Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

From	Your Name <YourName@YourISP.com>
Newsgroups	comp.sys.mac.misc
Subject	Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?
Date	2018-11-16 14:23 +1300
Organization	Aioe.org NNTP Server
Message-ID	<psl65o$1sh4$1@gioia.aioe.org> (permalink)
References	<ps2re1$af$1@gioia.aioe.org> <2018111513244194158-tomevans9890@yahoo.ca>

Show all headers | View raw

On 2018-11-15 21:24:41 +0000, Tom Evans said:
> On 2018-11-14 05:38:54 +0000, Your Name said:
>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>> 
>>>> the chances that someone hacked your mac is low, unless you clicked a
>>>> phishing link, in which case, anything goes.
>>>> 
>>>> from your description of the unsubscribe link, it *probably* was not a
>>>> phish, but that's impossible to know without examining the link.
>>> 
>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>> could my Mac be phished again by the same attacker in the same way, to 
>>> steal sensitive bank data that the attacker could again use to try to 
>>> steal money from my credit card, or is there only one attack for each 
>>> click on the wrong email link in my email inbox?
>> 
>> Phishing relies on you entering details into a faked version of a real website.
>> 
>> For example, you click the link in an email that is *supposedly* from 
>> your bank telling you you need to log into your account. That link 
>> takes you to a fake website that looks real, so you enter your user ID 
>> and password which teh website then stores for the hacker scumbags, and 
>> then it tells you the password is wrong and sends you to the real 
>> banking login page, where you login in as normal. You assume you made a 
>> typo and don't worry about it ... but the hacker scumbag now has your 
>> banking user ID and password they can use whenever they want.
>> 
>> Because many people re-use passwords for various websites, obtaining 
>> your password may let the hacker scumbag get into those different 
>> websites, not necessarily connected to the original phishing email.
>> 
>> Once you change your password, then the information the hacker scumbag 
>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>> the hacker scumbag can still get into your account.
> 
> Thanks, Your.
> 
> Which account are you referring to, that I should change my passcode for?

Whichever one you think was supposedly hacked, but since you don't 
know, you'll have to change them all ... or at least all the ones that 
have any connection to the bank account or to other internet accounts 
that have connection to that bank account.

You'll also have to change the password, etc. for that bank account 
itself via a bank branch taking proof of identity with you.



>> You can always tell the phishing link by simply pointing (not clicking) 
>> the mouse cursor at it. Most email apps and webmail systems will show 
>> you the link the email will be going to. The first part (before the 
>> firts slash character) of a real one will end with something like 
>> MyBank.com, while a faked one will be something else - sometimes it may 
>> look real like MyBank.somewhere-else.com, but that is faked and is 
>> going to somewhere-else.com, not MyBank.com.
>> 
>> The easiest way to avoid this is to NEVER click a link in an email 
>> asking you to login for some reason. Instead go to your webbrowser and 
>> manually go to the bank's real website to login as normal.
> 
> I didn't do that.  I did recently get an email that I thought was from 
> my bank, but after this crisis I realized it was a fake email.  But I 
> didn't try to log into my bank account by pressing on the link in the 
> email.  All I did was to press the "Unsubscribe" button on the Web page 
> that appeared after I pressed a link in the email.
> 
>> There are other ways nasty people can get your information. You might 
>> get an email / see a web-advert for a competition with an amazing prize 
>> ... unless it's a well known organisation running the competition, stay 
>> well clear because it may be a case of "too good to be true" and is 
>> simply using the 'competition' entry form to get your name, address, 
>> phone number, etc. Once they have those, it can be relatively easy to 
>> obtain other details.
> 
> I also didn't do that.

You'd be surprised where and how often people enter their details 
without even a second thought.

Thread

csiph-web