Pastor Nate Cress

Protecting Integrity Online

2021-04-29T12:57:00.000-05:00

The world isn't that scary of a place. We live in it every day. However, that doesn't mean that there aren't threats out there to consider. While Christians may be called to love our neighbors, that doesn't translate to living a careless and vulnerable life. We ought to be wise with how we operate and live our lives especially as believers who are supposed to be representing Christ.

With that said, lately online security has been something I've taken more time to research since seeing some strange activity on some of my own accounts. The last thing I want is someone masquerading as me, and potentially defaming the name of Christ in the process.

I've taken a few big takeaways that I think everyone needs to be aware of when it comes to protecting your integrity and witness online.

You Need A Password Manager!

The first is to use a password manager. The vast majority of accounts online require a username and password, and the average American internet user has about 150 online accounts. That's a lot of passwords to keep up with especially if you want unique and strong passwords! As human beings, we have limits to remembering hard to crack passwords. As a matter of fact, we often create a password that we think is strong and then end up reusing it on various different accounts. This is a bad idea. All it takes is one data leak with your username and password combination and all of your accounts are now vulnerable with your "strong" password.

A Password Manager helps you use different and complex passwords for every account.

Password managers make creating secure, complex, and unique passwords for every online account a breeze. This is because they allow you to access all of your unique passwords with one master password. This way you only need to remember one secure password instead of trying to remember a bunch of them or worse reusing one you think is secure.

Isn't my browser a password manager?

While popular browsers like Chrome, Firefox, and Safari will allow you to save and even create stronger passwords, they aren't very secure. Browsers are designed to get you on the web and logged in as fast as possible. They weren't designed with the security of your accounts as their top priority. This feature is more of an add-on with the goal of helping you get online faster and the second goal of helping you be a little more secure. The problem is that these passwords are stored on your device and can be unlocked with the local account password for the computer you are on. They also aren't very convenient to use for all of your accounts which makes using them across your devices somewhat challenging. If you absolutely refuse to use a dedicated password manager, the browser tool is better than nothing, but it's just not the right tool for the job. This is like using a butter knife instead of a flat head screwdriver. It works, but there's a better tool.

High Quality Password Managers

Here's a list of password managers that are well reviewed.

There are many more, but those are a few I've seen on several lists.

What if someone hacks into my password manager? Won't they then have access to ALL of my accounts?

Honestly, this was originally the reason I was very hesitant to use a password manager. Technically, the answer is yes, but there are ways to secure your password manager to limit that risk considerably if not eliminate it altogether.

The first is to use a really good master password. If you make your master password too simple, that's like leaving the front door to your house open and hoping the thieves don't find the safe hidden in your master bedroom closet... (Side note: Don't hide a safe or any valuables in the master bedroom closet. That's the first place thieves look.) You want a password that is easy for you to remember, but complex and difficult to crack. I suggest you do a little research yourself about creating secure passwords. Here are a few things to try though. One is to find a quote of some kind that you can easily remember and use the first letter of each word as a character using capitalization and symbols as seems appropriate. The quote should be something obscure and unpopular. Something a parent would always say or a song you made up as a kid would be ideal. You want to have a password that is 24 characters long or so. Another option is to use words in a list that are unrelated and use a word that isn't in the dictionary such as one you made up as a kid. For your own security, don't use this example, but an example might be: Secretary-Jupiter-Washington-Jaguar-Voltrue-Blazethinity. Something long like this with made up words will be much harder to crack while relatively easy to remember.

The next thing is securing access to the account for recovery purposes or accessing on a new device. Some password managers use an access key that you can save somewhere or print out. 1Password has a sheet you can print out and put in a safe place. Others such as LastPass offer a trusted contact who can access your account if needed. You'll want to secure this information and access to protect your account.

After that many password managers allow you to use 2fa authentication codes. I HIGHLY advise you set this up on your password manager. Apps like Authy can be used to secure your password vault even if someone somehow cracks your master password. For extra security, you can actually use a Yubikey and the Yubico Authenticator app to keep your 2fa codes offline. You could store this one key away and literally only use it for installing your password manager on new devices. This won't protect the devices you've already authorized, but it will keep a threat actor from accessing your passwords elsewhere.

Finally, you can use double blind passwords on your sensitive accounts or on all of your accounts if you want. A double blind password is like your last defense. If all else fails, and someone actually gets into your password manager, they end up with incorrect passwords! That is because setting up a double blind password means the password saved in your password manager is intentionally wrong. You can do this by letting your password manager create and save a new complex password for a site you are on. However, before you save this new password to the site itself, you add something to the end of the password that only you know. (You could even get a little more tricky by deleting a couple characters and then adding your special phrase, pin, code at the end...) This results in your password manager having the wrong password saved, so that your password manager is blind to the true password and so are you. Thus it is called a double blind password. This is great because you can easily remember your part of a double blind password while retaining the benefits of complex and unique passwords for each site. When you go to log in, let your password manager fill in it's part and then add yours before clicking to sign in. It's that simple.

With this in place, you are a million times more secure than trying to create and remember your own "secure" password for every online account you might have.

However, there's one other thing you need to keep in mind. 2FA ALL THE THINGS!

Use 2FA or 2SV wherever available

If you are anything like me, you might be thinking what is 2FA and why is it needed? 2FA or Two Factor Authentication is the next step in securing your accounts online. It is all about adding a second verification that the person logging in to your account is you. 2SV or Two Step Verification is essentially the same thing. There is a difference, but that comes down to how you implement and use what is available to you.

The most common and least secure method of 2FA is through SMS text messaging. If there isn't a more secure 2FA method available for one of your accounts, it's better to use SMS for 2FA than not having 2FA at all. The problem with SMS is that it is pretty easy to intercept, so while you might think you have secured your account, you may not have done much to keep the bad guys out. This is kind of like adding a chain to your front door and not having a deadbolt. If the bad guys want in, they just kick a little harder. However, if that's all that is available, it's better than nothing at all. Sadly, there are still lots of online accounts that don't offer any kind of 2FA. Of those that do offer 2FA, most offer SMS or require SMS for 2FA. Requiring SMS for 2FA is a shame, and some of the big names are still guilty. Apple and Amazon are a couple of big names I can think of that require SMS if you set up 2FA putting those accounts at risk. However, it's still better to have a chain on the door than no lock at all.

The better method is to use TOTP or time-based one time passwords from an authenticator app like Authy or one of the various competitors. The one I'd advise against using is Google Authenticator. It was essentially first to the market, but better options exist now that keep your TOTP secure. If you are on a site that supports Google Authenticator, it also supports any other TOTP authenticator apps. You don't have to use Google Authenticator just because that is what the site calls it. Some password managers include TOTP as a feature to store along with your passwords. This essentially moves the TOTP from 2FA to 2SV because it's on the same device that your passwords are stored on, but it does make using TOTP very convenient and fast although technically less secure because of being on the same device. One thing to note is that there are sites that offer TOTP support but require SMS as a backup. In those cases, implementing TOTP codes is more about convenience than security since an attacker could just choose to have codes sent to the phone number instead.

A few sites also support hardware security keys! This is GREAT (except if they require SMS fallback...) because the keys are convenient to use and extremely secure. The two big names in security keys are Yubikey and Google Titan. Both of these options are fantastic for security. Where Google failed with their authenticator app, they excelled with the Titan security key. The Yubikey options are also great and come in many form factors for your device needs. Hardware security keys are technically a bit more secure than TOTP and are true 2FA. Yubikey also supports storing some TOTP which are accessible in the Yubico Authenticator app. You are limited to storing 32 TOTP though.

A Note on Banks and 2FA
If you live in America, the state of 2FA and bank accounts is pretty terrible. It's actually pretty bad around the world, but there are certainly some foreign banks that support non-SMS 2FA. While the major American banks do support and even enforce 2FA, they require SMS and often times email (which is also a relatively insecure option). The only American bank that supports TOTP without SMS fallback that I'm aware of is Woodforest National Bank. With that said, SMS based 2FA is better than no 2FA, so if that's what you have, it's better than not having it. In those cases, I suggest making sure you have a very strong password.

I hope this makes you think a little more about your own online security and ways you can protect the integrity of your witness.

God bless,

Pastor Nate

A Church Website You Can Update Yourself

2016-01-01T19:00:00.000-06:00

At this point every church should have a website. If your church doesn't have a website, get a website. You can set a website up for free or mostly free. Free comes with some sacrifices, but you can make something happen without costing your church a dime.

For most of us though, we have a church website. Many churches choose to pay a small fee for hosting and install WordPress and a cool church theme, but when church office staff are asked to update the website, it can be a real headache trying to figure out how to do this or that. Often times the office staff are more concerned about messing something up than about actually updating the website. I have found that even tech savvy people can get frustrated trying to update a WordPress or even Joomla website.

What if there was something better. What if you could update a web page just as easy as a Microsoft Word Document? Point, click, edit, done... That sounds nice doesn't it. Well for a few years now, website editors have been working on developing WYSIWYG interfaces. (IE What You See Is What You Get).

There are quite a few options on the market today that make website editing simple and easy. Some of them are even built specifically for churches. With that said, the system that I have used over the last few years is called Weebly. I currently manage 15 different Weebly websites. Weebly isn't a church specific website builder, but they have a ton of backing, they are always working to make their product better, you can change and alter your website's design easily, and they are pretty cheap.

Editing a Weebly website is extremely simple. You drag text boxes, photos, videos, and other elements onto the webpage and arrange them in columns or stack them on top of each other as you see fit. Everything resizes to fit the space automatically. You can even edit your website from your phone or tablet.

Once you have everything set, you just click publish. Boom! Website updated.

Weebly has a free version. The only downside is that you can't have a custom domain, and there is a "Powered with Weebly" icon in the footer of your website. For a small monthly fee, you can set your website up to look a little more professional.

Click here to see how Weebly's website pricing works.

There are certainly other options out there that you can research, but this is the system I have used. I have found it to be reliable and rewarding. I can't think of any reason to go back to my WordPress days.

God bless,

Pastor Nate Cress

Manage Your Church Membership Data for Free

2015-12-27T19:00:00.000-06:00

Planning Center Online is a suite of apps built specifically for churches with churches in mind. These are same guys who make the extremely popular Planning Center Services app that so many church worship teams use to plan their worship services, set lists, and so much more.

While their most popular app is called Services, Planning Center also has several other apps that aim to be the best in each app's category.

To see a list of all the PCO apps visit their website here.

However, today I would like talk about one app in particular that every church can use absolutely free. This is especially great for smaller churches working on an extremely tight budget. If you are part of a small church, you know that every penny counts. Often times spending resources on software gets put on the back burner, but that doesn't mean that software isn't needed.

Of all the issues that churches deal with when it comes to tracking data, the first bit of information every church needs to track is membership data. Who are our church members, and what do we know about them? Every church needs to have a central place with every members contact information.

This is where PCO comes to the rescue. PCO People is an app from Planning Center that allows you to track unlimited member records and even track custom information for each individual for the great low price of FREE.

Now you might be asking how they can provide a free solution like this and reliably support it. To put it simply, PCO Services is so extremely popular that they have the financial resources to continue to provide PCO People for free. There is no catch. It is absolutely free software. It also happens to be the backbone of the other PCO apps, so if you ever want to add another paid app to your account, all of your people data is already there. However, there isn't a requirement to do so.

My church happened to be using PCO Services before PCO People existed. At that time, we didn't have a software system to manage all of our membership data. As a matter of fact, our contact information was a mess of spreadsheets and word documents. I had spent a ton of time researching Church Management Systems, but I was unable to convince the church board to spend the extra resources on a ChMS. I was frustrated with the was things were. The youth department had one list of people. The children's department had a partial list of people. The church office had a word document with the church membership list, and our accountant had a completely separate list of donors.

That's when PCO released their People app. I was immediately impressed. Check out this video from Planning Center below.

A quick overview of how PCO People can help you organize your ministry.
The best part of the whole app was that it was absolutely FREE. I can do free, and so I started importing the data from all of our systems. Our church staff was encouraged to all use the PCO People app to track member information. Once we had all the information in one place, we realized something. We were missing information on some of our members. So we collect that information. Then we began to realize just how powerful this new system was. When we needed to contact someone, we had one place to go. When we needed to contact a whole group of people, we could filter the people we needed to contact into a list.

Then we realized that we could use PCO people to track even more information about each person. We could track their volunteer information. We could track who has a background check on file. We could track forms like medical releases. We could track dates like salvations and baptisms.

PCO wasn't quite through bringing new features to the table though. Soon they released another feature to the PCO People app called Workflows. With work flows you can set up a series of steps to process people through and assign a staff member to each step. One of the best uses for this is visitor follow up. Your church may find a ton of other uses as well. You could set up a series of steps for becoming a church member. Basically you can track a person's progress through whatever steps your church already uses, and if you don't have a great process for visitor follow up, this is a great place to start.

PCO still had more to announce (and will keep updating their apps with great new features in the future). Recently PCO announced People for iOS. If you have an iPhone, you can now easily access all of your church membership information and contact information on the device you are most likely to contact them with. PCO also mentioned that an Android apps was in the works.

If you are interested in checking out more about PCO People, visit the website below and click the "Sign Up" button.

get.planningcenteronline.com/people

God bless,

Pastor Nate Cress

Plan Church Worship Services with PCO Services

2015-11-17T12:00:00.000-06:00

One of the greatest battles churches face in their day to day operations is getting ready for the Sunday morning service. Scheduling volunteers and making sure everyone will be there can be difficult. Small churches can struggle because each volunteer plays an extremely vital role. One person going on vacation without a backup can be a disaster. Larger churches struggle because services and programs can become more complex and communication can fall through the cracks.

That's not all though. Each week a set of worship songs must be decided on and practiced. The order of service must be planned, and the list goes on.

Enter Planning Center Online

PCO Services is the solution most churches turn to in this space. While there are certainly other solutions, Planning Center Online was the first to develop a solution for this in the local church and really helped to define the catagory. Now many traditional ChMS software companies are adding a Worship Planning aspect to their existing software, and PCO is becoming more and more of a full blown ChMS. With that said, PCO Services is the most mature of all the Worship Planning solutions available to churches, and Planning Center Online continues to innovate and push their software further. Whether you choose to use PCO as your church ChMS or choose to only use the Services app in tandem with your current ChMS solution, you won't be disappointed.

Cost is always a factor in any decision regarding church resources. PCO offers the Services app for free for up to 5 people, so if you have a small band or if you really only want to use this to organize your services and store your sheet music, PCO offers a great free solution. To really harness the power of PCO Services though, you will need to pay for your whole team. You get to decide what that team looks like though, so you can certainly keep costs down to a minimum. When we started using this at our church, we quickly realized just how powerful it was and upgraded to pay for all our church volunteers.

Find out more about PCO Services at get.planningcenteronline.com

The Fluid App

2015-08-21T16:10:00.000-05:00

Image from www.thefluidapp.com

Back when AT&T had the iPhone exclusively, I remember AT&T produced some commercials with the phrase "There's An App For That." In the years since then, we have seen a major mobile revolution. People who never had access to the internet now have immediate access almost anywhere they go. Things have changed and communication has changed. People text instead of talking. Many young people don't use or even have an email address, but they use SMS and messaging apps. How do we reach this next generation? How do we reach the current generation who are also spending increasing amounts of time on these mobile devices?

Thus, our church began looking at publishing a mobile app for our church. After searching through the many mobile church app companies to find someone to partner with, we chose The Fluid App. I actually found out about The Fluid App from a friend whose church started using it. I was really impressed with the app from their church. The Fluid App features an updating news feed for the home page, interactive messaging groups, a media section for sermons and promotional videos, an events stream for upcoming events (much better than bulletins and emails), and the best built in app donation system I've ever seen. I won't say this app is perfect, but it is a great app, and the developers are easy to communicate with. I love that.

One of the things that I really love about this app is the group messaging feature. If you want people to interact with your app, you need something other than just regularly updated content. Having a feature that allows our church to communicate with existing church groups is a fantastic use of our app, and as far as I know, this is the only other app that has this feature for churches.

Another thing that really sold me on The Fluid App is the price. The app is priced at $29/month plus a one time set up fee of $349. For the quality of app that is produced, this is an excellent deal. Other apps in this price range have subpar user experiences, but The Fluid App knocks pricing out of the park for churches on a tight budget!

Check out our app at onelink.to/thelakes and let me know what you think.

Visit The Fluid App's website to find out more www.thefluidapp.com

While I think The Fluid App is the best choice for our church and many churches, you may find that another app works better for your church.

Other custom church apps that I've looked at include:

I've looked at others but these three were among the ones that I really debated on when we decided to go with The Fluid App. Regardless of which app platform your church chooses to use, I encourage you to utilize this tool for your ministry!

- Pastor Nate Cress