Unscrupulous Try to Stay Fit by Stealing Fitbit Credentials

Even the unscrupulous want to stay fit these days; to the point they are willing to commit warranty fraud to get a new Fitbit. In the most recent instance, some Fitbit users found that someone was able to log into their accounts and change their passwords and subsequently request new Fitbit devices under warranty.

Fitbit says their systems have not been breached or accessed and it is likely that someone was able to reuse online credentials accessed via a compromise of another online account.

Fitbit customers are urged to change their passwords. Make sure they are not the same ones used at other online sites to avoid issues such as this one. There are many instances where password reuse has led to compromised information and it’s fairly simple to avoid this. When changing passwords, make sure to follow strong password guidelines:

• No less than eight characters, including upper and lower case letters
• At least one number and one special character
• No dictionary words or phrases, in any language
• Personal details, such as birthdates, addresses, children and pets’ names should not be part of it

One way to make sure the same passwords are not used on multiple sites is to use the dice method. This means to combine two to three words that typically would not be together; as if there are words on dice and you throw them to come up with the words to use. For example, you might try August%horsE8pAlm, keeping the numbers always in the same places within the phrase and the letter case in the same spots as well. It’s unlikely such a word can be cracked or guessed.

Another method is to bookend your six (or more) character core password or phrase with letters from the website you’re visiting. For example, your core password is “YnT1Z$” and the website starts with “S” and ends with “O.” Your password would become “SYnT1Z$o.”

The more difficult you make your passwords, the better.

Using two-factor (or multi-factor) authentication on online accounts whenever it is offered is another way to strengthen account security. Most of the time, the company will send a one-time code via text that must be entered and validated before account access is granted. Fitbit does not currently offer this, but is working toward it for use in 2016. In the meantime, it is possible to log in using a Google account with its multi-factor authentication option.

So don’t let the possibility of warranty fraud derail your fitness goals. Just make changing your passwords to unique ones part of your new year’s security fitness strategy.