25 Comments

Summary:

With both the iPhone and Mac address book syncing to Google or MobileMe, your address book data can be hacked without access to your actual phone. It’s time to think twice about what you store in your address book.

address_book_thumb

With recent security flaws found in both the iPhone and Android platforms, and the numerous iPhone apps which can scan your address book, your private and confidential contact information is at risk. With both the iPhone and Mac address book syncing to Google or MobileMe, your address book data can be hacked without access to your actual phone. It’s time to think twice about what you store in your address book.

This is especially important if you, like many people, store information like credit card numbers and passwords in the address book. Ideally this private information is stored in a separate app on your iPhone such as one of these Weldon reviewed. However, not everyone is going to do that, and I have a possible compromise for those who want to store sensitive information in their address book.

The basic technique is to hide the sensitive data in plain sight, as part of what looks like just another ordinary contact. While it sure makes life easier to store your American Express card number under “American Express,” it also makes it easier for a criminal. If you absolutely need to store a credit card number, don’t be so obvious about it!

For credit cards, I suggest filing under a false name that only you know such as “Dave AX Smith.” Then use your own scheme of hiding the number as a combination of the street address and phone number, possibly across multiple contacts. I’m not going to tell you my exact strategy for storing this information, but it’s something I know and use for multiple credit cards. In this example, it’s an American express card with a number of 123456789012345 with an expiration of 09/12.

Here’s the way the card looks. It would be very unlikely someone browsing the address book could figure out it is a credit card.

A variation of this scheme can be used for passwords to websites or other sensitive information. If you think your address book is private, it’s time to get over that fallacy and take steps to protect the data within. While you may not choose my exact method, please be aware of the risks your address book is subject to and come up with some way of obscuring the data. If you don’t want to use a separate app for storing sensitive information, that’s fine, but I’d suggest you consider this middle ground.

  1. You are nuts! Simple answer store sensitive data in app designed for that. I recommend 1password.

    Share
    1. Well put Ed. Why would anyone consider storing sensitive information in a vulnerable store? And now that the “obscuring” idea is out, not much better of a solution….. 1Password (preferred) or mSecure.

      Share
  2. Sigh…

    Storing sensitive information in plain text (read, no encryption) is a horrible idea.

    In my opinion, this blog post is irresponsible and should be removed immediately.

    Share
    1. I agree with you it’s generally a bad idea to store things this way . However, people will still do it.

      At least this is a middle ground way of keeping that information at least somewhat obscured. I’d love to live in a world in which people didn’t write down their passwords on sticky notes, used a different password for each site, etc. etc. Until all join this vision, at least this is a way of moving them all one step closer to it.

      Share
      1. I would agree that this is largely an irresponsible post and suggestion. Using things like 1password or even the built-in keychain using secure notes for OSX are more appropriate options.

        This falls into the category of just because you can doesn’t mean you should.

        Share
      2. I do understand you mean well, but I still respectfully disagree. I know this was meant as a free/easy compromise for storing information, but I really think those of us with more knowledge should be pushing folks toward a solid solution rather than offering security compromises.

        My argument? How much is that information worth to you? How much financial damage can be inflicted if the information is stolen or accessed? How difficult will it be to clean up the mess? There are no clear-cut answers, but you can bet it won’t be a pleasant situation. Spending around $50 (for 1Password) to secure that information on your computer or phone is pretty cheap insurance.

        Is it really worth taking the free option which only hides the information in plain view where it can (relatively) easily be parsed and stolen?

        My father was fond of saying, “Do it right, or don’t do it at all”. I think that applies in this case :-)

        Share
      3. If I understand you correctly, your thesis is that people are too lazy to install an app that secures their sensitive information but they’ll expend time and effort to invent their own cipher!?

        Share
  3. This raises the question why would someone want to put their credit card numbers in an address book record in the first place?

    Share
    1. Because they ran out of Post-It notes?

      Share
      1. That comment has to win an award!

        Share
  4. Jeez, talk about an over-reaction…the author isn’t saying you SHOULD do this, he’s saying, IF you have this stuff in plain text (which a lot of people do, here’s a better way to do it — I help friends with their Macs all the time and it shocks me how many of them just have credit card numbers and such “loose” in the address book.

    Ironically, if done well, hiding data in plain sight like this, but well-obscured is actually fairly decent security (assuming it is not obvious).
    It’s no different then the old trick of hiding a secondary message in an otherwise innocuous letter.

    Share
  5. Dave:

    This is a great example of thinking outside the box. Apps that advertise security are (1) targets for hackers, and (2) vulnerable since their algorithms are public (regardless of how secure they seem). Using the Address Book with a personal “cipher” is much less immediately crackable since there is no public algorithm. Undoubtedly the Achilles heel is the effort the individual User puts into “encoding” the data but it’s definitely an interesting proposition.

    Share
    1. Like I said at the beginning of the post “Ideally this private information is stored in a separate app on your iPhone such as one of these Weldon reviewed.”

      I hadn’t really considered the fact that password storage programs would be a ripe target for hackers, but should there ever be a flaw in any of those programs, you make a compelling argument to create a personal cipher like I offered.

      I think EVERYONE agrees, that plain text storage of information in your address book is a horrible idea! Unfortunately people do it. I can’t tell you the number of people I see with a text file in their documents folder called “passwords”. Arrrgh. It burns my eyes.

      Share
  6. I doubt this would blow anyone’s cover, but has anyone noticed that “Dave Smith’s” ZIP code in the displayed example has six digits instead of five?

    Share
    1. Ah…you see I have a digit in there so I know what the data is, but you may not know which digit is truly “fake” and what it represents. Also someone would know Lawrence Kansas isn’t that zip. Perhaps I’ve said too much.

      Share
    2. Seems to me that the leading zero in the zip code should not be there, not only because zips are five and not six digits, but also because the lone zero in the credit card number already appears at the end of the “house number”.

      Share
  7. Password sharing, writing down passwords and unpatched systems are the most insecure for everyone. The security control of obscurity can be effective if you DON’T SHARE your message hiding strategy with others! Harriet Tubman, abolitionists and slaves used this obscurity strategy to hide life or death information in the underground railroad for over 40 years; They were never compromised. :-) See blog: http://clarkthoughtleadership.blogspot.com/2009/11/my-first-it-security-aritcle-published.html

    Share
  8. but that’s the other big problem… too many people are unwilling to create a truly secure password even for apps that hold all their sensitive info. they refuse to even attempt to commit a string of 8-10 or more random characters to memory, acting like it’s some monumental task that will hurt their brain. i have 4 random alphanumeric passwords of around this length. i forced myself to remember them. if you can remember your own phone number this shouldn’t be any different.

    Share
  9. Jesus, this is crazy. I understand that people do it. They don’t read these websites (I hope) if they do, they would really benefit from a horror story and the post with dedicated apps. But what will this accomplish?

    Why not just not store credit card info (with the exception of the phone number in the back, that can go in plain sight) at all anywhere. And remember your darn passwords. If you can’t, use a dedicated tool.

    You say, you won’t reveal your exact strategy? Are you crazy enough to use this?

    Share
    1. It’s frankly laughable. The same kind of idea that comes from inept senders of emails warning about new fraud methods… Some people really need to be sacked.

      Share
  10. A basic cypher can easily work better than 1password for example if you have a 1password file someone can steal it (or your keychain) then spend time cracking it. If you hide information in plain site with the cypher only in your head it is way more secure than a password system as nobody knows what file (or files) are hidden data and what are just normal files.

    The example in this article is fairly basic but I have used something similar and it works fine. Another example is using numbers disguised as letters using the code from a touchtone phone you can then convert someones name into a digit passcode.

    Hidden in plain site your normal data hacker will just pass right by it. Yes it has flaws but people calling it irresponsible are overreacting, I would lay a years wages the fact that my in plain site reminders would not be found if you went through my hard drive as they are a mixture of different codes and personal knowledge without knowing both even if you found the off strange number or word combining them together would be an impossible task (even with a computer).

    I would not recommend storing long or detailed information in plain site but to say that it is insecure and a security risk is untrue just like using 1password is not secure by default. They both depend on the user, for example my use of this system is a lot more secure than someone with 1Password and their user login password stuck on their machine with a sticky note!

    Share
    1. I’m loving it. Logs of ideas of how to store information and I’ll definitely be using some of these ideas in the future for my own data storage. I have seen people do that number to letter conversion before.

      Share
    2. If you are smart enough to work out a cipher for storing your sensitive data in plain sight (steganography) why can’t you memo rise the information?

      Just write down your password etc and keep it somewhere safe.

      This whole store it in plain sight using a cypher is plain stupid. What do you think an 256 bit AES encryption codec does?

      Share
  11. There are 1918 cards in his address book. All credit cards?

    Share
  12. Thanks for answering my question as to why I needed my old computer as back-up for my iPad. I have questioned everyone at Apple as to why, why,?? I bought the iPad to replace my old computer and found out I still needed the old, old, computer. I am 78 years young and wanted to get rid of the ancient mariner.

    Thanks for the explanation.

    Mary Parry

    Share

Comments have been disabled for this post