Friday, March 13, 2015

ApplePay, Google Wallet, and PayPal what it means for you

Many of you reading this post probably have also heard of KrebsOnSecurity. If you haven't already done so I recommend you read his article regarding ApplePay: http://krebsonsecurity.com/2015/03/apple-pay-bridging-online-and-big-box-fraud/

The article explains at a high level how credit card fraud works and then goes on to explain how ApplePay fits into the whole picture. Mr. Krebs has many valid points regarding ApplePay, and I agree that I won't be using ApplePay or Google Wallet any time soon to buy things at stores. But I want to point out that many of these "hacks" can actually be prevented by the end user, here's how.

Apple Pay, Google Wallet, and PayPal all rely on the security of you appropriate iTunes, Google, or PayPal Accounts, meaning that the only way a hacker could steal your credit card information is if they were to gain access to your account as well. If you are security conscience then you probably already have two factor authentication on your Google account and probably have a strong password on the rest of your accounts. Having a strong password is the single most important step in securing your online identity. Even if you password was easy to remember and therefore easy to brute force or guess, but it is a long password (talking 20+characters here) then you will be reasonably safe. The reason for that is that hackers will almost always go for the low hanging fruit. They don't want to spend hours, days, months, years trying to hack passwords, they would never make any money doing that. They are going to hack the people whose accounts are easy to hack into first. Keep in mind that this doesn't always mean they just guess your password. You should also have strong security questions for password recovery, this is less important than having a strong password, however.

You can further protect your online identity and credit by knowing what credit cards you use online and knowing their fraud policies. As standard practice for me, I never store my credit card information on the site when I buy something, I don't know how good their security practices are and if someone were to hack into my account then there would be nothing for them to find/steal. Kind of hard to steal something that isn't there. If I have the option to use PayPal, or Google Wallet (I do not currently use Apple Pay at all) then I take that option. This limits the number of times that I enter my credit card information online, also reducing the possibility that it could be stolen. I trust PayPal and Google with my information but they have shown they can be trusted. Lastly, I NEVER use a debit card or do a direct bank account transaction online, even if there is a fee for using my credit card. The reason for this is that if someone were to get my bank account information or a debit card information, it is very difficult to dispute those charges, sometimes even impossible. All of my credits cards are very generous with their dispute times and all I have to do when I notice a fraudulent charge is give them a call and its taken care of. Most of the time when it is actually fraud they call me.

In summary, passwords are the first step in securing your credit cards, no matter your method of payment. XKCD posted a great little "comic" depicting how you can remember complex passwords easily. (http://www.explainxkcd.com/wiki/index.php/936:_Password_Strength). Or you can use a application to remember your passwords for you, such as LastPass (https://lastpass.com/). Limiting your credit card exposure to the internet is the next biggest step. Limit the number of websites that you allow to store your information and for god sake NEVER EVER EVER put debit cards or bank account information in ANY website unless it is your bank. If you are super freaked out and/or you don't have a credit card, then go to the store and buy a gift card (either merchant specific or just a generic visa gift card) and use that online. They are prepaid so even if they get stolen you are only out a little bit of money. Ideally you would only load enough on it to make one purchase, use it, then leave it empty until next time.  The Internet is the wild west, but with little effort even you can stay safe out there.