About F‑Secure ID Protection

F-Secure ID PROTECTION is an app that prevents you from falling victim to identity theft.

Identity theft happens when someone uses another person’s identity or personal information, such as name, social security number, credit card number, or online credentials without permission to commit a crime or fraud. Resolving identity theft is not easy. Once information gets exposed, it can stay out there for years.

The majority of identity theft incidents originate from cyber criminals exploiting users’ weak passwords.

With F-Secure ID PROTECTION, you can do the following:

• Protect your own and your family’s personal information against cyber crime.
• Receive alerts and guidance on how to respond to an incident when your personal information has been found as part of a data breach or data leak.
• Improve your security by creating strong and unique passwords, and by synchronizing them across all your devices.

What is an F-Secure ID PROTECTION master password?

The master password is very important as it gives you access to the app and keeps your password data safe.

Once you’ve installed F-Secure ID PROTECTION and you start the application for the first time, the app asks you to create a master password.

Choose a hard-to-guess master password or passphrase that you can remember, as the app is not able to reset your master password. The fact that the app cannot reset the master password has been a conscious decision by F-Secure to increase your security and privacy and protect your data.

How the app uses double encryption to store data

The data stored in the app is encrypted and decrypted only on your own device. Every time you enter your ID PROTECTION master password, this password adds another layer of encryption, as it is used to generate an encryption key that descrambles your encrypted ID PROTECTION data. This process is carried out by using the PBKDF2 (Password-Based Key Derivation Function 2) standard, which adds a salt (random data) value to the password, and hashes the resulting data with the HMAC-SHA256 function. This process gets repeated 20,000 times.

Your master password and the master encryption key are never stored anywhere. The encryption keys exist only when you use the product. When you turn off F-Secure ID PROTECTION, the encryption key is destroyed. We have no way of decrypting any information that you have saved in F-Secure ID PROTECTION.

This level of security also means that there is no way for F-Secure to recover your password or data for you if you forget the master password. Furthermore, F-Secure does not track you when you synchronize your data across devices.

Keep your passwords safe with Vault

F-Secure ID PROTECTION stores and protects your personal information, such as passwords, credit card numbers, and PIN codes.

The app gives you an easy way to make sure that the account credentials for your online services, as well as your credit card details and other important information, stay both safe and conveniently accessible.

The main benefits of the Vault feature are:

• Password storage: Store all your passwords, login details, PIN codes, credit card details, and online banking credentials securely.
• Create passwords: Generate stronger, unique passwords for all your services and accounts.
• Password status: The app helps you to improve your passwords by grouping your passwords based on their quality.
• Autofill: Get your passwords automatically entered on login pages in your web browser to make it easier and quicker to access your account (not available on iOS versions).
• Sync: Synchronize your passwords securely across all your devices.

With ID PROTECTION, all the data is encrypted, and the only way to access it is with your master password. Not even F-Secure can access your data. Furthermore, the service is anonymous, which means that there is no way for anyone else to link you to your data. There is no web browser access to your data, so nobody can access it without stealing your device first.

F-Secure ID PROTECTION stores your personal data, such as usernames, passwords and credit card details on the computer or mobile device you use to run the app.

Your passwords are stored in encrypted format and nobody can access them unless they know your master password and get access to your device.

You can sync your passwords across your devices. For security reasons, we do not provide access to the passwords through F-Secure servers. We recommend that you sync your passwords with another device running the ID PROTECTION app, just in case you lose or break your device. No matter what happens to one of your devices, sync ensures that you will always have access to your passwords on the other devices.

Data breaches and identity theft

A data breach is either an intentional or unintentional exposure of sensitive and confidential personal or financial data to an untrusted environment.

A data breach happens when cyber criminals break into a company or online service and steal the private information of its customers or users. This information can range from personally identifiable information, such as names, social security numbers and addresses to directly harmful financial information, such as credit card numbers and bank accounts.

Identity theft happens when someone uses another person’s identity or personal information, such as name, social security number, credit card number, or online credentials without permission to commit a crime or fraud. Resolving identity theft is not easy. Once information gets exposed, it can stay out there for years.

What happens when there is a data breach and my data gets stolen?

When a data breach happens, it means that cyber criminals access data sources illegally and can get their hands on sensitive personal data. The data can also end up being sold on forums and market places deep the web. This data may be used for illegal activities such as fraud, identity theft, and blackmail.

If your data has been part of a breach—depending on the scenario, you are advised to take action immediately to prevent cyber criminals from getting further access to your systems or from using your data.

Some tips on what to do:

• Act without delay and change any affected passwords.
• Contact your bank immediately and cancel any bank or credit cards.
• Turn to the relevant authority dealing with online criminality and report that your data has been stolen.

How we monitor for data breaches

This topic gives an overview of how we collect data from data breaches.

We get this information from many sources by collecting data sets that have been breached and leaked using multiple techniques. Our primary focus is using a human approach coupled with scanning and monitoring technologies that can access forums on the deep and dark web.

We collect a massive amount of data on a daily basis. Once we have the data, we put it through a rigorous quality-control process to determine its value. This includes sorting the data into file types, types of data, and getting rid of data that is not useful. We may also get duplicate data that we already acquired from a previous breach, so the data also goes through a process to eliminate these duplicates.

Once the data collection and controls are done, we run checks on the authenticity of the data. The final phase in handling this type of data is to transfer the data analysis into the report.