From @jjmartucci: I bet 99% of the stolen Zappos passwords were “shoes”. // Fact: most passwords are frighteningly easy to guess. We bet that those passwords aren’t “shoes” at all, but rather “password”, “abc123″ and others from the list of too-often-used passwords. Alphanumeric passwords just aren’t as safe as we think they are.

From @dombenoit: receive @zappos email asking to change password after hack, can’t change password because i’m outside the US… good thinking guys.// Fact: American may be in the center of some poorly conceived maps, but it is not the center of the universe. Corporations, don’t forget that the majority of the world lives outside of the US, and they need customer service too.

From @kimfouroffive: In order to change my Zappos password I would have to remember my Zappos password and that’s not going to happen. // Fact: Tons of consumers rely on the “cookies” on their computer to remember their passwords. There’s no need to delve into all the reasons that’s poor practice. But let’s face it – many users either don’t remember their passwords, or they have them written on a post-it in their desk.

From @Kevbo1111: Wait, you’re telling me a company whose office looks like this, has lax security? #Zappos http://pic.twitter.com/pr9SrfCF // Fact: If we could see inside the workings of all the places that hold our ‘secure data’ we wouldn’t feel so secure.

From @Tuna999: Im confused, is that zappos security email real? // Fact: This is actually a very smart question, that many wouldn’t think to ask (or research before clicking through). A phishing attempt can look much the same, and confuse consumers into handing over their credentials to fraudulent sites.

From @justAK: Had someone try to acces my bank info a few times. Could this be cause of the #zappos #hacking ? I hope not. #worried // Fact: Too many users have the same password for all online accounts. It’s not hard to believe that hackers would use information from one site to try to access others.

From @andishehnouraee: Zappos hacked, “sensitive” customer info stolen. Before I’m outed, I’ll confess here: I’m a size 12. // Fact: sensitive information is a lot more sensitive than shoe size. That said, great sense of humor!

From @Tontiella: Zappos why are your accounts being hacked into?? Who is not doing their job to prevent this?  // Fact: Strong security measures are fabled to be more expensive than responding to data breaches. Time will tell how this affects Zappos in the long term, but let’s just say that resetting passwords doesn’t instill a sense of trust. (And, for the record, strong mutual authentication is well worth the investment)

Some facts that the typical ecommerce consumer should be aware of:

1. Too many users have a single set of login credentials (username and password) for all their online accounts. That means, when someone gets their info from Zappos, they can use it to access Facebook, Amazon, online magazine subscriptions, PayPal, email, gaming sites, online banking, and more.
2. “Fixing” an alphanumeric password breach with new alphanumeric passwords doesn’t actually “fix” anything. If I know the guy trying to break into my house is a locksmith, I don’t just cut a new key – I install security measures that a locksmith isn’t an expert in.
3. Zappos has chosen the path of least resistance – deploying consumers themselves to fix the breach. Zappos users have to follow instructions given in an email (which may have gone into spam folders), change their passwords, and email Zappos with any questions or concerns. Anyone with an email address they don’t regularly check, an overactive spam filter, or the ‘grandma’ syndrome (not computer savvy, and likely suspicious of ‘official’ email communication) may fall through the cracks.
4. Changing the Zappos password doesn’t change all the other similar or identical passwords the consumer uses on other accounts, leaving their customer base open to further attack elsewhere.

One of the key takeaways from this is that ecommerce systems should not be based on ‘security’ systems that rely on users’ unreliable alertness. Users expect the systems that hold their sensitive information to bear the burden of iron-clad security for their data. Strong, two-factor authentication systems aren’t just an option in today’s online environment – they are where the market is heading by default and by necessity. Zappos has shown us exactly how not to handle a data breach. Of course, if more systems used strong mutual authentication, we’d see decidedly fewer breaches like the one this weekend.

When we talk about the authentication space there are really 3 things we have to balance. It boils down to 1. Real security, 2. Perceived security, and 3. Price. What we’d hope is that all players in the space would have strong real security. I mean, that’s the business we’re in, isn’t it? But when it comes down to it, not all login systems are created equally.

And unfortunately perceived security combined with an effective pricing model can equal success, regardless of the level of actual security. What that means is the industry is open to clever fox-types who can swindle their way through a sales presentation based on slick ideas with little real security provision. Yikes. And our consumers are left vulnerable, but worse – with the perception that their information is secure.

And then there’s me. And my colleagues. See, we’re sticklers for real security. We’re those geeky types who aren’t satisfied with merely protecting our clients authentically from current threats while providing perceived security through positive user experience. We’re the crazy guys who are determined to get it right, without cutting corners. We have this crazy notion that we won’t stop improving our technology as long as there are still hackers out there finding ways to compromise consumers. Of course, that means we have a team of geeky types just like us on payroll. And our pricing strategy can’t compete with the fake-it-till-you-make it guys. We believe you get what you pay for, and even though our prices aren’t much higher than the other guys, cost-cutting measures can mean that the contracts go to the cheap solutions, even when those solutions offer cheap quality.

That’s ok though. We’re creating a safety net. When the merchants out there are disappointed with their lack of actual security, when the hackers seem to be winning the battle, we’re here to catch you when you fall. It’s like the commercial for Office Depot when a barber sees a competitor open shop across the street for “$6 haircuts.” Our barber puts up a sign saying “We fix $6 haircuts.” That’s us. We fix $6 haircuts authentication.

A Canon advertisement at the International Consumer Electronics Show (CES) in Las Vegas, Monday, Jan. 4, 2010. (AP Photo/Paul Sakuma)

This year’s Consumer Electronics Show brought us some interesting trends and ideas.   In his review of the show, Lance Ulanoff lists 9 things he’s learned there.  In the last point in that post, he makes the observation that “the marriage of technology and content took center stage”.

There is a fundamental change in how we’ve been turning every possible device into content delivery or presentation mechanism.  You can read your email or a book on you PC, on your phone or on TV.  I can now watch a TV show on cable, on my iPod, iPhone or on Hulu Desktop.  I happened to be in an Eastern European country during their parliamentary election.  The ruling party rigged the election and when the students came out protesting, they were using Twitter and Facebook to organize themselves and broadcast the latest news.  The government promptly shut down Internet access to these websites.  However, I was pleasantly surprised to learn that the Facebook app on my iPhone continued to work.  Multi-channel communication rocks.

As our life becomes more digitized, we are being asked to get used to reading and sending information via a multitude of devices and services.  We’ve been conditioned to open up our private lives and share (some more, some less) our life experience with our online social networks.  Various companies are now hording more and more data about who we are.  I laugh every time a bank asks me to select “What year did you graduate from high school?” as one of my security questions.  Come on, there are at least 1000 people who know the answer to this question.  Besides, about 50% of half of all identity fraud crimes are committed by people who know the victims personally.

As we enable more types of devices to access our private or paid content, the identity access technologies will have to evolve in order to make sure we have consistent usability and security across all information delivery platforms.   The users also need to know that the service they are accessing is authentic, based on the mutual authentication principle, where the service provider will first reveal a secret which will assure the user of the integrity of the communication channel.

In the last two years hackers have stolen over $40 million from small to medium enterprises that typically don’t have the resources or tech expertise to protect themselves from such attacks. They often do business with small banks and credit unions, which are typically considered “low hanging fruit” for hackers. Channel-Pro SMB interviewed our very own Stuart Morris about this issue, and the write-up points out some key issues – like the impact this can potentially have on small to medium businesses.

The solution the feds propose is a dedicated computer used only for banking. They recommend it because malware is often installed when surfing the net, gaming, emailing, and downloading programs. It isn’t fool-proof though. Crooks are smarter than we like to think and a computer dedicated to online banking isn’t a surefire way to stop them. And logistically, unless we’re talking about sole proprietors, it becomes both a hassle and prohibitive expense when every person who needs access to banking information requires a separate computer to do so.

Hey! I have an idea! What if banks, e-commerce sites, and other agencies requiring sensitive login procedures found a way to protect their users and consumers from this type of fraud? Is it possible? Is it plausible? What is this, 1976? Of course it is! And it has been for years.

The only real way to stop keyloggers is to stop typing passwords. You know how you use your mouse to click on buttons on the computer screen?  There’s no reason banks couldn’t use a clickable keypad on the screen to replace password typing, or even credit card entry. And guess what? It’s already being done. There’s a system that first recognizes the user and generates a customized keypad for them. If your keypad doesn’t look right you know you’re on a fraudulent site. When you see the keypad you recognize, you use your mouse to key in your password. Easy, breezy. And keyloggers don’t have a chance. (Neither do man-in-the-middle, man-in-the-browser, or any host of other hackers.)

Wanna give it shot? You can. Go ahead – try it now. I’ll give you a buck – a whole greenback for the minute you spent – if you think it’s too hard to use.

The good:

• if you’re trying to save dough, this could be a positive means of accountability – you spend frivolously and your friends immediately know it.
• couponing and bargain-hunting gone wild. If your friend found something on sale, this could be a valuable alert.
• a marketer’s dream. This takes ‘keeping up with the Jones’s’ to a whole new level.

The bad:

• it requires you to store your credit card information and login information on their site. Um… is our memory for corporate financial data leaks really that short? Are we fool enough to divulge this? If so, maybe we deserve to have our identities stolen…
• surely no burglar, criminal, or otherwise mischievous soul would ever use this for ill. And if you believe that, I have a bridge to sell you.
• are we really so materialistic and driven by instant gratification that we need a whole new social networking site to help retailers manipulate our spending habits?

Here at Tricerion, we think a site like this has the potential for more harm than good. It would certainly be useful to hackers to gain access to the data stored there, and we haven’t seen anything from Blippy to allay our fears about their site security. Maybe we’re just overcautious (or maybe we just know who we’re fighting really well).

How about you? What do you think of Blippy? Would you blip (or is it bleep? maybe bleet?)?