Chapter 11. Keeping your computer and personal information safe

Using strong and unique passwords for important and sensitive accounts helps prevent unauthorized access to your personal information, identity theft and direct financial losses. Consider the following scenario:

Password reuse can turn into a disaster. You should pay attention to use unique and strong passwords for the following services:

The strength of a password depends on how hard it is for an attacker to guess it. Attackers use special programs that can make millions of guesses per second, so weak passwords don’t stand a chance.

Some passwords (like monkey, password, test, 123456) are extremely common. If you use those common passwords, your accounts will be hacked easily. However, adding capital letters, numbers or symbols is often not enough to turn a weak password into a strong one. This is because people reliably pick the same additional symbols and numbers (for instance, monkey1 is more common than mo5nkey, and also more common than monkey hoover).

It is better to choose a longer secret, such as a pass phrase (for example correct horse stable battery), than a secret that is both hard to remember and easy to crack. Consider using a series of common words which you can easily remember. Do not pick words that people around you would naturally associate with you (for instance, you should not pick poker related words if you play poker every day).

While using the same password for multiple accounts is not encouraged, everybody ends up doing this, even security experts. However, many commonly used websites get compromised by hackers every year. Some of them might even purposefully sell their users' passwords to third-parties. There is no definitive agreement among security researchers on how to reduce the risk of reusing passwords, but you should consider the following:

You don’t need to change your passwords every other day. In many cases, if an attacker can steal your password, they will be able to steal it again in the future.

If you do need to change your password, you must pick one that is actually different from the previous one. For example, monkey5 is not an acceptable substitute for monkey4, and it will be easily guessed by an attacker who already stole your previous password!

To change your password, follow the steps below:

	While it is possible to make Xubuntu log in automatically on boot within the user dialog, automatic login is highly discouraged because it provides less security for your system. Please turn on automatic login on only if you can trust everybody that has access to the computer.

Websites like haveibeenpwned.com can tell you if your email address or username appears amongst databases of stolen passwords. It is a good idea to check it every other month. Besides, you may occasionally hear about a service you use in the news, or get an email from a service provider informing you that they have been hacked. When you are confident that a password has been compromised, you should:

	Never reveal your password to a third-party website. The website above is OK to use because it asks for an email address, which is relatively public information. It does not ask for a password. Websites that ask for your password will most likely misuse it.

Password managers are a very convenient way of using many unique passwords without having to remember them all!

	There are several password managers available in the repositories, including KeePassX and PaSaffe.

Some password managers, like KeePassX can synchronise your passwords across devices, including Windows or OS X computers. You should be aware of a few limitations, if you decide to use a password manager:

If you keep the above advice in mind, password managers can be a great way to stay more secure, more easily!

Web browser extensions are a popular mechanism among hackers for harming users. They are especially relevant to Linux, since they are compatible with all platforms. Malicious extensions could steal your passwords, monitor your activity online for advertising, abuse your social media accounts or steal your money.

You can take measures to limit the risks you expose yourself to:

If you run public facing Internet services, or are not on a NAT, you should consider using a firewall. Most home users are not concerned by this measure.

Understand that firewalls are not very useful in their default settings. You should consider what you want to achieve and configure the firewall accordingly. Firewalls can protect you against denial of service attacks, limit access to a service to specific IP addresses or inspect and reject suspicious packets. However, they cannot protect you against unknown or emerging threats, and they do not replace the need to install security updates.

When Xubuntu is installed, it is set up for a single person to use. If more than one person will use the computer, it is best for each person to have their own user account. To read more about adding users, refer to Users and groups.

Locking your screen prevents other people from accessing your computer while you are away from it. All of your applications and work remain open while the screen is locked.

To lock the screen, press Ctrl+Alt+Delete or click → Lock Screen.

To unlock the screen, move the mouse or press a key. Then, type your password and either press the Enter key or click the Unlock button.

If more than one person has a user account on your computer and the screen is locked, other users can press the triangle button to the right of the user name, select their name from the list and enter their password to use the computer, even while the screen is locked. They will be unable to access your currently open work and you will be able to switch back to your locked session when they have finished using the computer.