More and more of the sensitive, valuable things in our life are guarded through password-protected online accounts — love letters, medical records, bank accounts and more. Websites use login procedures to protect those valuable things. Generally, as long as someone can’t log into your account, they can’t read your email or transfer money out of your bank account. As we live our lives online, how should we protect our logins?
Özetle:
- Rastgele parolalar kullanın ve her site için farklı bir parola kullanın
- Tarayıcının güvenlik sinyallerine dikkat edin ve şüpheci olun
- Güvenlik sorularına en az parolalarınız kadar güçlü yanıtlar verin
- Parola oluşturmayı ve hatırlamayı kolaylaştırmak için bir parola yöneticisi kullanın
- Kullanabildiğiniz her yerde “İki aşamalı kimlik doğrulamasını” kullanın
Parola olmak zor zanaat
Most logins today are protected by a password. If an attacker can get your password, they can access your account and do anything you could do with that account. So when you ask how secure your account is, you should really be thinking about how safe your password is. And that means you have to think about all the different ways that an attacker could access your account’s password:
- Şifrelenmemiş bir web sitesi kullandığınızı görebilirler
- Parolanızı tahmin edebilirler
- İçinde parolanızın bulunduğu bir dosyayı çalabilirler
- Parolanızı sıfırlamak için parola kurtarmayı kullanabilirler
- Parolanızı onlara vermeniz için sizi kandırabilirler
To keep your login safe, you need to prevent as many of these as possible. Each risk has a different corresponding mitigation.
Tarayıcınızdaki asma kilide dikkat edin
It’s easy to prevent attackers from stealing your password when you log into an unencrypted website: Think twice before you type your password if you don’t see a lock icon in the URL bar, like this:
The lock means that the website you’re using is encrypted, so that even if someone is watching your browsing on the network (like another person on a public WiFi hotspot), they won’t be able to see your password. Firefox will try to warn you when you’re about to enter your password on an unencrypted site.
Your browser also helps keep you informed about how trustworthy sites are, to help keep you safe from phishing. On the one hand, when you try to visit a website that is known to be a phishing site, Firefox (and any major browser) will display a full-screen warning — pay attention and think twice about using that site!
In general, the best defense against phishing is to be suspicious of what you receive, whether it shows up in email, a text message or on the phone. Instead of taking action on what someone sent you, visit the site directly. For example, if an email says you need to reset your PayPal password, don’t click the link. Type in paypal.com yourself. If the bank calls, call them back.
Farklılıktan gelen güç
The secret to preventing guessing, theft or password reset is a whole lot of randomness. When attackers try to guess passwords, they usually do two things: 1) Use “dictionaries” — lists of common passwords that people use all the time, and 2) make some random guesses. The longer and more random your password is, the less likely that either of these guessing techniques will find it.
When an attacker steals the password database for a site that you use (like LinkedIn or Yahoo), there’s nothing you can do but change your password for that site. That’s bad, but the damage can be much worse if you’ve re-used that password with other websites — then the attacker can access your accounts on those sites as well. To keep the damage contained, always use different passwords for different websites.
Use Firefox Monitor to keep an eye on email addresses associated with your accounts. If your email address appears in a known corporate data breach, you’ll be alerted and provided steps to follow to protect the affected account.
Güvenlik Soruları: Annemin kızlık soyadı “Ff926AKa9j6Q”
Son olarak, çoğu web sitesi, parolanızı unutursanız onu kurtarmanıza izin verir. Genellikle bu sistemler, parolanızı sıfırlamadan önce bazı “güvenlik sorularını” yanıtlamanızı ister. Bu soruların yanıtlarının da parolanız kadar gizli olması gerekir. Aksi takdirde saldırgan yanıtları tahmin edebilir ve parolanızı değiştirebilir.
Rastgelelik bir sorun olabilir çünkü sitelerin sıklıkla kullandığı güvenlik soruları; doğum yeriniz, doğum gününüz veya akrabalarınızın adları gibi insanların sizin hakkınızda bilebileceği veya sosyal medya gibi kaynaklardan toplayabileceği şeylerdir. Neyse ki verdiğiniz cevabın gerçek olup olmadığı aslında önemli değil. Yani yalan söyleyebilirsiniz! Ama verimli bir şekilde yalan söyleyin: Güvenlik sorularına da parolalarınız gibi uzun ve rastgele yanıtlar verin.
Parola yöneticisi kullanın
Now, all of this sounds pretty intimidating. The human mind isn’t good at coming up with long sequences of random letters, let alone remembering them. That’s where a password manager comes in. Built right into the browser, Firefox will ask if you want to generate a unique, complex password, then securely save your login information, which you can access anytime in about:logins.
When you’re logged into Firefox with your Firefox account, you can sync across all your devices and access your passwords from a Firefox mobile browser. Learn more about how to use the built-in password manager to the fullest here.
İki aşamalı kimlik doğrulama (2FA)
2FA is a great way to level-up your security. When setting up a new account, some sites will give you the option to add a “second factor” to the login process. Often, this means linking your phone number to your account, so after you enter your password, you will be prompted to enter a secure code texted directly to you. This way, if a hacker has managed to get your password, they still won’t be able to get into your account, since they don’t have your phone.
Örneğin Firefox hesabınız, burada daha fazla bilgi edinebileceğiniz 2FA ile korunabilir.
2FA provides much better security than passwords alone, but not every website supports it. You can find a list of websites that support 2FA at https://2fa.directory, as well as a list of sites that don’t support 2FA and ways you can ask them to add support.
Güçlü, farklı ve çok aşamalı
For better or worse, we’re going to be using passwords to protect our online accounts for the foreseeable future. Use passwords that are strong and different for each site, and use a password manager to help you remember them safely. Set long, random answers for security questions (even if they’re not the truth). And use two-factor authentication on any site that supports it.
In today’s internet, where thousands of passwords are stolen every day and accounts are traded on the black market, it’s worth the effort to keep your online life safe. When you use Firefox products, some of the effort is taken off your plate, because all our products are built to uphold our privacy promise. And Firefox is always guided by Mozilla’s mission, the not-for-profit we are backed by, to build a better internet.