL0!”  The programs designed to crack passwords have included subbing numbers for vowels now.

3. Consider the “pass phrase”.  Like “IReallyLikeCoffeFirstThingInTheMorning10:00am”

4. Change your password often.

5.. Don’t use the same password for more than one account.

6. WRITE  your passwords down somewhere safe.  Try your darndest to not store them within a document that can get hacked.

7. Review all those apps that you have given access to your Twitter account – maybe it’s time to revoke access of apps that don’t use SSL certificates or that you have not used in a while.

8. Always make sure the URL bar up top reads “https” before logging in to any account.  that means they have an SSL certificate installed that will encrypt your information when logging in.

Some of these steps can be completely alleviated with great tools like oplop (courtesy of Pat “P-Mo” Moroney) that let you simplify all your passwords to a nickname and one master password. And Fitz in support reminded us to plug one of our customers, Last Pass, a secure password manager that promises to make your life much easier.

Finally, it should be noted, that your password should NOT be any word or phrase associated with your personal information or business products. Those are very easy to hack. Like I should not use “Jared1” and you definitely should NOT use “whopper123”  as Burger King, the Home of the Whopper, used up until recently.

We’ll leave you with this helpful password hint from one of our favorite web comics, XKCD

cartoon password strength tips tricks

WordPress, Joomla and Drupal: How to Protect your Websites!

Chris Gaston, our systems administrator, says, “Hey all, FYI theres a lot of hacks for WP, Joomla, and Drupal floating
around lately.”

It’s time to update those themes! Here’s more from the National Cyber Awareness System.
US-CERT Current Activity
Increased Exploitation in Web Content Management Systems

Original release date: September 21, 2012
Last revised: January 4, 2013

US-CERT is aware of recent increases in the exploitation of known
vulnerabilities in web content management systems (CMSs) such as
Wordpress and Joomla. Compromised CMS installations can be used to host
malicious content.

US-CERT recommends that users and administrators ensure that their CMS
installations are patched or upgraded to remove known vulnerabilities.
This may require contacting the hosting provider. Also, users and
administrators can check for known vulnerabilities in the National
Vulnerability Database by searching their CMS by name.

UPDATE: This is an update to emphasize post-exploitation clean-up.

Basic post-exploitation clean-up can be summarized by this: “Clean,
Patch, and Monitor.”

Clean – Remove the malicious content AND validate all accounts, removing
unauthorized accounts and paying particular attention to accounts with
administrative or elevated privileges.

Patch – Keep systems patched and upgrade system software to the most
current supported releases (predominantly Joomla in this ongoing
campaign of exploitations).

Monitor – Stay abreast of new patches and version releases of your
content management software, and patch when new versions are released.
Also perform continuous baseline review of your site’s usage to detect
abuse before your site is used to attack others.

A number of support sites and other open source forums have had recent
discussions involving the exploitation of Joomla installs up to versions
2.5.2 and earlier. Additional vulnerabilities have been identified and
patched relating to versions 2.5.4 and earlier. In many instances Joomla
installs have been found to be very out of date. The attacker would
self-register an account and then proceed to escalate the account to
have administrative privilege using vulnerabilities in the outdated
software. Once privileges have been escalated, the attacker is able to
modify the website to include the upload of malicious content. The
uploaded content may be malware to infect your website visitors, or
tools to enable the attacker to leverage your website to launch denial-
of-service attacks against others.

If your site has been compromised, remember to “Clean, Patch, and
Monitor.”

Relevant URL(s):
<http://web.nvd.nist.gov/view/vuln/search>