Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

From	Your Name <YourName@YourISP.com>
Newsgroups	comp.sys.mac.misc
Subject	Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?
Date	2018-11-17 09:43 +1300
Organization	Aioe.org NNTP Server
Message-ID	<psna5g$1ac5$1@gioia.aioe.org> (permalink)
References	<ps4rjv$1g7l$1@gioia.aioe.org> <2018111608075639149-tomevans9890@yahoo.ca>
Show all headers | View raw
On 2018-11-16 16:07:56 +0000, Tom Evans said:
> On 2018-11-16 05:41:15 +0000, Your Name said:
>> On 2018-11-16 03:14:49 +0000, Tom Evans said:
>>> On 2018-11-16 01:23:06 +0000, Your Name said:
>>>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>>>> 
>>>>>>>> the chances that someone hacked your mac is low, unless you clicked a
>>>>>>>> phishing link, in which case, anything goes.
>>>>>>>> 
>>>>>>>> from your description of the unsubscribe link, it *probably* was not a
>>>>>>>> phish, but that's impossible to know without examining the link.
>>>>>>> 
>>>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>>>> steal money from my credit card, or is there only one attack for each 
>>>>>>> click on the wrong email link in my email inbox?
>>>>>> 
>>>>>> Phishing relies on you entering details into a faked version of a real website.
>>>>>> 
>>>>>> For example, you click the link in an email that is *supposedly* from 
>>>>>> your bank telling you you need to log into your account. That link 
>>>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>>>> and password which teh website then stores for the hacker scumbags, and 
>>>>>> then it tells you the password is wrong and sends you to the real 
>>>>>> banking login page, where you login in as normal. You assume you made a 
>>>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>>>> banking user ID and password they can use whenever they want.
>>>>>> 
>>>>>> Because many people re-use passwords for various websites, obtaining 
>>>>>> your password may let the hacker scumbag get into those different 
>>>>>> websites, not necessarily connected to the original phishing email.
>>>>>> 
>>>>>> Once you change your password, then the information the hacker scumbag 
>>>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>>>> the hacker scumbag can still get into your account.
>>>>> 
>>>>> Thanks, Your.
>>>>> 
>>>>> Which account are you referring to, that I should change my passcode for?
>>>> 
>>>> Whichever one you think was supposedly hacked, but since you don't 
>>>> know, you'll have to change them all ... or at least all the ones that 
>>>> have any connection to the bank account or to other internet accounts 
>>>> that have connection to that bank account.
>>> 
>>> Do you mean my computer account or my bank accnounts?  You still 
>>> haven't specified that.
>> 
>> Because there's no way I can know. There's no way you can know either, 
>> nor can you know if it was or wasn't anything to do with the computer 
>> at all. At the very least you should change the passwords for your bank 
>> account and your email account.
>> 
>> 
>> 
>>>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>>>> you the link the email will be going to. The first part (before the 
>>>>>> firts slash character) of a real one will end with something like 
>>>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>>>> going to somewhere-else.com, not MyBank.com.
>>>>>> 
>>>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>>>> manually go to the bank's real website to login as normal.
>>>>> 
>>>>> I didn't do that.  I did recently get an email that I thought was from 
>>>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>>>> didn't try to log into my bank account by pressing on the link in the 
>>>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>>>> that appeared after I pressed a link in the email.
>> 
>> There's no point in unsubscribing from fake emails. If it is a scumbag, 
>> then you won't get unsubscribed and you'll simply be telling them that 
>> someone is opening the emails.
> 
> That's not the point.  The point is that people keep telling me the 
> danger is from clicking a link in emails and then typing passcodes and 
> account numbers on the resulting pages.  I keep repeating that I didn't 
> do that.  But then you change your position, stating that pressing on 
> an "Unsubscribe" button on a Web site is just as dangerous.

Again: That was simply ONE example way you could have inadvertently 
given away your details. There are various other ways, including ones 
that have nothing to do with the computer at all. There's no possible 
way to know exactly how someone got your bank account details, but the 
chances of some hacker getting into your Mac to read a text file stored 
on it's drive are basically zero.
Thread

csiph-web