Tips to Keep Your Social Media Accounts Secure

Greetings everybody, welcome to the Wednesday, January 16th, 2019 episode of Free Webinar Wednesdays. This is Eric Cook with WSI Digital, where we work with businesses and organizations primarily in the financial services and community banking space, helping them better understand and leverage the power of the internet as a strategic business tool. You can learn more about WSI and all the fun stuff we do here with our clients and online at www.poweredbywsi.com. Today's show and all shows are recorded, made available at freewebinarwednesdays.com. And if you are attending live, first and foremost, thanks for joining us live. We appreciate that. Um, and by we, it's probably going to be me and the mouse in my pocket because normally my good friend And Free Webinar Wednesday partner Mr. Jeff Simpkins joins me, but he's been a little AWOL, busy doing other stuff. So I've kind of been carrying the water for Free Webinar Wednesdays, which is fine. I am totally cool with that and actually enjoy spending a little bit of time with everybody at least once a week, assuming that I'm not traveling or in an airplane or someplace jaunting around. But if you are attending live and you've got comments, thoughts, feedback, or just want to say hey, feel free to use the chat function. in your control panel, which is likely floating over on the right-hand side of your screen, and would be good to know that you're there. And if there's something that you specifically would like to know, let me know. Today, what I thought I would do is just share a brief update because I've had a couple of conversations regarding account settings in social media, and I'm just going to cover the 3 main ones, although what I'm going to talk about to you today also can apply To other services as well, such as Snapchat, Instagram, Pinterest, all those. But I want to make sure that everybody is familiar with— and we had an instance just recently where something kind of suspicious happened on one of the Facebook pages that we helped to administer, and we discovered that one of the admins from the company did not have 2-factor authentication enabled, then it was difficult to determine if that might have been somebody that figured out a username and password and got in. It didn't really do anything suspicious. You know, there wasn't a security issue, wasn't an identity theft, or— but it was just something happened that nobody could really put their finger on. And so in order to make sure Whether you are an administrator on a social media account for your organization, or you just want to lock down your own personal settings, it's good to know that you can change these settings within your own LinkedIn, within your Facebook, within Twitter, and many of the other platforms to try to keep the bad guys out. A couple of things that I'll mention first and foremost. One thing that you want to make sure that you're not doing is using the same password for multiple accounts. And the reason that that's a problem is in the internet of today, there are companies outside of your control that will suffer data breaches and it will reveal usernames and passwords. And so that can be a problem. And, and we use Dropbox here at WSI, so I, I can kind of speak to this firsthand. And I'm trying to type in here, trying to type and talk at the same time. That's the joy of a live webinar. Sometimes that works and sometimes it doesn't. But if you have an account, for example, at LastPass, and your email address is first name .lastname@gmail.com, and you set your password to password12345. And that password— hopefully that's not it— but that password12345 is one. Or maybe it's even a special password, you know, password with the letter A replaced with the sign and the first S is the number 5, and then you use exclamation point. So you might be able to change it to some I mean, it would be difficult to guess, but if that's the same password that you use for your social media sites, typically what's going to happen is whoever ends up breaching that wall and getting the usernames and passwords from Dropbox or whoever, they're going to go out to all of these other sites and they're going to try that same user ID and password combination. And if you just happen to have first last@gmail.com is your email address to get into Facebook, and you use that same— even though it might be a complex, very difficult to guess password, but if it's that same password that you have in, uh, that you've been using for Dropbox or maybe for Gmail, that will get the bad guy into Facebook because they no longer have to hack that password. They actually just have to find out what that password is from some other site, some other breach, and connect it with your email address. And then most of the time they just throw that into some sort of a bot program that systematically goes through all of the social sites and other platforms that you could have a username and password combination. And if it comes back with a successful response, they may or may not do anything right away. They may just say we got in and they might just let it sit. So 6 months from now, if you've not changed your password, yeah, it was in Dropbox, but, you know, nobody's really done anything, so it's no big deal. And then at the 7th month, all of a sudden weird stuff starts happening on your Facebook or your LinkedIn profile. That's when you need to be really careful. So one of the things that we've done here within WSI, and I would encourage it, and I'm not necessarily saying you have to go with LastPass, there's 1Password and other platforms out there, but I would strongly suggest that you use some sort of a password management tool. The good news is they're not very expensive. I think this is $2 a month if you pay it annually, so it's dirt cheap insurance. But what this gives you the ability to do is you can create one complex master password that's not going to be anyplace on a computer. You maybe jot it down, stick it in an envelope, and shove it in your desk. Or use a combination, but one master password is going to get you into this system. And then what happens is, as you start building passwords or setting up accounts at other platforms, you allow LastPass to automatically just generate a random 12-character password that has absolutely no connection with any other password. It's going to be impossible for you to remember, but you're no longer having to remember passwords. You're using the LastPass service and either on your computer. You can see I've actually got the LastPass Chrome extension installed in my, in my browser. So when I go to a website, as long as I'm logged into my LastPass extension, you can set up LastPass to use 2-factor authentication. So when you log into LastPass to get access to your passwords, you can have it send your phone a text message so that you can authenticate and get in so that another layer, which is what we'll talk about with Facebook and LinkedIn and Twitter. But by doing it this way, you can over time ensure that every single one of your accounts has its own unique password. And you can install LastPass on your mobile device, you can enable fingerprint login, so you've got that level of biometric security. Or if you've got Face ID, I believe Face ID is now supported. LastPass on the more recent iPhones. So this gives you a very, I guess, secure way and a unique way so that the password that you use for Dropbox is different than Facebook, is different than LinkedIn, and it just puts all that in. And plus it creates a very unique password combination, so it's very difficult for somebody to guess that. And if somebody does happen to hack into an account and they grab your password, you now know that they only have got access to that one account. They can't use that password over and over again. I will tell you a horror story from a friend/client of mine who was using the same password for LinkedIn and for their Gmail account. Their Gmail account was compromised. The person got into Gmail, And changed the individual's password in Gmail. So at first locked them out of their Gmail account, which they didn't use very often, but that just happened to be the email account that they used when they set up LinkedIn. They didn't use their business; they used their personal email address. So then what happened is they logged in to LinkedIn, which also had the exact same password, and that was associated with Gmail, and they got into. LinkedIn and they changed the password there. So when my friend/client found out that somebody was spamming people with their LinkedIn account, sending messages and direct kind of SMS-type messages through their LinkedIn account, they immediately went to LinkedIn and tried to log in. Well, it didn't work, so they clicked on password reset. Well, when the password reset was clicked That did what? It sent the password reset link to their Gmail account. They tried to log into Gmail. Gmail's password had been reset. They could not log into Gmail. So the bad guy took over LinkedIn, and when the password reset notification came into Gmail, which the bad guy had control over, he just deleted it and continued on his merry way of causing ruckus and, uh, and mayhem. in this individual's LinkedIn account. So that's probably an extreme. Over the 11 years that I've been serving as a digital strategist with WSI, I think I've heard of that happening 3 times. But I can tell you that each of those 3 occasions, it was devastating to the individual because they've been spending time in LinkedIn. Their professional reputation was tarnished. It's very difficult to get back to LinkedIn because now you have to figure out Well, how do I communicate to LinkedIn to tell them that that's not me? And how do I get them an alternative? And there's no way that you can just pick up the phone and dial 1-800-LinkedIn and talk to somebody. And particularly in LinkedIn, where that's much more focused on your business reputation, you may not get an opportunity to recover that down the road if you connected with somebody and then someone who's taken over your account sends them an offensive or spammy message. They might disconnect with you, block you, and that might be a business opportunity that just completely shrivels up and dies and could have been prevented with some password management and some 2-step authentication. So I would say I'm getting off my soapbox now, but I'm still going to stand on my soapbox because I still think that this is a very important thing that everybody needs to be thinking about. So I'm going to— Thank you, Eric. Show you exactly how to go about getting access to the 2-step login process on each of the 3 different platforms, which are again probably the most popular. So let's start with Facebook. So Facebook, what you're gonna do is make sure that you log in. Obviously you're gonna click on the little dropdown over next to your settings. You're gonna scroll down to where you've got access to your settings. So you can see it right here, kind of towards the bottom. That's going to take you into your settings area. You're going to have your general settings where it's going to show you what you've got for your connections. While you're in here, it's also a very good idea just to spend some time doing a security audit against your account. So sometimes privacy settings, who your information can be seen by, what information, you know, friends or friends of friends or public. It's a good idea to double-check and make sure that you understand what all those are saying and who has access to your information. If you click on the security and login area though, this is the area that I want to spend the most time looking at. So I can see where I'm active now, which is correct. I've got a device that's also in this area, which happens to be my mobile device. So it's tracking that. I can dive in and take a look at some more of that information. If you go in here and you see that you're logged in in Tallahassee, Florida, and you live in Dallas, Texas, there's a problem. And, you know, maybe you were in Tallahassee last week and it just retained that IP address, or maybe somebody down there has figured out a user ID password combo and they've logged in as you down in the Sunshine State. You can change your password here at any point in time. You can elect to opt in with your, with your profile picture, which is a little bit more related to the mobile device. But this area here, 2-factor authentication, is what I really want to talk about. You're first going to need to make sure that you authenticate your mobile device to your Facebook account, and most people probably have done that already. But if you go through this 2-factor authentication login process and you don't have your phone, it'll prompt you to say you need to authorize your phone because that's going to be the method by which this 2-factor process is going to work. You will log in, you go to the public library, for example, you pull up facebook.com, you type in your username and your password. The system says you've never logged in here before, I don't recognize this. It'll send a text message to your phone, or you can elect to use your Facebook app on your mobile device and go to the code generator. And either way, you'll be able to get access to a 6-digit number that's randomly generated for you that you'll be able to enter into Facebook to complete the login process. If you get one of those, hey, here's your 2-factor login code, and you have not gone through the process of trying to log into Facebook, then there's probably an issue with somebody else who discovered the username and the password. Think about protecting your home. Most of us are protecting our home If you use an analogy here with the screen door, it's very easy to get through the screen door. It's just like it's very easy in today's day and age to maybe find somebody's password because you can breach another system and that information is maybe available to you. If you enable 2-factor authentication, that basically shuts the big old wooden door, locks the deadbolt, makes sure that the bad guys really aren't going to get in unless they've got— unless they've got that code, which they're not going to have. Unless of course they steal your phone and then there's probably a whole other issue there. But the 2-factor authentication, you want to make sure that you turn that on. You can see mine is on. I can edit that if I so choose. You can also browse through and take a look at any authorized logins of where you've actually used your code to get access to the system. You can add some additional security alerts to make sure that, hey, if there is an unrecognized login, you can get a message. If for some reason you happen to lock yourself out, to make it easier for you to unlock that account, Facebook is giving you the ability to identify friends that can vouch for you. Facebook's going to look at the relationship between your spouse, your best friend, your college buddy, a coworker, somebody that is connected with you that you've been having conversations with. Maybe you're tagged in each other's photos, and you can answer a series of questions to be able to unlock your account. Leveraging those friends connections. Make sure you pick friends that they're going to make sure that they claim that they know you, or that could be kind of defeating the purpose. And then some advanced options here. You can always kind of go through and take a look at those privacy timeline and tagging location. All of those are elements that I would encourage you to spend some time looking around in and making sure that you understand what Facebook is doing, who they're sharing their your information with, because like I said, sometimes that information changes. I've heard of stories where people have thought they have locked down their account so they're only sharing with friends, and then they post something, and then all of a sudden Facebook did an update, and now all the updates that you're posting are public, and people that you didn't necessarily want to see those pictures, those posts, those status updates are now able to see that information, and that's certainly not what you want. We hop over into LinkedIn. This gives us the ability to do that as well. So in LinkedIn, and I'm using the Sales Navigator functionality, so you may see a couple of extra icons over here if you don't see those in the free version. But you go to the Me icon and you click on the dropdown and you're going to go to Settings and Privacy. This is going to take you into the backend. This will open up a new tab. Sometimes when you go into Settings and Privacy or when you're making changes, You will be prompted for your LinkedIn password, so make sure that you know what that is. While you make sure you know what that is, it's a good opportunity for you to double-check yourself and make sure that that's not a password that you're using someplace else on the internet, because if it is, you want to make sure you get that changed. If you click over on the Account tab, this is going to take you into the different areas. So you've got the navigational elements that show up here on the left-hand side. So you've got communication preferences, whether you can see or other advertisements are finding you, privacy-related information. So just like in Facebook, it's a good opportunity for you to browse. And I will kind of wrap up Free Webinar Wednesdays shorter. We're not going to go the full hour. So if you wanted to take the last 30 minutes that normally would be part of Free Webinar Wednesdays, you can browse around. And do some updates here. So you go into the account area, you can see at the very bottom of login and security, you've got 2-step verification that is turned on for me. Just like with Facebook, you're going to need to make sure that you've got your mobile device authenticated. And if you feel that there's some suspicious, suspicious activity, you can go do your password change. You can add phone numbers, other sorts of email addresses as well. You've got some other preferences down here that you can actually go through. One of the other features that I also wanted to maybe draw your attention with, or draw your attention to, is if you go into the privacy area and you look at LinkedIn using your data, depending on— and you want to double-check with your corporation privacy settings. So some of you Maybe entrepreneurs, single business owners, you call the shots. So it's your data. You can do what you want with it. If you work for an organization where you're getting access to an Exchange server or an Outlook system or OWA or Office 365, whatever the case is, you want to make sure that it's okay for you to be able to activate this. But there's a couple of options here that are kind of nice as it relates specifically to LinkedIn being a much more of a business-orientated platform. So you can synchronize your contacts as well as your calendar with LinkedIn. And what that does is it allows LinkedIn to monitor that information for you on your behalf. And if I have an appointment set up in the future with somebody and I've invited them to that appointment and their email address resides in my Google Calendar because we use the Google Apps for Business suite for our corporate email and calendaring and productivity. If somebody's email address is in a Google Calendar, Google is obviously given authorization to share that information with LinkedIn. LinkedIn is going to monitor that, and if LinkedIn sees that that email address is associated with a LinkedIn profile, I could get a notification pushed to me by LinkedIn that says, hey, Looks like you've got an appointment coming up with Jeff Simpkins tomorrow. How would you like to browse his LinkedIn profile before your meeting to catch up? Or if I'm not connected with Jeff, it'll still recognize Jeff's email address, but maybe I would want to send him an invitation to connect with me on LinkedIn, or at least visit his profile to see if he's posted anything recently. Has he shared any status updates? Maybe get a little bit of background information about Jeff. Where do you go to school? What sort of nonprofits is he interested in? What skills does he have? But it gives me an opportunity for LinkedIn to provide me with a little bit of a heads up as your own little digital social calendar secretary, so that you can make the most out of that conversation. And there's been a number of times where I've gotten a notification from LinkedIn. It's told me that I've got an appointment coming up with somebody. I visited their profile and either I'm connected with them already and I can, you know, get access to some more of their information, or if I'm not, I'll send an invite or I'll at least browse their LinkedIn profile so that they can see maybe that I visited their profile and then maybe work something out of that. So if they posted or shared an article recently, I can maybe work that into the conversation and build a little rapport. So Probably lots of other cool little nuggets and tidbits that I could share with you with regards to LinkedIn, but those are a couple of the ones as I was just browsing through that most people don't realize exist within the LinkedIn platform. So if you click on either of those, you will get a request to authenticate and it'll say, you know, you need to give permission so you can see my Powered by WSI account with Google Contacts. And my Google Calendar. If you've got Outlook through personal or work, or you can even synchronize it directly just with your phone contacts. So if you want to keep it more personal, not necessarily your business, you've got the ability to go in and actually do that as well. The last platform I'm going to share with you is Twitter. So you go into Twitter, you go to your profile, even though it doesn't say me beneath it, but you go to your profile area. You're going to go down to Settings and Privacy. Settings and Privacy is going to take you into the backend, and in there, because I've already got it turned on, now I just have the option to review my verification methods. But if you don't see Review Your Verification Methods, that's where you're going to want to double-check because you're going to have the ability to opt into that from a security perspective. Turn that on, register your phone. Next time you log into Twitter, it'll make sure that it pushes out a notification to you. You've got your password management here. Again, this is a good area for you to go through. You can see this little LastPass element here has been integrated within, and you've got the ability to generate a secure password. So when you're using a service like LastPass, it gives you the ability to have fields automatically recognized as password fields. So Let's say I wanted to make a change to my password. I've got this option here where I can click on this. If I click on this, this generates— I can just do generate and fill and be done, or I'll show you kind of more options. I've got the ability to change the length, so I can go all the way up to 100 characters if I want. I can force uppercase, lowercase. I can include or exclude special characters. And so now if this is the password that I'm using, I'm probably not going to remember that. And I'm not going to change it to this because this webinar is going to go on the internet. I don't want to give everybody access to my Twitter account. But if I wanted to use this, I could click fill. I could copy this and paste it in myself. But this is going to give me the ability to change my password very easily. And then if I decided to change this, I would get a little notification up here that would say, hey, And it would come from LastPass. Sees that you've made an update to your Twitter account. Do you want to update this in LastPass? And I can say yes or no. So not going to change the password. I'm going to hit close on that, but that gives you some really nice capabilities. Probably the one other thing that I'll mention on LastPass, because I think that kind of covers what we're talking about here as it relates to your login authentication within Twitter, just make sure that you've got the 2-step added here is within LastPass, if you're using the paid version, you also have the ability to share your passwords and other secure cards directly with other people that also have LastPass accounts. And the reason that that's important is internally here, when we set up new customers, when we create accounts for the business for things like mail servers and hosting accounts and FTP credentials and all the other geeky stuff that we do that requires user IDs and passwords and IP addresses. Rather than sending that information through an email, which you don't want to do, putting it in an Excel file, which you don't want to do, we create the LastPass cards and then we just share those cards with each other. So if Mark from my team wants to know what the password is to re-register an SSL certificate for a client, That's got some pretty sensitive information in there. He just goes into his LastPass account and accesses that card, which I've created but then shared with his LastPass account, so he can see the information, I can see the information. A much, much more secure way of sharing information back and forth. I know a lot of spouses that will actually use this service, so other sorts of usernames and passwords. that you use for the household. You know, what's our Google Photos password? What's the Google Drive password? What's the, you know, different passwords for different things that reside? Just, you can share that with your significant other, or you can just do what I've done and put it all in mine. And my wife says, what's the password for X, Y, or Z? And I'm kind of her LastPass account, but that's okay. Makes me feel needed. It's good to, it's good to be wanted. But again, something that I think is very important to think about as you start moving through. You will likely, if you decide to kind of go on this adventure and make changes to your passwords, if you have some sort of a reference file now, I know a lot of people will create an Excel file and they'll copy call it passwords.xls and they'll store it someplace. If somebody gets access to your computer, that's going to be the first file they're going to look for, just so you know. So if you, if you've got a file like that, maybe print that information off and delete the file from your computer so it doesn't exist in electronic format, and then just work your way through the highest priority items. Where would you suffer the most damage if somebody got in and and acted as if they were you. Would it be Facebook? Would it be LinkedIn? Would it be someplace else? Maybe you've got a Dropbox or a Google Drive folder, and that's where you synchronize important records and files and tax forms and insurance documents, because more and more information is being stored and pushed to the cloud. If that's the same password that you're using for your Gmail account and somebody hacks that, uh, all that information could be up for grabs, and that's probably the last thing that you want is somebody getting access to that type of sensitive confidential information. So I'm going to pause for a quick minute just to check the chat queue and see if there's any questions from folks that are attending live. So as a reminder, if you, if you had a security-related question, feel free to toss it in the chat. Don't see that there's anything at this point. Looks like the thank you for attending was the one that I was seeing there, so Anyway, that kind of wraps what I wanted to talk about. A little bit more of a public service announcement, but given the fact that we've seen that happen and some not so nice things occur to folks that we care about, I figured it would be a good idea to maybe take this pulpit and broadcast the message. And, you know, over the next 30 minutes before you officially plug in back at work, I would encourage you to hop over to at least the main social networking platforms. Make sure that you've got the username and password, you know, probably not your username, but your password updated. Make sure you turn on your authentication process for 2-step, and then, you know, give LastPass a shot. You can download the free version. I do not think that that gives you the ability to share passwords. Between individuals, but if you want to just use it for a while, test it and see how it works, you can certainly do that at no cost, and it's a great way to go ahead and get started. So looks like we do have a question. Let's see. I assume LastPass will be a good solution even though I use a home PC, home laptop, and a separate work PC. Hashtag ninja training. Sean, you crack me up, man, but thank you for the question. Yes, I think any sort of a password management tool— you may not be able to install the Chrome extension on your work computer. They may forbid you from doing that, but that shouldn't preclude you from using it at home because there's probably a lot of usernames and passwords that you have that don't have anything to do with work. You may have more of an enterprise-grade password management service at the office that you can use, you're certainly going to want to check into that just to make sure that at least your business passwords— so I also happen to know Sean is a banker, so if you've got something to, you know, a FedLine terminal or an ACH system or your online banking credentials to be able to get onto your core, those are all things that you're going to want to make sure that you store in your bank password management environment. But you can install LastPass if you've got ownership and control over your mobile device and all of your computers and your laptop and your tablet, then you can certainly use the LastPass application to take control of all of those other accounts. And at some point, you know, maybe this would be an introduction. They do have an enterprise service that can be used, that can be rolled out at a very high level. So more of an organizational formal support. So if you don't have something in the office yet that's doing this kind of at a big picture, Then maybe this would be something to at least start some dialogue on and run this up the flagpole. Most IT managers are pretty aware of security and the threats of passwords and intrusions and breaches and all those other sorts of things. But if you're a user and not in charge of that, having those types of conversations with your IT folks, one, will score some brownie points for you. Remember, back in the day when I served as a network admin for our community bank. If I could get users of the network to even think about things like passwords and security and phishing and, and other sorts of ways to keep themselves safe, that just gave me warm fuzzies because most of the time your technology people are beating that drum and nobody's listening to it because let's face it, Having a unique complex password for every single site that you access on the internet is a real pain in the butt unless you've got a way to manage it. And honestly, there's no way that I could have a unique 12-character mixed case uppercase special character number. There's no way I could remember 2 or 3 of those passwords, let alone 200 or 300 of those. You have to have some sort of technology to be able to allow you to do that and bring that level of security in. So have that conversation. Let me know how it goes. Maybe you'll get some brownie points, but certainly it's definitely a conversation worth having. So looks like the question area is clean. You are most welcome, Sean. Thank you for the question. So with that, we're going to go ahead and wrap this up. Thank you, Eric. Show for the day. I wish you all a good rest of week. Those of you that are enjoying maybe some of the GEICO flashback commercials, every time I'm on Free Webinar Wednesdays, I'm reminded of the camel that walks around the office asking people if you're— if they remember what, what day it is. And being a camel, having a hump, eliciting the Hump day. So have a happy hump day, 'cause that's kind of what Wednesday is referred to. We'll look forward to seeing you online. It was kind of a cheesy way to wrap a show, but I decided to go for it and give GEICO a free plug, 'cause I love their commercials. But on that note, have an awesome rest of your week. Thanks for joining me at Free Webinar Wednesdays. Keep an eye on the site for future show and show recordings, and we'll look forward to seeing you on a future episode. Here, freewebinarwednesdays.com. Take care, everybody. Bye-bye.