Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

From	Your Name <YourName@YourISP.com>
Newsgroups	comp.sys.mac.misc
Subject	Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?
Date	2018-11-14 18:38 +1300
Organization	Aioe.org NNTP Server
Message-ID	<psgcdd$1ujq$1@gioia.aioe.org> (permalink)
References	<2018110721595581963-tomevans9890@yahoo.ca> <2018111321190411384-tomevans9890@yahoo.ca>

Show all headers | View raw

On 2018-11-14 05:19:04 +0000, Tom Evans said:
> On 2018-11-09 05:23:05 +0000, nospam said:
>> 
>> the chances that someone hacked your mac is low, unless you clicked a
>> phishing link, in which case, anything goes.
>> 
>> from your description of the unsubscribe link, it *probably* was not a
>> phish, but that's impossible to know without examining the link.
> 
> If it did happen from phishing, and if I don't secure my sensitve data, 
> could my Mac be phished again by the same attacker in the same way, to 
> steal sensitive bank data that the attacker could again use to try to 
> steal money from my credit card, or is there only one attack for each 
> click on the wrong email link in my email inbox?

Phishing relies on you entering details into a faked version of a real website.

For example, you click the link in an email that is *supposedly* from 
your bank telling you you need to log into your account. That link 
takes you to a fake website that looks real, so you enter your user ID 
and password which teh website then stores for the hacker scumbags, and 
then it tells you the password is wrong and sends you to the real 
banking login page, where you login in as normal. You assume you made a 
typo and don't worry about it ... but the hacker scumbag now has your 
banking user ID and password they can use whenever they want.

Because many people re-use passwords for various websites, obtaining 
your password may let the hacker scumbag get into those different 
websites, not necessarily connected to the original phishing email.

Once you change your password, then the information the hacker scumbag 
has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
*CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
the hacker scumbag can still get into your account.

You can always tell the phishing link by simply pointing (not clicking) 
the mouse cursor at it. Most email apps and webmail systems will show 
you the link the email will be going to. The first part (before the 
firts slash character) of a real one will end with something like 
MyBank.com, while a faked one will be something else - sometimes it may 
look real like MyBank.somewhere-else.com, but that is faked and is 
going to somewhere-else.com, not MyBank.com.

The easiest way to avoid this is to NEVER click a link in an email 
asking you to login for some reason. Instead go to your webbrowser and 
manually go to the bank's real website to login as normal.



There are other ways nasty people can get your information. You might 
get an email / see a web-advert for a competition with an amazing prize 
... unless it's a well known organisation running the competition, stay 
well clear because it may be a case of "too good to be true" and is 
simply using the 'competition' entry form to get your name, address, 
phone number, etc. Once they have those, it can be relatively easy to 
obtain other details.

Thread

csiph-web