The Virtual Vault

Don’t get clickjacked

Clickjacking is a fiendishly clever way to hijack your website. This hacking technique overlays a legitimate web page with an invisible hacked web page. When you click a button, you unknowingly click the button on the invisible overlaid page.

The most famous example of this hack was the “Don’t click me” exploit of Twitter. Suddenly, Twitter was full of messages pointing to a website with a button that read “Don’t click me”. For a more detailed explanation, see Daniel Sandler’s blog article Twitter’s “Don’t Click” prank, explained.

To mitigate this problem web pages should contain a framekiller script that prevents framing of invisible web pages. However, this script can still be hacked on older browsers. If you are an Internet Explorer user, you should upgrade to Internet Explorer 8, which contains enhanced security features that directly address this problem. Firefox users should install the NoScript Firefox add-on to protect yourself against Clickjacking attacks.

James Bell

What are your duties as an executor?

About 10 years before my mother died, she went to an attorney and drew up an estate plan. She named me as the executor of her estate. After reading over the plan, I did not quite understand the amount of work needed to settle an estate. Years later, when she died, I found out. This responsibility consumed untold hours of my time and it took years to settle her estate.

If you are named the executor of someone’s estate, I highly recommend that you find out exactly what you are getting yourself into. You may have to travel great distances and take time off work. Although your exact situation will be different, these articles explain the process enough to prepare yourself.

The Duties of an Estate Executor
Pauline Go

Executor Responsibilities and Duties
estatesettlement.com

James Bell

Talking about Your Final Wishes

Talking about death is an uncomfortable subject. Most of us expect to die quickly, but the sad fact is that many of us may linger in poor health for an extended period. Talking and planning for death is one of the most important things you can do for you and your family.

AARP has published an excellent article on this topic called "Talking about Your Final Wishes". Make sure to have that talk soon. You owe it to your family!

James Bell

Advance Directives: Put It In Writing

An advance directive is your life on your terms. Whether you're 18 or 80, documenting your wishes today means your family won't have to make heart-wrenching decisions later.

The American Hospital Association website PutItInWritting.org contains must read information on advance health care directives.

James Bell

How is your data encrypted?

A virtual safe deposit box must provide the highest degree of safety to its users. Data stored on its servers must be encrypted. Data at rest is particularly sensitive to hackers, so it is vital to encrypt information stored in databases and file servers.

Encrypted data is only as good as its encryption algorithm. Recently, hackers have broken the 768-bit RSA algorithm, although the 1024-bit version is still safe (for now). With the increasing amount of computing power available to users, weaker encryption algorithms will become more susceptible to cracking by hackers.

AES/Rijndael is a strong encryption algorithm, which is highly resistant against brute force attacks, such as linear cryptanalysis and differential cryptanalysis. The US Government uses the AES algorithm to protect TOP SECRET information. A 128-bit AES encryption key is roughly equivalent to 2600-bit RSA key.

Before choosing a virtual safe deposit box provider make sure that you understand exactly how your information is stored. Your provider should employ a double encryption standard where data is encrypted in transmission ("in-flight") using SSL and in storage ("at-rest") using a 128-bit AES algorithm or better.

James Bell

Is your password in harm’s way?

A virtual safe deposit box is meant to hold your most precious information. So, it’s prudent to ask your service provider exactly how they store your information? In light of the recent security breach at RockYou.com, where 32 million passwords were exposed, your provider should, at the very least, publish a security policy clearly stating how information is stored.

Your provider should encrypt (hash) passwords that are stored in a database. Passwords can be further disguised through a technique called salting, where additional data is stored with the password prior to hashing. If the database is hacked, the passwords will be unreadable. Salting the passwords makes it far more difficult for a password cracker program to decipher your password.

A more secure approach would be to use OpenID or RPX for authentication. This way, passwords are stored off-site. Some OpenId providers, like MyOpenId, also offer SSL certificate sign in and two-factor authentication.

Additionally, your service provider should prevent their database from being hacked by guarding against SQL injection attacks. This security breach allows a hacker to enter database commands into an input box. If successful, this technique reveals details about the database, which allow the hacker to steal information. Input data should be sanitized using tools such as AntiXSS. Another defensive strategy is to query the database exclusively through stored procedures and disallow the use of Dynamic SQL.

Make sure to change your password often. If you suspect a security breach, change your password immediately and contact your service provider. Learn how to create strong passwords and avoid phishing attempts. Once your information is compromised, you will not get a second chance.

James Bell

Sources

RockYou Hacker: 30% of Sites Store Plain Text Passwords
by Jolie O'Dell

One Of The 32 Million With A RockYou Account? You May Want To Change All Your Passwords. Like Now.
by MG Siegler

RockYou Hack: From Bad To Worse
by Nik Cubrilovic

LBS technology to revolutionize home inventory services

Location Based Services (LBS) will soon provide powerful solutions that provide real-time tracking of personal property. Small inexpensive devices, known as S5 tags, periodically transmit their location through a rapid-response wide area network. Location information passes to a telemetry server, which in turn, is sent to an application through the Internet.

These tags incorporate the necessary electronics, battery compartment, antenna elements and external housings to allow the device to act as a self-contained transmitter. In addition to location information, a tag can also transmit other information, such as temperature, meter readings, running hours, fluid levels and more.

Battery life is estimated at 4 years and individual tags are priced at under $10. On-going service is about $1 per month per tag.

A tag can be inconspicuously attached to your personal property. If your property is lost or stolen, it’s location can be instantly determined, greatly reducing recovery time.

James Bell

Sources:
S5 Technology
S5 Wireless

S5 Tracking Chips Will Run for Four Years, Cost $2, Weigh Nothing
Gizmodo.com

Subpoena wielding authorities get full contents of Yahoo! account for $80

Cryptome has assembled a set of "Lawful Spying Guides" which spell out a company's requirements for divulging your account information. According to the Yahoo! Compliance Guide for Law Enforcement, with a subpoena (and $80) you can get the entire contents of a person's Yahoo! account. The document does not mention anything about estate planning legal documents, so my assumption is that having a will or power of attorney is not good enough. Make sure to consult a legal professional for exact details on your specific situation.

James Bell

Collecting Life Insurance

My mother named me as a beneficiary on her life insurance policy. When she died, I called the insurance company and found out that before distributing any funds they required a death certificate and a copy of the life insurance policy. The death certificate was the easy part. Where was the life insurance policy?

I quickly located the life insurance premium statements and a cover letter from the insurance salesman. I called the insurance company again. They were adamant, without a copy of the entire life insurance policy there was no payout. It didn’t make sense to me…why didn’t they already have a copy of the policy?

Hours later, I found the policy in a stack of papers. It was over 10 pages long! I made a copy and sent it to them. Several weeks later, I received a check.

This little experience taught me how vital it is to have your final affairs in order, before you die. This is one of the many reasons why we created Estate++, a virtual safe deposit box that helps you organize your affairs.

James Bell

Online Banking: During Incapacity and After Death

With all the attention being given to the digital afterlife, I would like to share my real world experience with accessing my mother's online banking account during her incapacity and after her death.

Luckily, my mother had enough foresight to seek out an estate planning attorney many years before her passing. This attorney created a comprehensive estate plan, which contained a will, a financial power-of-attorney, a health care power-of-attorney, a living will, and a revocable living trust. In order to fund her revocable living trust she had to change the name on her bank accounts to the name of the trust.

When she became incapacitated, I needed to write checks and transfer money between accounts...no easy feat when the bank is located over 700 miles away. So I called the bank for help. They immediately responded by freezing all of her accounts. They told me that nothing else could be done without a power-of-attorney. Once they received a copy of my mother's financial power-of-attorney, they promptly gave me a new password to her online banking account and restored check writing privileges.

When she died things became more complicated. Once again, the bank responded by freezing all of her accounts. This time they needed copies of her death certificate, will, and revocable living trust. They also required a notarized copy of an "Acceptance of Successor Trustee" form from each of the living trust’s successor trustees. Only the executor of the estate received a new password to her online banking account, which was now restricted to read-only access. Check writing privileges were restored, but each check required the signature of each successor trustee.

Overall, the bank was very cooperative, once they received the proper paperwork. I can only imagine the problems a person could have without an estate plan. A virtual safe deposit box is a secure place to store information about online bank accounts, but never assume that just because you have the password that you can access an account without the proper authority. I highly recommend that you consult an estate planning attorney concerning the details of your specific situation. You won't get a second chance once your are gone!

James Bell

Special thanks to the employees of The First National Bank of Illinois