Security

What if you had an emergency measure that could help you stay in full control of your data, even remotely? Wouldn’t that be nice, right?

Well, there is such an option and it is called a Duress code. In this article, we will talk all about it and help you understand the ins and outs of it. Hopefully, it will help you better understand how to securely manage your data and how to protect it in case of an emergency.

A Duress code is a special security measure that allows you to protect your data in case of an emergency.

This code, when entered, will trigger an alarm or some other action that will warn systems or anyone else that something is wrong, in danger or exposed to significant risks. How is this related with digital communications and chats?

Well, let’s say someone tries to force you to open your Kraden app and show your chat history. That’s very alarming, because it might expose your confidential info, private property, thoughts, possessions or everything in between. What you can do is enter your duress code. On Kraden, this will immediately wipe your account and everything stored on your device and the server (if an immediate connection is available). Your chat history, shared data and everything that was on your account will be permanently, irreversibly deleted from existence without any possibility to restore it.

This is a very powerful measure, but it’s important to remember that it should only be used in case of an emergency. Also, make sure to keep your Duress code confidential and don’t share it with anyone else.

Setting up your duress code is a very significant part of being safe while communicating digitally. Whether you’re talking about confidential business deals, putting your reputation at risk or trying to keep something a surprise, it’s worth keeping your duress code in mind, just in case.

To use the duress code, when prompted with the lock screen, simply enter the duress code instead of your passcode. After that is done, you’ll need to set-up a completely new account and re-purchase a subscription.

To enable the duress code on the app, go to settings area.

If an internet connection is available, it will also wipe your messages from the phones of other contacts.

Will delete and remove all of your data from the server.

Only use it when absolutely necessary. Evaluate the risks associated and keep in mind that the action cannot be reversed.

So, in conclusion, the duress code is a preventative security measure that is used in case of emergency. A duress code is to be used during a moment when your privacy is threatened with compromisation. If such a risk arises, enter in your duress code to trigger an alarm, a warning or for Kraden users – to wipe your entire account, keeping your privacy intact.

A duress code is a security measure that allows you to protect your data in case of an emergency event. When entered, it will perform security actions.

What Is a Duress Code (And How to Use It)? - Kraden Blog

What Is a Duress Code (And How to Use It)?

Kraden Blog - 404

Tutorials

When it comes to online privacy and security, two of the most commonly used tools are proxy servers and VPNs. Both offer similar functionality, but there are some key differences that set them apart. In this article, we'll take a look at proxy servers vs VPNs, and compare their pros and cons in order to help you decide which one to use and/or which one of them is the better option for you.

Proxy - What is it? How does it work? Pros and cons of proxy

A proxy server is a computer that acts as an intermediary between your computer and the internet. The dictionary defines a proxy as  “a person authorized to act on behalf of another person or organization.” In the case of proxy servers, they act on behalf of their users, forwarding requests from computers to web servers and returning the responses back to them. So, imagine a situation where you want to tell a secret to your friend John. However, instead of telling it directly, you tell the secret to a proxy, let's say another friend - Jane. Then, Jane tells the secret to John, acting as a proxy between you two.

When you use a proxy server, all of your internet traffic is routed through the proxy server before it reaches its destination. This means that any website you visit will see the IP address of the proxy server instead of your real  IP address.

When you set up a proxy server, you can choose to route all or only certain types of internet traffic through the proxy server. For example, you could set up a proxy server to only route your web traffic (traffic from your web browser) and not route your email traffic (traffic from your email client), so on and so forth. The proxy will communicate with your devices in order to either pick up and reroute traffic or stay still.

There are both advantages and disadvantages to using a proxy server. Some of the benefits of using a proxy server include:

More privacy: When you use a proxy server, your real IP address is hidden from the websites you visit. This means that you can browse the internet sort of anonymously, and your online activity cannot be tracked by your ISP or other 3rd parties. You separate your traffic from your personal internet subscription, if such an expression makes sense. This can be very beneficial in all kinds of environments, both personal and business.

Security: Proxy servers can also offer security benefits. For example, if you only route your web traffic through a proxy server, any malicious software that tries to infect your computer will only be able to do so by going through the proxy server. This adds an extra layer of protection. If you're interested in knowing more about company and business data protection in the current digital landscape, we wrote a blog on one of the most common types of attacks - exec phishing on our blog. Give it a read to get more acquainted with the topic - 

As with the pros, there are also some disadvantages to using a proxy server that you should know about.

Slower Speeds: Because your traffic has to go through an extra server, it can slow down your connection and reduce the bandwidth. This is especially true if the proxy server is located in a different country or far away from you. Keep this in mind if you're trying to collaborate on a document in real-time, share or download large files, play games.

Less Security than with a VPN: While proxy servers do offer some security benefits, they are not as effective as VPNs. This is because proxy servers only encrypt web traffic, whereas VPNs encrypt all traffic, including traffic from your email client, file-sharing programs, and instant messaging apps.

VPN - What is it? How does it work? Pros and cons of VPNs

A VPN, or Virtual Private Network, is a type of proxy server that encrypts all of your internet traffic and routes it through a remote server in another location. This means that any website you visit will see the IP address of the VPN server instead of your real IP address. Millions of internet users online have VPNs on their mobile devices, tablets or computers and use them for a wide variety of reasons. Here is a chart with three of the most popular ones.

In addition to this, nowadays, accessing Netflix and other streaming platforms, is definitely very close by as a category and in the top positions as well.

When looking at the frequency of VPN use, it just further solidifies our claim regarding its importance.

As we can see, half of VPN users use it daily or no less than 4 times per week.

Picking up where we left with proxy servers, we have to say that a VPN works in a very similar way. It encrypts all of your internet traffic and routes it through a remote server in another location. The main difference is that proxy servers only encrypt web traffic, whereas VPNs encrypt all traffic, including traffic from your email client, file-sharing programs, and instant messaging. Nevertheless, this isn't equal to total anonymity since your unencrypted traffic, rather than getting obtained by your ISP, is collected by the VPN service provider. So, on paper it's better but in practice, the genuine benefits are not as great as usually advertised.

Unlike proxy servers, which are often much more limited in their capabilities, VPNs provide you with a wider coverage. You can use a VPN to access websites and content that are not available in your country or region. For example, if you're traveling abroad and want to access your favorite streaming site, you can connect to a VPN server to make it look like you're in that location, instead of your home, work, etc.

So, let's say you're from the US and travel to the UK for 2 weeks. However, your favorite TV show is only available for streaming in the US. So, you turn on a VPN, access a US-based server and voila! You can watch your TV show.

Location switching is not the only reason people use VPNs. Another big one is security. When you connect to a VPN, all of your internet traffic is routed through an encrypted tunnel. This means that if someone were to intercept your traffic, they wouldn't be able to read it or see what websites you're visiting. This makes it a solid protection from many hacking and phishing actions, as well as even ad personalization.

These tools come with a few disadvantages as well. The first one is that they can slow down your internet connection, just like a proxy. This is because all of your traffic is routed through a remote server, which takes some time.

Another downside is that VPNs can be quite expensive, depending on the provider you choose and the features you want.

The main distinction between proxy servers and VPNs is that proxy servers only encrypt web traffic, whereas VPNs encrypt all traffic. This particular point that we're referring to quite often is the main differentiation. However, neither proxy, nor VPN service can grant you total anonymity online. They do a good job of hiding your true location and IP address, but it's still very much possible to track you, if someone has the resources and knowledge to do so.

Hence, you shouldn't stop at using proxy servers or VPNs to protect your privacy. Take it a step further and embrace tools like 

 for total anonymity when sending messages.

Why is Kraden way better than proxy servers or VPNs for messaging? Firstly, because it offers end-to-end encryption for every message sent. Secondly, Kraden never stores any of your data (it's zero-knowledge) and we never ask for personal info during sign-up! So, you're getting the best possible deal.

Kraden is also available as an app for users with Google Pixel phones, running GrapheneOS. What is GrapheneOS? Read our guide of GrapheneOS (

) to find out more about it - the most secure version of Android in the world!

If you're looking for a way to encrypt your traffic and hide your true location, proxy servers and VPNs are both good choices. However, they each have their own set of advantages and disadvantages that you should take into account before making a decision. In general, VPNs offer more features and better security than proxy servers, but they can be more expensive. It's up to you to make the decision.

VPNs have more features than a proxy, but they are more expensive. However, there are more pros and cons when choosing between a VPN or a Proxy.

Proxy vs VPN: What Are the Differences?

One of the hardest aspects of remaining in full control of your data is remote control. Being able to manage your data from a distance is a great innovation that adds much more security to how you can operate. One such remote control feature is the remote wipe. In this article, we’ll focus on the remote deletion of data on your phone. We’ll see how it works, what are the ins and outs of this technology as well as discuss how 

Remote wipe technology has been around for a while. The earliest implementations were used in large organizations with significant IT departments. They allowed remote deletion of data from company-owned devices. The technology has evolved since then and is now available to more users. It is most useful wherever it concerns your most sensitive personal info, hence – on operating systems and of course, social media, as well as messenger apps.

A remote wipe is a remote deletion of data from a device without having the device physically. In most cases, it refers to deletion of data from a mobile device, but remote wipes can also be performed on desktop computers, laptops, and other devices.

There can be quite a few different methods for remote wiping. One of the more practical and simple solutions is a dedicated website or a dedicated access point where you enter a code or a passkey and trigger the remote wipe. The service server then triggers the deletion of data and once your device connects to the internet, your data should be wiped as planned. The key is to have the device, which you’re trying to wipe, connect to the internet. In the past, it could’ve been more difficult, but these days, our phones probably spend 90% of the time connected to the web, hence remote wipe works quickly and effectively.

There are many benefits to remote data wiping. The first and most obvious benefit is that you can erase your data from a device if it’s lost or stolen. This is especially important if you have personal information on the device that you don’t want others to see. Or if you have something business-related that might be beneficial to your competitors or could harm your business.

Another benefit of remote data wiping is that it can help protect your privacy. If you have personal information on your device that you don’t want others to see, remote data wiping can help erase that information. If circumstances in your life or surroundings change, or if you’re facing pressure to disclose or show private communications, having the option to wipe data remotely is greatly appreciated.

Remote data wiping can also help protect your identity. If someone gets their hands on your personal information, they could potentially use it to steal your identity. By remote wiping your device, you can help prevent this from happening. Finally, in countries with stricter rules on censorship or a lack of freedom of speech, remote wiping can help keep you out of trouble. If at work or from home someone decides to confiscate your device, you can use this feature to protect yourself.

There are other benefits to remote data wiping as well, such as peace of mind and the prevention of data breaches. If you have remote wipe enabled on your device, you’ll know that your data is safe even if you lose your phone or it’s stolen. And if a data breach does occur, having remote wipe enabled can help minimize the damage that would be done.

How does remote wipe work on a Kraden messaging app?

As Kraden seeks to solidify its status as the world’s most secure messenger, having the remote wipe feature seems like a no-brainer. You can instantaneously wipe all of the data on your Kraden account, server, and device by visiting 

Each user has a separate, individual code for remote wiping. The code consists of unique and memorable words that can be used later on the website. Kraden users can access their code on the app by going to the remote wipe settings.

This particular feature provides the most hands-on data management experience. To have full control over your privacy, you should remain in control even when the circumstances change for the worse. Even in situations when your device is lost, stolen or threatened, you can quickly trigger the remote wipe and defend yourself from unwanted risks. If your device isn’t connected to the internet, the Kraden server will trigger the wipe next time your device establishes a connection. But what about when a device won’t go online for a very long time? Well, we’ve thought about that too, and have it covered. For prolonged periods of time without an established connection, inactivity wipe is triggered on the device, as well as the server.

Once you trigger the remote wipe, the action cannot be reversed or undone. Remote wipe is permanent, and you’ll need to re-purchase a new subscription code. This is the only way we can ensure genuine privacy and security for both our new and more experienced users.

So, to sum up – in case of a threat arising or when you are separated from your device, you can initiate a remote wipe. This action will remotely delete (wipe) all of the data on the targeted device. This is a great measure to prevent data leaks due to human error or whenever your device is stolen or lost.

A remote wipe is a remote deletion of data from a device without having the device physically. Remote wipes can run on mobile phones, desktops, etc.

What Is a Remote Wipe? Remotely Delete Your Phone

At Kraden, we always look for ways to improve our app and provide our users with the best experience possible. We're excited to announce Kraden Vault as a secure file storage addition to the Kraden app. From today, you can store all of your important files, create notes, and even take photos directly from the vault. Everything is in one place and secured with AES-256 encryption (

Let's look at the key features integrated into Kraden Vault and how it can improve digital privacy.

To continue improving our ecosystem, we decided to go on a path that would revolutionize the way files are shared on messaging platforms. By default, you would use a messaging platform, chat with your friends and family, and at some point, you'd download a photo. It sounds like not a big deal, right? However, most apps would send the image to your local device storage and keep it there. With this move, your photo or file is instantly accessible to hackers that hack your phone.

How is it different on Kraden? All your files will go directly to the vault secure file storage when sharing files. The storage is on the Kraden app, meaning files are not exported to your device. The vault has multiple-level security, such as AES-256 encryption, and prevents hackers or unwanted persons from accessing your files. Only you, having a key that decrypts the files, can preview them whenever you want.

Also, you can share all your files from the vault directly to your contacts, not needing to access your device files.

When making the vault feature, we wanted to ensure we got everything necessary. Let's start with the plus button on the vault's homepage.

By clicking the plus button, you will be able to perform these actions:

Notes are the best place to drop down your quick thoughts or save important information. Whatever is out there you need to store as a text is safe and sound. You can share the notes with others, rename, delete or even export them to your device as a file.

Do you ever think of securely storing files that are not yet on Kraden? Upload any file from your device directly to Kraden Vault. No more risks that hackers can hack your device files as they will now be on Kraden, with its security and unbreakable safety system.

When thinking of massive vault storage, it is essential to ensure that your files can be accessible at scale. We've prepared an infrastructure that enables you to manage your files, add them to folders, and reorganize stuff the way you imagine it.

Got a memory you want to catch? Or something significant that can be captured on a camera but still is very valuable and can't be shared anywhere else? The answer is there: on Kraden Vault, you can securely capture everything directly from your phone's camera. All the images will automatically appear on the vault without uploading them from your device.

With many experienced and security-first users on the platform, Kraden Vault is created with advanced actions in mind. If you're sharing multiple files at once or even looking for bulk reordering, starring, and deleting, we have you covered. There are all of the tools you need to organize the file storage the way you imagine it.

In conclusion, Kraden Vault is a secure file storage addition to the Kraden app that offers many useful features for improving digital privacy. With AES-256 encryption and multiple-level security, Kraden Vault allows users to safely store and share their files without exposing them to the risk of being accessed by hackers or other unwanted parties. Additionally, the app offers features such as notes, folders, and the ability to capture photos directly from the vault, making it a versatile and convenient tool for managing digital files. There is no better solution to explain something than trying it out yourself (

Secure file storage feature that lets you store all of your important files, create notes, and even take photos directly from the app.

Kraden Vault: Secure File Storage

Updates

Kraden is proud to announce the official introduction of additional passcode security layers, including optional biometric login on our app. From now on, your messaging experience will be even more secure. You will be able to access secure and private communications with other Kraden users by entering a secure passcode or, optionally, scanning your fingerprint.

Let’s take a look at our recent update and see how security will be integrated on Kraden and how it can improve the protection of your digital privacy.

To further solidify our claims of being a security-first platform, we decided to introduce improved and revised password requirements for all of our users.

Your passwords will now have to meet our standard security requirements to better protect your private communications including these on your passcode:

This form of password can be considered safe enough and almost impossible to crack. Even with state-of-the-art machinery, hackers would need many lifetimes to crack it, so such protection is necessary if you want to feel sure about your messages remaining private.

It is true that a combination of approaches might work better: lengthy and fairly complex passwords.

Lengthy – Short length passwords are relatively easy to break, so the idea is to create lengthier ones for added security and to make them less predictable. So what is the desired or required length? A 2010 Georgia Tech Research Institute (GTRI) study told how a 12-character random password could satisfy a minimum length requirement to defeat code breaking and cracking software, said Joshua Davis, a research scientist at GTRI (

). In any case, to be on the safe side, a password length of 12 characters or more should be adopted.

Strong and complex – Strong passwords are still key. Security experts agree that upper and lowercase alphanumeric characters are good practices for increasing password strength and making it capable of resisting guessing and brute-force attacks. In order to add complexity without compromising ease-of-use, users could modify passphrases by inserting spaces, punctuation and misspellings.

However, if you find inputting a long password too much of a hassle to type each time you enter our app, you can always turn back to the optional fingerprint unlock that we’re introducing with the update. More about it below.

When it comes to user identification and authentication, there are specific methods for doing it. These methods are called ‘Authentication Factors’ and they can be divided into 3 main categories:

As you can probably guess, inheritance is the most distinguishable and unique feature of a user since it’s the hardest to replicate, duplicate or hack.

You should know that your fingerprint is unique and you have the only one like that in the world. This makes fingerprints a great authentication factor for confirming a user’s identity. Hacking biometric data is just not realistic.

Google Pixel and GrapheneOS handling of biometric data

In the realm of secure Android smartphones, Google Pixel reigns supreme. In the world of secure operating systems, GrapheneOS is top of the league, beating its competitors and utilizing the top-of-the-range security practices and software solutions to protect the data of each device and its user (

In Android (on which GrapheneOS is based), biometric data is hashed, encrypted, and stored in TEE or Trusted Execution Environment without any possibility for exporting. This is the most secure location for such sensitive data to be stored. GrapheneOS takes it a bit further than base Android by permitting less attempts after failed authentication, making fingerprint scanning even more secure.

Kraden never has access to the fingerprint data. The app will communicate with the OS on a software level and your device’s operating system will inform the Kraden app whether the request (e.g. fingerprint scan) was a success or a failure.

On top of that - fingerprints are not available to the OS, it doesn't matter if an attacker obtains root access. Fingerprints are not stored directly in the first place. Fingerprints themselves are not stored. Fuzzy hashes of fingerprints are stored in the TEE and are never available to the OS.

Meaning that even if the OS gets compromised - fingerprints are still safe.

How is biometric data implemented on Kraden?

Your Google Pixel mobile device has a fingerprint reader on the backside or under the screen. With clever technology, it only takes a fraction of a second to process data, analyze your fingerprint, and determine the authenticity of the print.

Since it’s a very quick and very secure process, our users will be able to toggle between biometric authentication being on/off.

How to turn on optional biometric authentication on Kraden?

Toggle the “Fingerprint Unlock” feature on

Kraden will use the same fingerprint that's already set-up on your device. So, you should do that before toggling it on in the app settings.

Keep in mind that this authentication method is completely optional and you have full control over it.

Learn more about additional passcode security layer updates on Kraden, including optional biometric log-in.

Passcode security improvements on Kraden 1.17.0

Privacy

For most of us, spying is something we see in movies, TV shows, but rarely stop to think about in real lives. But, you should be aware of the fact that someone can be tracking certain metrics, logging internet browsing data, or remotely monitoring every single thing that you do on your phone. Most people don't think about the possibility of someone spying on their phone, but it is a real threat. There are many ways that someone can spy on your phone, from installing spyware to using a dedicated tracking app.

In this article, we're going to talk about how one can find out whether someone's spying, prevent attempts to install spyware or other similar software as well as get rid of it, if it's already installed.

People are aware that some kind of monitoring goes on. They know that both businesses and governments can benefit from spying. Regardless, private individuals rarely have full knowledge of the scope and the depth as well as actual implications of the spying. Let's look at some stats.

As we can see, 15% of adult Americans think that no one tracks them through their phones. Around 30 million people are completely unaware of the fact that exploiting digital privacy and spying has brought in millions for some and billions to big data companies. Facebook has been at the forefront of a lot of controversies, related to spying on its users. The most famous being the Cambridge Analytica scandal (

But that shouldn't distract us from the fact that Facebook is just the best-known example and probably the company that's been exploiting this the most. However, others do it too. Google and its partners like YouTube, as well as the likes of Twitter and Amazon (e.g. platforms with lots of users), collect and analyze heaps of information about you in order to maximize their influence and profits. Suggestions for content, personalized ads, and AI-fueled algorithms are the bread and butter of how they make a lot if not almost all of their money.

In one of our previous articles we've talked about this in-depth, so we won't go over bit by bit, but give a short, comprehensive rundown instead (

Trust in the government is high in only a handful of countries. In most parts of the world, people are generally not satisfied with the overall performance of their elected or appointed officials. Widespread belief of mass surveillance in almost half of the adult demographic can be linked with the very notable scandals of NSA & Edward Snowden as well as recent limelight that has been shining on China's social credit/score system, cameras in public places, etc.

Governments usually spy on your phone by the powers given to them by law. Simple as that. For example, it's likely that in your country, your mobile service carrier and/or ISP has, by law, to log your data and store it for 2-3 years or even indefinite amounts of time. If they want, they can put in a request with the carrier and they will be obliged to hand over all of the data that they have on you.

The UK has the 'Snooper's Charter' also known as the Investigatory Powers Act, which gives the government unprecedented levels of access to people's private lives via electronic surveillance.

Other countries are not to be left out either. Russia, for example, can legally intercept any electronic communications, including text messages, phone calls, and emails.

So if you really think that no one is spying on you, it might be worth rethinking it from a different perspective. Think about it this way - if someone can make money and gain power from spying on you and gathering information, would they be ethical enough to not do it? Do you trust them to make that decision? Let's leave it as a rhetorical question.

Let's move back to spying on your phone that you can know about and be in full control of. Let's talk about spyware. By default, spyware is seldom installed in your app from the get-go. Even though you can call apps like 'Find my Phone' some sort of spyware, it's in your control and they do provide more benefits than drawbacks. We're talking about malicious spyware that appears on your phone from your belief of trickery and fraud coming from cybercriminals or malicious actors, trying to commit crimes.

Malware (spyware is in this category) is a huge issue for mobile phone users. Each year, millions of new malicious apps are registered by experts.

Via third-party apps, downloaded from unofficial app stores or websites

You can infect your device with malicious spyware apps from unofficial app stores or websites. While the Google Play Store is pretty good at weeding out the malicious ones, it won't stop criminals from posting them elsewhere and disguising them as completely normal or even cutting-edge apps. So, if you're downloading an app from anywhere else other than the Play Store, be extra careful. Read reviews (if available), do a bit of research on the developer and make sure that what you're downloading is legit.

Phishing is a type of cyberattack where the attacker tries to trick you into giving them sensitive information, such as your password or bank details, usually through clever social engineering and fraud. They are able to lure away information successfully by disguising themselves as a trustworthy person or organization and sending you an email or text message that looks legitimate.

For example, you might get an email from your bank saying that there is an issue with your account and you need to log in through a particular link to fix it. Or it can also be a text message from your carrier saying that you've won a contest and you need to click on a link to claim your prize. Our advice would be to never click links through SMS messages and to avoid clicking links on emails that claim anything about urgency.

When your 'friend' messages you on social media

These hacks were pretty prevalent in the early 2010s, but now it seems that they're making a comeback. Your friend sends you a message on social media, saying that they found this really great video/article/app and they think you'll love it. The message is completely out of the blue but it usually comes from someone who's in your Facebook friends.

They include a convenient link to the content in the message. You click on the link and it takes you to a website or an app that looks completely legitimate. However, the virus can spread just like that and it can steal your login information, gather personal data and harass other users too. Our advice would be to not click links to untrustworthy websites from social media, especially if the message came unexpectedly with 0 context.

There are a lot of malicious ads and websites with malware all over them. Be extra careful when clicking on ads, especially if they're on a website with low domain authority. Avoid downloading files from sketchy sites too. Some tips to help you out:

If an ad looks too good to be true, it probably is.

Don't click on unknown shortened links, as you won't be able to tell where they'll take you.

Research the product/company before clicking on anything.

It's good that more and more sites are very wary of these issues and if you try to leave a platform with a link that takes you to another domain, the platform warns you about the possible risks. It's good to have it in mind.

When connecting to a public Wi-Fi network, be aware that there might be someone on the same network who is trying to intercept your data. This is especially common in public places.

If you must connect to a public Wi-Fi network, make sure you're using a VPN and not logging in to sensitive sites like social media, bank accounts, etc.

The worst thing about spyware on the phone is the almost limitless amounts of data a criminal can get their hands on. We do so much with our phones. We communicate, pay bills, run businesses, manage our insurance, can track medical records, and do much more. The vast information and data resources attract all kinds of criminals. They usually want to gather data that could be later sold or held for ransom. Still, it's worth knowing what's being targeted the most.

Any type of data that is stored on your phone unencrypted can be accessed and retrieved by spyware, including your communication history and contact information.

Especially, if you're an executive or a decision-maker, access to such information can be exploited by your competitors or regulators even.

There are also plenty of other data points that spyware could target, such as:

Why would spyware target it? This information is valuable to many criminals as it can be used for:

The best way is to install an antivirus app that can detect and remove any malicious software on your device.

How do these antivirus apps work and prevent spyware from taking over? The features can differ but the underlying basics should remain the same. Such apps usually have two features - a file scanner that checks every app you install for malicious code. It also performs periodic file checks for any changes and threats. Also, there's a real-time protection feature that monitors your device for any suspicious activity.

There are plenty of great security apps out there that can help you rid your phone of spyware. You can download and use them for free or upgrade for a premium membership at just a fraction of what it would cost to restore damages after an attack.

In short - prevention is the best form of defense.

End-to-end encryption - the best way to avoid spyware

We strongly recommend using end-to-end encryption for all of your digital communication. This way, even if someone is trying to spy on you, they won't be able to understand what is being said because they won't be able to read what's being said.

Kraden utilizes end-to-end encryption and relies on secure P2P connection establishment to help users communicate privately and securely. Throughout the sign-up process, you won't need to enter any of your private or sensitive personal information and can use our app fully anonymously. Check out more info on Kraden (

Spyware is a serious threat to our privacy and should not be taken lightly. Both businesses and governments do it (to a varying degree), not to mention black hat hackers and cybercriminals. There are ways to protect yourself, but the best defense is always prevention. Be careful what apps you install on your phone and only download them from reputable sources. Keep your software up to date and never click on links or attachments from unknown senders. And finally, use end-to-end encryption for all of your communication to make sure that even if someone is spying on you, they won't be able to decrypt what's being said.

Are you taking your online privacy seriously? Learn tips and tricks to tell if someone is spying on your phone and how to prevent it.

Is Someone Spying on My Phone?

Pretty much all of us know that hacking is a common practice. Unfortunately, not all hackers are ethical (e.g. 

). A large portion of them are criminals that exploit, steal or do other criminal acts in order to profit or benefit. One of the most common hacking threats are the so-called brute force attacks. In this article, we're going to look at what is a brute force attack, how it works, give you some examples of it and share tips and tricks for protection. Let's begin!

Brute force attacks - a simplified overview

A brute force attack is where a hacker uses an automated system or a bot to guess the credentials (e.g. password or personal identification number (PIN)) of a target individual or organization. The attacker tries various combinations of characters (numbers, letters, and symbols) until they find the right one that gives them access to the account or system. It's all about trial-and-error and isn't linked to sophisticated break-ins, clever hacking, etc. The best brute force attacks can be helped by social engineering. For example, the hacker can know your birthdate and then try and manipulate that information to guess your PIN number. Yet, in the end, they're very straightforward, nevertheless, still dangerous.

Interestingly enough, brute force attacks have been around for a long time. One of the most famous brute force attacks was conducted in the late 1970s against the US National Security Agency (NSA). Two cryptanalysts, Jim Gillogly and Steve O'Mara used brute force methods to break an NSA cipher. They managed to find a key that helped them read a message that was meant to be unreadable. They were the first people to do so and received a lot of media attention for it.

Another famous example of a brute force attack happened in 2017. In that year, a brute force attack was launched against the WordPress content management system (CMS). Over 10,000,000 brute force attacks were conducted per hour during the height of the attack and a whopping 1,000,000,000 sites in total were targeted. The aim was to brute force weak passwords and then use those to access sites and plant malware on them.

The cart shows how serious the attacks were, targeting tens of millions of websites each hour.

Nowadays, brute force attacks are still conducted on a regular basis. They're one of the most common hacking methods as they can be easily conducted by anyone with malicious intent and some basic technical knowledge. Brute force attacks can target individuals, small businesses, and large organizations - anyone can be a victim. It's not a new or innovative solution, but with the right targeting and clever social engineering alongside, brute force attacks can be super effective.

How to protect your personal data from brute force attacks?

Now that we know what brute force attacks are, how they work and some famous examples of them, it's time to focus on the protection part. Here are some tips and tricks on how you can protect your personal data from brute force attacks:

: This one is pretty straightforward. The stronger your password is, the harder it will be for someone to brute force it. Avoid using easily guessed words like your name, birthdate, etc., and opt for a mix of letters (upper- and lower-case), numbers, and symbols. Also avoid continuations or sequences like "123456", "ABCDE", etc.

We have a list of the 25 worst passwords of 2022.

Change your password ASAP if it's one of these. You can use special software for password generation and password storage. It can be beneficial to have one difficult password to access a database with all of your accounts rather than 50 accounts, all with the same password.

: Two-factor authentication is an additional layer of security that can go a long way in protecting your data. In short, 2FA adds an extra step to the login process by asking for a code or to accept a separate confirmation that's sent to your phone or email, further authenticating your identity. This means that even if someone brute forces your password, they won't be able to log in as they don't have access to your phone or email.

2FA/MFA is also widely used for financial operations, especially in the EU. Under current regulations, two-factor authentication is required to prove the authenticity of a request by any two of the three following factors: knowledge/possession/inheritance. Respectively, this can mean PIN codes/passwords, possession of a device, and biometric data. This has drastically reduced the totals of hacking and financial brute force crimes.

: Another great way to protect your data is by using a VPN. A VPN encrypts your traffic and makes it harder for someone to snoop on what you're doing online. This means that even if someone brute forces their way into your account, they won't be able to see anything as it will all be encrypted. Yet, VPNs aren't totally bulletproof and can be bypassed, so it's important to use other methods of protection as well.

: This is important for a variety of reasons, but brute force attacks are one of them. Outdated (legacy) software often has known vulnerabilities that can be exploited by hackers. By keeping your software up to date, you're patching those vulnerabilities and making it harder for someone to brute force their way into your account.

Take advantage of remote wipe and similar features

: Many apps and platforms these days have remote wipe features that allow you to remotely delete all of the data on a device or an app if it's lost, stolen, or compromised. This can be a lifesaver if your device is brute forced as you can simply wipe it and start fresh. We wrote an entire blog on remote wipe and its benefits for your privacy (

How can businesses improve their protection against brute force attacks?

Since we've covered how individuals should better protect their own data, it's also important to shift our attention to businesses as well. Brute force attacks can have devastating consequences for businesses, both small and large. A lot of it is the same as with your personal data, but there are also some different things to do. Here are some tips on how businesses can better protect themselves against brute force attacks:

: A firewall is a critical piece of security infrastructure for any business. It can help to block brute force attacks by blocking suspicious IP addresses and traffic patterns. Firewalls work by inspecting incoming and outgoing traffic and comparing it against a set of rules that are established by the developer and/or your IT personnel. If the traffic doesn't meet the criteria set in the rules, the firewall will mark it or outright block it.

Use strong passwords and password policies

: This is one of the most important things you can do to protect your business from brute force attacks. By using strong passwords and password policies (such as requiring employees to change their passwords every few months), you make it much harder for hackers to brute force their way into your systems.

Implement two-factor authentication (2FA)

: Two-factor authentication (2FA) is an excellent way to protect your business from brute force attacks. By requiring two forms of identification (such as a password and a code sent to your phone), you make it much harder for hackers to gain access to your account. This is because even if they have your password, they won't be able to access your account without the code.

Monitor your system for brute force attacks

: By monitoring your system for brute force attacks, you can quickly spot suspicious activity and take action to mitigate it. This includes things like monitoring login attempts, IP addresses, and traffic patterns.

What can you do if you know you're facing a brute force attack or was exploited by one?

If you know that right now you're facing brute force attacks or you know that your device has just been brute-forced, there are a few things you can do:

: This is the first and most obvious thing you should do. By changing your password, you make it much harder for the hacker to continue exploiting or to return.

: If you don't already have 2FA enabled, now is the time to do it. By requiring two forms of identification, you make it much harder for hackers to gain access to your account subsequently.

Contact service providers or your IT administrator

: Before panicking or doing something further, hold on a minute. If you know you're under attack or you've been brute forced, the best thing you can do often is simply to contact your service providers or your IT administrator. They'll be able to help you figure out what's going on and how to deal with it. Furthermore, they can address this to other people within your organization or implement patches & fixes to prevent this in the future.

What sites or services do brute force attacks target the most?

There are a variety of sites and services that brute force attacks target the most. Learning your password can be beneficial if you can also obtain access to information or permissions to manipulate, change something or take action.

Email is one of the most common targets of brute force attacks. This is because email accounts can be used as a key to change passwords on other platforms. So, it's like a secret key to your whole vault of personal information. Protecting your email credentials is very important.

Social media accounts are also targets for brute force attacks. Once a hacker has access to personal or business information, they can get financial benefits in exchange for the release of the account or even blackmail you.

Router admin panels are another common target of brute force attacks. This is because they're often left with the default or a weak password. By brute forcing the router admin panel, hackers can gain access to the router's settings and potentially redirect traffic or cut off internet access altogether. This is a sophisticated hack and is hard to defend against by an individual, but organizations need to address this right away.

Finally, WordPress is one of the most popular content management systems (CMS) in the world. Unfortunately, it's also one of the most popular targets of brute force attacks. This is because WordPress websites often have weak passwords and are easy to brute force due to their technical similarities. Hackers can then demand ransom, change the content, harm your business, blog, brand, etc.

Kraden - for private and secure communication that's protected from brute force attacks

We'd like to further address the fact that oftentimes, hackers target your social media accounts. Personal and group conversations on Kraden are private and secure (end-to-end encrypted) by default. Furthermore, every user needs to log in through their own device, meaning that the device has to be stolen.

This means that brute force attacks aren't a bother and with message data being encrypted, even a successful remote or sniffing attack won't be of use since the contents of messages will be unreadable. In addition, Kraden's encryption keys are generated and stored locally on each device, just like your conversation data. So, even if a hacker were to gain access to our servers, they wouldn't be able to brute force their way into your account or message contents. Give it a go to improve communication security.

A brute force attack is a type of hacking where hackers use brute force, or trial and error, to gain access to your account. This can be done by trying different username and password combinations until they find the right one. Once they have access to your account, they can then do whatever they want with it.

You can protect yourself from brute force attacks by using strong passwords, two-factor authentication, and a password manager. You should also contact your service providers or IT administrator if you think you're being brute forced.

Organizations can protect themselves from brute force attacks by implementing patches & fixes, and address this to other people within the organization. Only by implementing strict protocols, having up to date software and constantly happening what's happening with your business will lead to the ultimate security.

A brute force attack is an automated method to guess credentials (e.g. passwords). Learn how it works and what to do if you're experiencing one.

What Is a Duress Code (And How to Use It)?

A duress code is a security measure that allows you to protect your data in case of an emergency event. When entered, it will perform security actions.

What is a duress code?

How to set up your duress code?

Conclusion