{"id":5307,"date":"2023-05-30T14:20:00","date_gmt":"2023-05-30T14:20:00","guid":{"rendered":"https:\/\/advisorator.com\/members\/?p=5307"},"modified":"2023-05-30T00:29:54","modified_gmt":"2023-05-30T00:29:54","slug":"5-30-2023-whos-afraid-of-the-dark-web-2","status":"publish","type":"post","link":"https:\/\/advisorator.com\/members\/2023\/05\/30\/5-30-2023-whos-afraid-of-the-dark-web-2\/","title":{"rendered":"5\/30\/2023: Who’s afraid of the “dark web?”"},"content":{"rendered":"\n
\"\"\/<\/figure>\n\n\n\n
\n\n\n\n

Hey folks,<\/p>\n\n\n\n

As I mentioned earlier, I am on vacation for the next couple of weeks, so these next two newsletters will look a bit different than usual. For this week’s issue, I’m excited to publish a story by Ed Bott<\/strong>, a veteran tech journalist who writes the Read Me newsletter<\/a> and recently authored a whole book about Windows 11<\/a>.<\/p>\n\n\n\n

The first time I recall seeing Ed was at a Microsoft conference in 2011, right after the company announced Windows 8. I was still pretty new to the tech journalism world, and when I spotted Ed holding court at a get-together for the press, I was too intimidated to actually say anything to him. (This is the first time he’s hearing this.)<\/p>\n\n\n\n

All of which is to say that I’ve admired Ed’s work for a long time, and this story of his falls into one of my favorite categories: It’s about something you probably don’t need\u2014in this case, “dark web monitoring”\u2014rather than something you absolutely do.<\/p>\n\n\n\n

Take it away, Ed!<\/p>\n\n\n\n

\n\n\n\n

The security software industry wants you to be afraid of the “dark web”<\/h1>\n\n\n\n

An industry whose very existence is predicated on selling fear has found a new bogeyman.<\/h3>\n\n\n\n

By Ed Bott<\/strong><\/p>\n\n\n\n

These days, credit card companies are falling over one another to offer perks that differentiate them from the competition. And as part of the benefits that come with my Chase Sapphire Preferred card, I get occasional reports about my credit score and activity on (pause for dramatic effect) the \u201cdark web.\u201d<\/em><\/p>\n\n\n\n

Below is an email Chase sent me recently. The tone can be paraphrased as \u201cNothing to be alarmed about, sir, but perhaps you want to climb into your fallout shelter before you click this link.\u201d<\/em><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

You won\u2019t believe what happened next.<\/p>\n\n\n\n

Clicking that link sent me to the Chase website, where (after signing in) I was presented with a \u201cDark web alert\u201d webpage that informed me my email and password from a \u201ccompromised website\u201d had been found somewhere online. The report was \u2026 not exactly filled with technical details. See for yourself:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Basically, this says \u201cWe have no idea where this information came from. Sorry.\u201d<\/p>\n\n\n\n

So, what\u2019s going on here?<\/p>\n\n\n\n

I must admit, I was baffled by this one. That snippet of a password doesn\u2019t resemble anything associated with the email account in question. Nor does it help that this \u201cdark web report\u201d doesn\u2019t provide even a clue as to where this sketchy information is from or what website or online service it might be related to. I looked through several lists of known data breaches from the past year or two and couldn\u2019t find anything that matched up with this.<\/p>\n\n\n\n

Eventually, I hit on a strategy. I exported my 1Password file (usernames and passwords only) to an Excel worksheet to see if I could find any password I had ever used that included the segment shown in this email message. Surprisingly, it worked. I had indeed used that email address and a password containing those three letters to sign in to my LinkedIn account.<\/p>\n\n\n\n

(If you try a similar strategy, make sure you save the exported password file to a local directory and then permanently delete it after your check is complete.)<\/em><\/p>\n\n\n\n

But I changed that password in 2012. No, that is not a typo; I really did that more than 10 years ago<\/em>! That happened right after LinkedIn reported that their accounts database had been hacked<\/a>. (I found that detail because my password manager helpfully added a note documenting every password change.)<\/p>\n\n\n\n

Those LinkedIn credentials have been bouncing around the Internet for roughly a decade, and I guess the file got dumped to a new site recently, leading to this alert.<\/p>\n\n\n\n

It\u2019s all horribly misleading, though. That sketchy alert implies that my email account has been compromised and recommends that I change my email password<\/em> to make it more secure. Why should I do that? This set of credentials wasn\u2019t associated with that email account; the email address was simply serving as a username for a completely unrelated service.<\/p>\n\n\n\n

In my considered opinion, sending notification of a compromised set of credentials from a data breach that happened more than a decade ago isn\u2019t exactly an \u201calert.\u201d I\u2019m sure the Chase marketing people who partnered with whatever company is providing this data believe they\u2019re providing a valuable service, but all they\u2019re really doing is adding noise to an already cacophonous security soundscape and encouraging me to waste a lot of time changing passwords that don\u2019t need to be tampered with.<\/p>\n\n\n\n

But here\u2019s the thing: If I didn\u2019t know enough to figure out that this alert was very old news and not an indication of a real problem, I might be impressed that the credit card company was looking out for my online security.<\/p>\n\n\n\n

I wrote about this phenomenon nearly two decades ago, in a 2005 post titled \u201cThe security software industry wants you to be afraid.\u201d (Here\u2019s an archived version<\/a> of that post, in case you feel like reading about online security in the age of Windows XP.) A fellow tech journalist had written a glowing thank-you note to the maker of his Windows PC for installing commercial antivirus software on his computer, which they did to collect a commission from the software maker. That software in turn had popped up a warning message that made him believe the software had detected a nasty piece of malware and saved his PC from infection. But it was a false positive and there was no threat there at all.<\/p>\n\n\n\n

\n

Joe feels good because the software told him it had protected him, even though the likelihood that this was an actual attack is microscopic. The lesson that Joe is unwittingly sending to the vendors in question is, \u201cGive me more false positives, because the more times you tell me you\u2019ve protected me from something, the more I\u2019ll feel like I\u2019ve gotten my money\u2019s worth from your software.\u201d<\/p>\n<\/blockquote>\n\n\n\n

Meanwhile, back in 2023, when I went looking for security vendors selling dark web monitoring services, I found the usual suspects (Norton and McAfee at the head of the list) along with a surprising number of companies serving enterprise customers. CrowdStrike<\/a>, for example, says \u201cWho Needs Dark Web Monitoring Services? The short answer: Everybody.\u201d Which is a pretty bold growth hacking strategy, I guess.<\/p>\n\n\n\n

There might be a case for enterprise IT folks to pay someone to monitor underground sites for early signs of data breaches or intrusions. But do consumers get any value from this info? I\u2019m skeptical.<\/p>\n\n\n\n

CrowdStrike, though, says I need to get busy:<\/p>\n\n\n\n

\n

What does it mean if your information is on the dark web? For consumers, the revelation that their information is available on the dark web usually means they should change all their passwords, keep an eye on their credit reports and consider replacing their credit cards.<\/p>\n<\/blockquote>\n\n\n\n

Uh, change all my passwords<\/em> and replace all my credit cards?<\/em> No. Thanks, but no.<\/p>\n\n\n\n

I regularly hear from readers who had a close brush with some sort of malicious software or phishing attack. In most cases, they tell me they responded by spending too much money on a security software suite that promises comprehensive protection from every imaginable threat. They were afraid, which made them perfect targets for companies that prey on their fear.<\/p>\n\n\n\n

Be afraid.<\/em> After all these years, that pitch still works.<\/p>\n\n\n\n

\n\n\n\n

Thanks again to Ed Bott for this column!<\/strong> Keep up with more of Ed’s writing by subscribing to Read Me<\/a>.<\/p>\n\n\n\n

Also, quick reminder that paid Advisorator subscribers get original advice columns every Tuesday, along with access to the full Advisorator archives. Some stories I’ve previously written for subscribers from the “stuff you probably don’t need” genre:<\/p>\n\n\n\n