PayPal E-mail authentication

PayPal is one of the 2-3 most phished brands out there. That means they are targeted more often by phishing attacks than anyone else. If you use PayPal, then you need to be aware of the security capabilities they use to protect your account information. NetworkWorld had a recent interview discussing their security methods.

1. Two-factor authentication - PayPal will issue you a token to more securely authenticate to your account. It costs $5 and you'll have to carry it around. I definitely adds more security to your account, but you have to carry the thing around. Did I mention you have to carry it around? I think using a strong password will provide enough security.
   
   
2. Signed e-mail - PayPal also used a technology called DKIM (domain keys internet mail) to add a digital signature to any emails they send to you. Many of the major email client (yahoo and gmail for sure) will tell you the message is signed. This verifies that the message is actually from PayPal and not from an attacker. Below you can see what the signature looks like in Gmail. The "signed-by" and "mailed-by" fields show that paypal.com has sent the message.
   

As usual, an ounce of awareness is worth a couple of pounds of protection. Your own knowledge is far and away your best defense.

Protecting the Keys to Your Kingdom

Passwords are the path of least resistance. Almost everything you do online is protected by a password. Your bank accounts. Your credit cards. Your online merchants. Of course, you could use different, very strong passwords (15-20 random characters) on each site, but who has time for that?

Odds are you are like everyone else out there and use the same 2 or 3 passwords for all of your sites and you write them down on a piece of paper that you store in your wallet or at your desk. Don't feel bad, you aren't alone.

But it's still not a good idea. Brian Krebs goes over a few password storage tips and tools in this post. Send him a note and thank him. He's provides some great advice.

I use Mac OS X for 95% of my computing tasks. So I bought the leading password manager for Mac users - 1Password. It works great. I let it generate very strong passwords for my sensitive sites. They are stored in it's secure vault and I let the tool fill in the forms on the web sites. It does cost money, but for me it's worth it.

If you are looking for some free stuff, then Brian's post points to a couple of open source tools. I can't vouch for them because I've never used them. But figuring out a way to increase the strength of your passwords should be a priority.

Photo credit: Secure password of the week by Simon Lieschke