Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

From	Your Name <YourName@YourISP.com>
Newsgroups	comp.sys.mac.misc
Subject	Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?
Date	2018-11-16 18:41 +1300
Organization	Aioe.org NNTP Server
Message-ID	<psll9r$flq$1@gioia.aioe.org> (permalink)
References	<2018110911034357212-tomevans9890@yahoo.ca> <2018111519144913678-tomevans9890@yahoo.ca>
Show all headers | View raw
On 2018-11-16 03:14:49 +0000, Tom Evans said:
> On 2018-11-16 01:23:06 +0000, Your Name said:
>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>> 
>>>>>> the chances that someone hacked your mac is low, unless you clicked a
>>>>>> phishing link, in which case, anything goes.
>>>>>> 
>>>>>> from your description of the unsubscribe link, it *probably* was not a
>>>>>> phish, but that's impossible to know without examining the link.
>>>>> 
>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>> steal money from my credit card, or is there only one attack for each 
>>>>> click on the wrong email link in my email inbox?
>>>> 
>>>> Phishing relies on you entering details into a faked version of a real website.
>>>> 
>>>> For example, you click the link in an email that is *supposedly* from 
>>>> your bank telling you you need to log into your account. That link 
>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>> and password which teh website then stores for the hacker scumbags, and 
>>>> then it tells you the password is wrong and sends you to the real 
>>>> banking login page, where you login in as normal. You assume you made a 
>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>> banking user ID and password they can use whenever they want.
>>>> 
>>>> Because many people re-use passwords for various websites, obtaining 
>>>> your password may let the hacker scumbag get into those different 
>>>> websites, not necessarily connected to the original phishing email.
>>>> 
>>>> Once you change your password, then the information the hacker scumbag 
>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>> the hacker scumbag can still get into your account.
>>> 
>>> Thanks, Your.
>>> 
>>> Which account are you referring to, that I should change my passcode for?
>> 
>> Whichever one you think was supposedly hacked, but since you don't 
>> know, you'll have to change them all ... or at least all the ones that 
>> have any connection to the bank account or to other internet accounts 
>> that have connection to that bank account.
> 
> Do you mean my computer account or my bank accnounts?  You still 
> haven't specified that.

Because there's no way I can know. There's no way you can know either, 
nor can you know if it was or wasn't anything to do with the computer 
at all. At the very least you should change the passwords for your bank 
account and your email account.



>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>> you the link the email will be going to. The first part (before the 
>>>> firts slash character) of a real one will end with something like 
>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>> going to somewhere-else.com, not MyBank.com.
>>>> 
>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>> manually go to the bank's real website to login as normal.
>>> 
>>> I didn't do that.  I did recently get an email that I thought was from 
>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>> didn't try to log into my bank account by pressing on the link in the 
>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>> that appeared after I pressed a link in the email.

There's no point in unsubscribing from fake emails. If it is a scumbag, 
then you won't get unsubscribed and you'll simply be telling them that 
someone is opening the emails.



>>>> There are other ways nasty people can get your information. You might 
>>>> get an email / see a web-advert for a competition with an amazing prize 
>>>> ... unless it's a well known organisation running the competition, stay 
>>>> well clear because it may be a case of "too good to be true" and is 
>>>> simply using the 'competition' entry form to get your name, address, 
>>>> phone number, etc. Once they have those, it can be relatively easy to 
>>>> obtain other details.
>>> 
>>> I also didn't do that.
>> 
>> You'd be surprised where and how often people enter their details 
>> without even a second thought.
> 
> I DO -- and I DID -- give it a second thought, and I DID NOT enter any 
> such competitons recently or earlier.

Competitions was only one example of a potential cause. Phishing 
emails, weird software update requests (with you entering the admin 
password to install it), strange phones calls from fake "help desk" 
staff saying they know something is wrong with your computer, etc., 
etc. ... there's a ton of options and that's even assuming that your 
computer was actually hacked, which is highly unlikely,
Thread

csiph-web