passwords

We’ve been obsessed with strong passwords and public Wi-Fi for years. It turns out that the data sink was in the satellites

by

While we worry about choose strong passwords and Don’t let the neighbor steal our WiFiit turns out that anyone can capture private data simply by pointing a dish at a satellite. It is not a government conspiracy, it is what some Californian researchers have discovered using a piece of equipment that only costs $800. What has happened? They count in Wired that several researchers from the universities of California and Maryland have been capturing communications from various satellites for three years. During this time they have collected a huge amount of private data. Among the information collected there is data on calls and messages from users of various operators, the pages visited by airplane passengers who used WiFi on board, communications between different critical infrastructures such as oil platforms or electrical companies and even police and military communications that revealed the position of their equipment. Why it is important. According to the study’s conclusions, it is estimated that around half of the signal from geostationary satellites carries sensitive information of consumers, companies and also governments. We strive to protect our WiFi networks, our online accounts or mobile devices, but the results of the research make it clear that satellites are a critical element through which data can also be leaked. A basic equipment. What is striking is that the researchers did not use super complex technology to obtain these findings. They simply placed a satellite dish on the roof of a university building and started pointing it at the satellites. They only invested $800 in the entire equipment. The data they obtained is only from the satellites that they could capture from their position in southern California, which according to their calculations is 15% of the total, so logic leads one to think that the amount of sensitive data will be much larger. In addition, it also shows that anyone could do it from another part of the world. Operators. The most significant data came from telephone providers, mainly T-Mobile, but also Telmex and AT&T México. In just nine hours of communications logging, researchers were able to collect the phone numbers of more than 2,700 T-Mobile users, as well as text messages and phone calls. After contacting T-Mobile to alert them, the company took steps to encrypt the data. AT&T also fixed this and claimed it was due to a satellite provider failing to configure some towers in a region of Mexico. Telmex has not said anything about it. Military and police data. That anyone’s data is exposed is already problematic, but that it is data from the army and security forces adds another layer of seriousness. Investigators were able to intercept communications between US military ships and the names of those ships. Since they were in Southern California, they also obtained data from Mexican authorities, including transmissions of confidential information about ongoing operations. “When we started looking at military helicopters, it wasn’t the sheer volume of data that worried us, but rather the extreme sensitivity of that data,” says Aaron Schulman, co-director of the research. Cybersecurity in space. In August of this same year, researchers found several vulnerabilities which, under certain conditions, could allow remote control of satellites. At the beginning of the Ukrainian war, Russia carried out a cyber attack against ViaSat which affected thousands of users. Cases like these highlight the need to bring the cybersecurity debate to space systems as well and not just terrestrial systems. Image | SpaceX on Pexels In Xataka | There are so many satellites orbiting the Earth that Starlink has a new concern: avoiding colliding with them

A single click and goodbye to our passwords. This is the vulnerability that affects the extensions of several managers

by

We trust our Password managers as if they were digital safes. But, According to expert Marek Tóthjust visit the wrong website and click where it does not correspond to put that armor at risk. The technique presented in Def with 33 does not point to applications, but to extensions we use daily In the browser. In his tests, he ensures that this gesture can activate an information theft system without the user perceiving it. The research, made public in one of the main international conferences of computer security, documents how eleven extensions of password managers could be manipulated to filter data. Toth states that he notified the finding of manufacturers in April 2025 and that in mid -August several still still had corrections. The study includes practical tests, websites designed to demonstrate the failure and an estimate of the scope: about 40 million potentially exposed active facilities. How the attack works and why it affects you The technique described by Tóth is based on hiding the elements that the extensions insert on the page so that the user interacts with them without seeing it. With minimal changes in opacity or overlapthe attacker gets that The self -fulfilling is activated in the background. And there are several ways to achieve it, from manipulating the root element of the extension to altering the entire body of the site, in addition to variants by overlap. The most delicate scenario appears when a trap website is not necessary, but it is enough to take advantage of a legitimate page with a security failure. In those cases, he explains, the attacker can capture login credentials. The risk increases because many managers fill data not only in the original domain, but also in subdomains, which expands the attack surface without the user noticing it. According to data published by Tóth and collected by Socketon August 19, 1Password, Bitwarden, ENPASS, were continued as vulnerable Icloud PasswordsLastpass and Logmeonce. On August 20, Socket updated that Bitwarden had sent version 2025.8.0 with a patch, pending distribution in extensions. Among the managers who did apply corrective measures are NordPass, Dashlane, Keeper, Protonass and Roboform. Of course, this list can vary at any time if other companies publish arrangements after the dissemination. Extension of password manager for the browser The manufacturers reaction was disparate. Socket points out that 1Password and Lastpass classified the ruling as “informative”, a category that usually implies absence of immediate changes. Bitwarden, ENPASS and Apple (Icloud Passwords) confirmed that They work in updateswhile Logmeonce did not respond to contact attempts. Some companies admitted the existence of risk, but related to external vulnerabilities at the sites visited. While some developers decide how to act, Toth and Socket team agree that there are practical measures to reduce exposure. One of the most effective is to deactivate the manual self -fulfilling and resort to copying and paste. It is also recommended to configure the automatic filling only for exact URL coincidences, preventing it from working in subdomains. In chromium -based browsers, the use of the extension can be limited with the access option “When clicking”, so that the user explicitly authorizes each use. The researcher shows how it is possible to overlap invisible elements on the page to deceive the user and press the password manager without realizing it Not everything is as immediate as clicking and losing everything. For the attack to succeed, the extension must be unlocked, the browser has not restarted and the user interact at the right time. In addition, the analysis focused only on eleven extensions. There is no evidence that All solutions The market is vulnerable, although the expert warns that the pattern can be repeated in other types of extensions. The weak point is in the SUNthe internal structure used by websites to organize buttons, forms or menus. Password managers insert their elements there, and if a malicious page manages to move them, hide or force them, the user can end up clicking without realizing it. That same risk extends to other extensions such as cryptocurrency wallets or notes applications. Images | Xataka with Gemini 2.5 In Xataka | How to change all our passwords according to three cybersecurity experts

The most common and insecure passwords in the world, exhibited in a graphic developer

by

Passwords They are a headacheand so it is just as it should be. We have more and more applications that require a password, something fundamental because in many we have associated payment data, but the Statistics evidence that, as much as there is Key managers And security gaps, we still do not give them the importance they deserve. In fact, every year ‘12345’ remains the most used password. It is not the only password that can be burst in seconds, but that we insist on continuing to use. And this graphic exposes it perfectly. Usual suspects. Prepared by Visual Capitalist With the data of NordPassin the upper graph we have the 25 most common passwords worldwide for 2024. To anyone’s surprise, ‘12345’ is the most popular, used more than three million times (according to the accounts of this service, so it can be many more), but it is accompanied by some consecutive numerical series a little longer, by the classic ‘password’ or by the first row of the keyboard, with more or a shorter length, but always left, but always left, but always left, but always left, with a length right. Passwords such as ‘Dragon’, ‘Monkey’ or ‘Iloveyou’ also appear, or the classic ‘Secret’. There are some that combine numbers and letters that, according to recommendations, give more strength to the key, but are such simple combinations that they do not make a difference in security. Burst in a second. Where do these passwords come from? Precisely, of a 2.5 TB database (which is said soon) that Nordass analyzed because they were credentials exposed in different security gaps. And beyond the number of times these unsafe passwords appear, what attracts attention is the time someone would take to burst them. You don’t have to be hacker to skip those passwords, and NordPass points that 25 can skip in less than a second. Of the most used, you have to go to the 28th place with ‘Target123’ to see that it would take nine seconds to crack it, ‘Tinkle’ would take two minutes and the first “safer” (Note the quotes) would be ‘Zag12WSX’, which would have been more or less and that it came out more than 90,000 times in different data leakers. Curiosity: Do not use Pokemon ‘like 45,776 people,’ Starwars’ as 34,427 or ‘Batman’ as another 24,638 people exposed because they are also bursting in less than a second. Spain and Latam without getting out of the line. Those are the most used worldwide, but something curious, and useful, is that we can filter through countries. If we look at Spain, ‘123456’, ‘123456789’ and 12345678 ‘are the three most used, but’ Spain ‘is the fourth and is somewhat safer. It would barely take that password that appeared 7,349 times in data filtration. ‘Spain’ would also take a couple of minutes and then there are some curious such as ‘Barcelona’ or ‘Alejandro’. Interestingly, if you have ‘Cristina’ as a password, it would take three hours to skip it. In Mexico the popular are identical to those of the rest of the world, but we have more insecure variety such as ‘Pokemon’, ‘Pass’, ‘Alejandro’, ‘America’, ‘Hello’ or ‘Carlos’. In Chile and Colombia, ‘Chile’ and ‘Colombia’ are among the most popular. In general, the list is quite curious, with “safe” passwords such as ‘111222Tianya’ in China or ‘Tkideltki’ in Taiwan, taking the Crackers one day to skip both. And return to recommendations. Six of the ten most used passwords are purely numerical and with extremely predictable patterns. Precisely, the trick to create a good password It is to use numbers, symbols and capital letters and lowercase with at least 12 characters. To do this, we have at our disposal programs that generate and manage these passwordsbut we can also take precautions changing the keys to timeuse Two -step verification methods whenever possible and take the habit of not reusing passwords. In Xataka | Beware of aircraft wifi: there are scammers that create false networks on flights

The filtration of 16,000 million passwords would be the largest in history. If it weren’t because it’s a gigantic refrito

by

A team of CYBERNEWS researchers He has discovered A large library with 16,000 million filtered passwords. That would be long the theft of credentials in history, but it has not been. That library is actually a compilation of 30 large sets of data already filtered in the past. Should I reassure us “just” that? Enough, but not quite. It is not a new massive theft of data. Cybernews researchers do not show their sources, but they point out that this is in essence a compilation of “supermassive data sets containing billions of credentials.” In those leaks – ancient, but it is not known how much – data appears that according to Cybernews come from Google, Facebook or Apple users. Again, without offering evidence of it. They explain that none of these data sets had been discovered before, except for one with 184 million credentials that They mentioned in Wired At the end of May. But it is still dangerous. The problem of a compilation like this is that it can serve as a great starting point for all types of cyber attacks. It is very likely that in that large database there will be a significant amount of duplicate credentials. No one has stolen data from Google, Facebook or Apple (recently). Although media such as cybernews or forbes talk that there are credentials of these platforms, again if any will be belonging to old data theft – which Of course Yeah There has been-. There have been no robberies (much less massive) of credentials in these companies recently, and if there were them, they should have made a communication responsible for the incidents – in the US the US is used FORM 8-K OF THE SEC– They can affect their businesses. Should I be worried? Relatively. It must be aware that these data theft give access to cybercriminals to millions of credentials (user and password) in all types of services, and they can gain access to our accounts in those services thanks to them and then attack them or use them as the basis of other attacks. But this is true every day, not only when a new security filtration appears. Have Ien Pwned is a useful service that allows us to enter an email address to check it with the databases of previous data theft. A curiosity here: the number of accounts hacked on this platform is almost 15,000 million, very similar to the one indicated in Cybernews. Check if you have hacked you. There has been a simple way to check if our email and password has leaked in any of these data theft. THE SERVICE HAVE I BEEN PWNED allows us Do it quicklyand here we have discovered something interesting: the database with which this platform works has almost 15,000 million accounts hacked in its registry. Almost the same number they are talking about in Cybernews, as if their great library was in essence the same one that has this service created by Troy Hunt cybersecurity expert. And acts accordingly. When introducing your email, services may appear in which your account may have been compromised. What you should do in case this happens is to change your password as soon as possible in those services, and, if possible, strengthen the security of that password. There are several methods to do so: you can create a strong passworduse a Password manageruse the two -step authentication “Specially recommended,” or even make the leap to the passkeys If the service allows it. Be careful out there. Those measures that we talk about should not only be applied if we realize that something has happened, but before it happens. It is better to prevent than healing, and it is worth reviewing the safety of our accounts on the Internet, especially the most sensitive. The mail (Gmail, for example) is especially delicate, since it is usually used as a password rescue method in many other services. It is a good idea here to go to the tools that allow verifying the security status of our accounts to reinforce it if possible. Google, for example, Maintain a control panel which we can access at all times to configure what is necessary and Avoid scares after. In Xataka | The old dream of the cybersecurity of the future has just come true: Microsoft corner finally the passwords

Microsoft Corner finally passwords

by

Passwords have been the entrance key to our digital life for decades. But his reign is in decline. Not only because of the safety risks that they entail when they are used alone, but because more modern, effective and easy to use alternatives have emerged. The Passkeys They are the great commitment of the industry to replace them, and Microsoft has just taken a decisive step to make this a daily reality. Create an account without defining a key. From now on, anyone can create a Microsoft account without having to establish a password. And it is not a secondary option: it is the new default behavior. We have tried it and the process is really simple. By accessing account.microsoft.comjust press in “log in” and then “create one right now.” An email is requested as a verification method, the code sent to that email is introduced and we are offered to “log in with the face, fingerprint or pin”. Neither trace of fields to write complex passwords nor arbitrary requirements. When continuing, a passkey is generated that is automatically saved in the device manager, such as Icloud Keychain in the case of Safari, or in the browser itself if we use Edge or Chrome. Passkeys are placed in the center. This change is part of a broader strategy that Microsoft has developed together with the Fido Alliance and other great technological ones. Passkeys are cryptographic keys based on open standards, designed to offer faster, safer and more resistant access to Phishing. Instead of storing a password on a server, what is saved is a public key. The private key, the one that authentic the user, remains on his device and is never shared. Thanks to this design, the passkeys eliminate the classic attack vectors. There is nothing to intercept, steal or guess. And the best thing is that they work with a single gesture: unlock the device as we do daily. What Microsoft says. The company ensures that Almost a million passkeys register every day in their services. And their internal figures reinforce the bet: users who log in with Passkey have a 98% success rate, compared to 32% of those who try with password and two steps verification. In addition, log in with Passkey, they claim, it is up to eight times faster. “We believe that a good user experience and good security go hand in hand,” says Microsoft. In fact, its new registration and login flow always prioritizes options without password. If it detects that the user already has a passkey or an alternative authentication system configured, he will use it by default. The classical password only appears as the last resort. In internal tests, this experience has reduced the use of passwords by more than 20%. A transition underway, but with nuances. This is not the immediate end of passwords, but the beginning of its decline. Although Microsoft maintains the possibility of using passwords in existing accounts, it encourages users to eliminate them from the configuration. In parallel, it works to minimize its use in each login. In any case, the comfort of the Passkeys should not make us forget an important point: you have to know where and how we store them. If all synchronized devices are lost, we will need to have configured recovery options (if available in the service we have chosen to store them). An response to the rise of cyber attacks. The industry moves because the attackers also do it. According to Microsoft, password -based attacks exceeded 7,000 attempts per second last year, more than double than in 2023. As the passkeys adopt more, the focus of the attackers is concentrated in traditional methods. Fido Alliance esteem that more than 15,000 million accounts can already use Passkeys instead of passwords. But there is still on his way. The adoption is growing rapidly, with companies such as Google, Paypal, Shopify or Yahoo! Japan implementing these access keys in their systems. Change of era. Passkeys are not just a technical advance. They represent a cultural transformation in the way we understand digital security. A more fluid experience, without keys to remember, without codes to introduce, although still with pending improvements. Now, with Microsoft as one of the most active drivers, it seems that the era without passwords is closer to consolidating. Images | Microsoft | Screen capture In Xataka | How to change all our passwords according to three cybersecurity experts In Xataka | It is possible that your favorite Chrome extension is sold to a third party and turns it into malicious: it is increasingly frequent

How to change all our passwords according to three cybersecurity experts

by

Passwords have become an essential part of everyone’s digital life. In combination with other verification methods, They are the entrance door to almost all the digital services we use. We need them to make online banking efforts, but also to log in to email accounts, social networks, streaming platforms or online stores. Like house keys, passwords must be well protected to avoid dislikes. But sometimes it is not enough to save them well: there are times when they should change them or reinforce security with additional methods. The question is when. In Xataka we have asked three cybersecurity experts to clear doubts and know what decisions we should make. The problem of security gaps Francisco ValenciaCEO of the Computer Security Company Secure & Itopened the conversation with a blunt phrase: “The user has to think that passwords Sooner or later they will expose themselves” What the expert tells us is relevant, because we usually navigate this increasingly digital and interconnected world without being completely aware of the threats that surround us. Valencia explains that the exposure of our passwords, or what is the same, that they have been committed or revealed, can occur in two ways: that they rob us directly or subtract them from the services where we have registered them. When we register in some online service, this should protect our authentication data, however, as the specialist points out, it is often not so. To illustrate it, the interviewee remembers Yahoo’s case. In 2013, with Marissa Mayer in front, the company starred in a colossal security failure, considered by many as one of the largest in history, which exposed the data of 500 million accounts. The platform “It seemed reasonably safebut the passwords were stolen and informed the users years later, ”he says. “The user has to think that the passwords sooner or later will be exposed.” Alejandro BotterCyber ​​Security Evangelist of Check Pointreveals that “it is increasingly common for a data gap to present.” The expert indicates that these types of scenarios where there is some type of data exfiltration can occur in any field, from a hotel to a bank, although the latter should, in theory, have more robust security measures. While the leaks of our passwords by those who are trusted are a reality, Botter warns that the most traditional security threats, those in which we deliver our passwords involuntarily, are still very present. “We might access a site that was not correct And let’s leave our password, or that the device will be infected, ”he explains. It also emphasizes that awareness is essential to understand that cybercounts not only pursue important objectives, but any white can be. “Many people say: ‘Where will my email be? I don’t think it’s my turn. ‘” In this regard, he mentions that tools such as “Have I Been Pwned? “The reality of information leaks account very palpably. Asked about whether we should trust the page created more than a decade ago by the Australian security consultant Troy huntBotter highlights the positive aspect of the platform, but says that “there is debate about it”, and that we do only email We are providing information that “it is achieved in different ways on the Internet and that is not so complex to achieve.” What are we wrong with our passwords? Adrián Arrow, cybersecurity technician INCIBE- Certhe tells us that “for years, passwords have been the main method of access to our accounts, but also represent one of the greatest security risks.” The specialist of this Spanish Institute adds that “the reality is that most users reuse keys, choose weak combinations or fall into phishing attacks.” Valencia supports this perspective with a practical example: “When we make an audit and, for example, we find a password of a person’s tennis club, it turns out that looking for password password We see it in another pile of sites because that same user has put the password on all sides. And that makes criticism even greater. ” The CEO of Secure & It emphasizes that one of the most critical problems of password reuse is that, generally, they end up leaking by the weakest link. Since the user has used the same set of characters in other services, many times together with the same email address, he ends up exposing all his accounts in a way that would not have occurred in case of using different passwords. “The reality is that most users reuse keys, choose weak combinations or fall into phishing attacks.” “Passwords cannot be the same in all sites. People many times have two passwords, the easy and difficult, and It turns out that it puts the difficult at the bank And something else and the easy thing in everything else. The password cannot be the same, it has to always be different, it has to be random, it has to be difficult to remember, etc. ” This, he explains, will force us to use a password management tool The interviewee adds some quite useful examples: “Knowing the exhibition, if they steal a password, they will exclusively attack the service where I put it. The Facebook password steals me, it will only affect Facebook, but not anything else. Until now the gravity is that if the Facebook password is stolen, it turns out that it is also for my bank and therefore the exhibition is much worse. ” Users usually ask if using a password manager is a good idea. Arrow, from Incibe, explains that “password managers are one of the safer and practical tools PARA store and manage our access credentials ”, and highlights some of its advantages. It lists that they not only serve to store passwords, but are also useful for generating them. “While no technology is infallible, a well -designed manager offers much more security than scoring paper passwords or trying to remember them all. Currently, there is no manual alternative that is so safe and practical. There are cloud and local versions (without connection), but … Read more

Log In

Forgot password?

Forgot password?

Enter your account data and we will send you a link to reset your password.

Your password reset link appears to be invalid or expired.

Log in

Privacy Policy

Add to Collection

No Collections

Here you'll find all collections you've created before.