Groups > comp.sys.mac.misc > #6717 > unrolled thread

Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

Started by	Tom Evans <tomevans9890@yahoo.ca>
First post	2018-11-07 21:59 -0800
Last post	2018-11-08 20:22 +0000
Articles	20 on this page of 131 — 7 participants

Back to article view | Back to comp.sys.mac.misc

Page 3 of 7 — ← Prev page 1 2 [3] 4 5 6 7 Next page →

#6783

From	Your Name <YourName@YourISP.com>
Date	2018-11-15 18:30 +1300
Message-ID	<psj099$9n6$1@gioia.aioe.org>
In reply to	#6740

On 2018-11-10 01:09:45 +0000, Your Name said:
> On 2018-11-09 19:03:43 +0000, Tom Evans said:
>> 
>> What passcode management programs do you recommend?
>> 
>> I checked Keychain, but it seems like it would be hard to find the 
>> company information I want to look for there.
>> 
>> I want to have a list of companies that I deal with, shown in 
>> alphabetical order (such as Amazon, Apple, Best Buy, Costco, etcetera), 
>> with each company's information in one place under the company's name 
>> heading in bold type, but instead  Keychain has one folder for 
>> passcodes, and another folder for Secure Notes, so I'd have to have 
>> each company's passcodes and notes into separate folders, and then 
>> scroll through those two folders to see each company's passcodes and 
>> notes.
>> 
>> Also, Keychain (in the login folder) shows a long list of odd names 
>> such as "com.apple.cloudd.deviceidentifier.production".  It feels like 
>> I'm in Terminal.
> 
> Keychain utility isn't really for looking up passwords. The passwords 
> are used automatically in apps like Safari. Keychain utility is for 
> deleting entries.
> 
> 
> Of the proper password manager apps, 1Password is probably the best, 
> but with their latest version they've changed to a silly monthly 
> subscription pricing.
> https://1password.com
> 
> Other popular alternatives, according to Macworld, are:
> 
>    - Dashlane (free for one device)
>      https://www.dashlane.com
> 
>    - LastPass (free)
>      https://www.lastpass.com
> 
>    - Keeper(free)
>      https://itunes.apple.com/us/app/keeper-password-manager/id414781829
> 
>    - EnPass (free)
>      https://www.enpass.io
> 
> <https://www.macworld.co.uk/feature/mac-software/best-passwords-managers-for-mac-3672527/> 
> 
> 
> The free ones do have a more powerful version and/or multi-device / 
> cloud syncing options you have to pay for as well, but the free version 
> might be enough for your needs.

Apparently Dashlane is so easy to use that even the mother of the Cult 
of Mac blogger can use it. This is from today's junk emails ...

    A password manager so easy, my mom uses it
    ------------------------------------------
    My mom loves her Apple technology. She's a full-fledged member
    of the Cult, with an iPhone, iPad, MacBook, iMac and Apple TV.
    She uses them all the time, to do everything. But she always
    had trouble with passwords - at least until I introduced her
    to Dashlane, the official password manager of Cult of Mac.

    In our video below, you can see exactly how easy it was for
    her to start using Dashlane (and give up the little book she
    formerly used to keep track of her passwords).
    <https://www.youtube.com/watch?v=cnRq8xfJ-_c>

    You (or your mom) can download a free copy of Dashlane and
    take control of your passwords on one device. The premium
    version, which costs $4.99 per month, lets you sync passwords
    and credit card details across devices. Premium users also
    can take advantage of Dashlane's new VPN and Dark Web
    Monitoring service for even more security.

[toc] | [prev] | [next] | [standalone]

#6787

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-15 13:07 -0800
Message-ID	<2018111513072846162-tomevans9890@yahoo.ca>
In reply to	#6783

On 2018-11-15 05:30:18 +0000, Your Name said:

> On 2018-11-10 01:09:45 +0000, Your Name said:
>> On 2018-11-09 19:03:43 +0000, Tom Evans said:
>>> 
>>> What passcode management programs do you recommend?
>>> 
>>> I checked Keychain, but it seems like it would be hard to find the 
>>> company information I want to look for there.
>>> 
>>> I want to have a list of companies that I deal with, shown in 
>>> alphabetical order (such as Amazon, Apple, Best Buy, Costco, etcetera), 
>>> with each company's information in one place under the company's name 
>>> heading in bold type, but instead  Keychain has one folder for 
>>> passcodes, and another folder for Secure Notes, so I'd have to have 
>>> each company's passcodes and notes into separate folders, and then 
>>> scroll through those two folders to see each company's passcodes and 
>>> notes.
>>> 
>>> Also, Keychain (in the login folder) shows a long list of odd names 
>>> such as "com.apple.cloudd.deviceidentifier.production".  It feels like 
>>> I'm in Terminal.
>> 
>> Keychain utility isn't really for looking up passwords. The passwords 
>> are used automatically in apps like Safari. Keychain utility is for 
>> deleting entries.
>> 
>> 
>> Of the proper password manager apps, 1Password is probably the best, 
>> but with their latest version they've changed to a silly monthly 
>> subscription pricing.
>> https://1password.com
>> 
>> Other popular alternatives, according to Macworld, are:
>> 
>> - Dashlane (free for one device)
>> https://www.dashlane.com
>> 
>> - LastPass (free)
>> https://www.lastpass.com
>> 
>> - Keeper(free)
>> https://itunes.apple.com/us/app/keeper-password-manager/id414781829
>> 
>> - EnPass (free)
>> https://www.enpass.io
>> 
>> <https://www.macworld.co.uk/feature/mac-software/best-passwords-managers-for-mac-3672527/> 
>> 
>> 
>> The free ones do have a more powerful version and/or multi-device / 
>> cloud syncing options you have to pay for as well, but the free version 
>> might be enough for your needs.
> 
> Apparently Dashlane is so easy to use that even the mother of the Cult 
> of Mac blogger can use it. This is from today's junk emails ...
> 
>     A password manager so easy, my mom uses it
>     ------------------------------------------
>     My mom loves her Apple technology. She's a full-fledged member
>     of the Cult, with an iPhone, iPad, MacBook, iMac and Apple TV.
>     She uses them all the time, to do everything. But she always
>     had trouble with passwords - at least until I introduced her
>     to Dashlane, the official password manager of Cult of Mac.
> 
>     In our video below, you can see exactly how easy it was for
>     her to start using Dashlane (and give up the little book she
>     formerly used to keep track of her passwords).
>     <https://www.youtube.com/watch?v=cnRq8xfJ-_c>
> 
>     You (or your mom) can download a free copy of Dashlane and
>     take control of your passwords on one device. The premium
>     version, which costs $4.99 per month, lets you sync passwords
>     and credit card details across devices. Premium users also
>     can take advantage of Dashlane's new VPN and Dark Web
>     Monitoring service for even more security.


Thanks, Your.

A problem with Dashlane is that I can't use my existing passcodes.  The 
passcodes are randomly generated by Dashlane so there's no way I could 
remember any of them and I'd have to change all of my existing 
passcodes that I've already established with many companies and other 
organizations over the years.

Also, I don't want to be so dependent on one company's software to 
remember all of my sensitive data, in case something were to go wrong 
and the company's software lost my data.

Tom

[toc] | [prev] | [next] | [standalone]

#6792

From	Your Name <YourName@YourISP.com>
Date	2018-11-16 14:11 +1300
Message-ID	<psl5fp$1ro8$1@gioia.aioe.org>
In reply to	#6787

On 2018-11-15 21:07:28 +0000, Tom Evans said:
> On 2018-11-15 05:30:18 +0000, Your Name said:
>> On 2018-11-10 01:09:45 +0000, Your Name said:
>>> On 2018-11-09 19:03:43 +0000, Tom Evans said:
>>>> 
>>>> What passcode management programs do you recommend?
>>>> 
>>>> I checked Keychain, but it seems like it would be hard to find the 
>>>> company information I want to look for there.
>>>> 
>>>> I want to have a list of companies that I deal with, shown in 
>>>> alphabetical order (such as Amazon, Apple, Best Buy, Costco, etcetera), 
>>>> with each company's information in one place under the company's name 
>>>> heading in bold type, but instead  Keychain has one folder for 
>>>> passcodes, and another folder for Secure Notes, so I'd have to have 
>>>> each company's passcodes and notes into separate folders, and then 
>>>> scroll through those two folders to see each company's passcodes and 
>>>> notes.
>>>> 
>>>> Also, Keychain (in the login folder) shows a long list of odd names 
>>>> such as "com.apple.cloudd.deviceidentifier.production".  It feels like 
>>>> I'm in Terminal.
>>> 
>>> Keychain utility isn't really for looking up passwords. The passwords 
>>> are used automatically in apps like Safari. Keychain utility is for 
>>> deleting entries.
>>> 
>>> 
>>> Of the proper password manager apps, 1Password is probably the best, 
>>> but with their latest version they've changed to a silly monthly 
>>> subscription pricing.
>>> https://1password.com
>>> 
>>> Other popular alternatives, according to Macworld, are:
>>> 
>>> - Dashlane (free for one device)
>>> https://www.dashlane.com
>>> 
>>> - LastPass (free)
>>> https://www.lastpass.com
>>> 
>>> - Keeper(free)
>>> https://itunes.apple.com/us/app/keeper-password-manager/id414781829
>>> 
>>> - EnPass (free)
>>> https://www.enpass.io
>>> 
>>> <https://www.macworld.co.uk/feature/mac-software/best-passwords-managers-for-mac-3672527/> 
>>> 
>>> 
>>> The free ones do have a more powerful version and/or multi-device / 
>>> cloud syncing options you have to pay for as well, but the free version 
>>> might be enough for your needs.
>> 
>> Apparently Dashlane is so easy to use that even the mother of the Cult 
>> of Mac blogger can use it. This is from today's junk emails ...
>> 
>> A password manager so easy, my mom uses it
>> ------------------------------------------
>> My mom loves her Apple technology. She's a full-fledged member
>> of the Cult, with an iPhone, iPad, MacBook, iMac and Apple TV.
>> She uses them all the time, to do everything. But she always
>> had trouble with passwords - at least until I introduced her
>> to Dashlane, the official password manager of Cult of Mac.
>> 
>> In our video below, you can see exactly how easy it was for
>> her to start using Dashlane (and give up the little book she
>> formerly used to keep track of her passwords).
>> <https://www.youtube.com/watch?v=cnRq8xfJ-_c>
>> 
>> You (or your mom) can download a free copy of Dashlane and
>> take control of your passwords on one device. The premium
>> version, which costs $4.99 per month, lets you sync passwords
>> and credit card details across devices. Premium users also
>> can take advantage of Dashlane's new VPN and Dark Web
>> Monitoring service for even more security.
> 
> Thanks, Your.
> 
> A problem with Dashlane is that I can't use my existing passcodes.  The 
> passcodes are randomly generated by Dashlane so there's no way I could 
> remember any of them

You can use your own passwords, but Dashland and 1Password *also* have 
the ability to generate random passwords for you. Since you're using a 
password manager, there's no need to remember any of them all - you 
only need to remeber two passwords: teh one to log on to the computer 
and the one for the password manager (they could even be the same, but 
best not to be).



> and I'd have to change all of my existing passcodes that I've already 
> established with many companies and other organizations over the years.

Seeing as you think one of your passwords has been hacked and you don't 
know which one, you're going to have to change them all anyway.



> Also, I don't want to be so dependent on one company's software to 
> remember all of my sensitive data, in case something were to go wrong 
> and the company's software lost my data.

With the exception of a plain text file or handwriting in a notebook, 
you're *always* going to be "dependent on one company's software to 
remember all of my sensitive data".

[toc] | [prev] | [next] | [standalone]

#6788

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-15 13:11 -0800
Message-ID	<2018111513114788187-tomevans9890@yahoo.ca>
In reply to	#6783

On 2018-11-15 05:30:18 +0000, Your Name said:

> On 2018-11-10 01:09:45 +0000, Your Name said:
>> On 2018-11-09 19:03:43 +0000, Tom Evans said:
>>> 
>>> What passcode management programs do you recommend?
>>> 
>>> I checked Keychain, but it seems like it would be hard to find the 
>>> company information I want to look for there.
>>> 
>>> I want to have a list of companies that I deal with, shown in 
>>> alphabetical order (such as Amazon, Apple, Best Buy, Costco, etcetera), 
>>> with each company's information in one place under the company's name 
>>> heading in bold type, but instead  Keychain has one folder for 
>>> passcodes, and another folder for Secure Notes, so I'd have to have 
>>> each company's passcodes and notes into separate folders, and then 
>>> scroll through those two folders to see each company's passcodes and 
>>> notes.
>>> 
>>> Also, Keychain (in the login folder) shows a long list of odd names 
>>> such as "com.apple.cloudd.deviceidentifier.production".  It feels like 
>>> I'm in Terminal.
>> 
>> Keychain utility isn't really for looking up passwords. The passwords 
>> are used automatically in apps like Safari. Keychain utility is for 
>> deleting entries.
>> 
>> 
>> Of the proper password manager apps, 1Password is probably the best, 
>> but with their latest version they've changed to a silly monthly 
>> subscription pricing.
>> https://1password.com
>> 
>> Other popular alternatives, according to Macworld, are:
>> 
>> - Dashlane (free for one device)
>> https://www.dashlane.com
>> 
>> - LastPass (free)
>> https://www.lastpass.com
>> 
>> - Keeper(free)
>> https://itunes.apple.com/us/app/keeper-password-manager/id414781829
>> 
>> - EnPass (free)
>> https://www.enpass.io
>> 
>> <https://www.macworld.co.uk/feature/mac-software/best-passwords-managers-for-mac-3672527/> 
>> 
>> 
>> The free ones do have a more powerful version and/or multi-device / 
>> cloud syncing options you have to pay for as well, but the free version 
>> might be enough for your needs.
> 
> Apparently Dashlane is so easy to use that even the mother of the Cult 
> of Mac blogger can use it. This is from today's junk emails ...
> 
>     A password manager so easy, my mom uses it
>     ------------------------------------------
>     My mom loves her Apple technology. She's a full-fledged member
>     of the Cult, with an iPhone, iPad, MacBook, iMac and Apple TV.
>     She uses them all the time, to do everything. But she always
>     had trouble with passwords - at least until I introduced her
>     to Dashlane, the official password manager of Cult of Mac.
> 
>     In our video below, you can see exactly how easy it was for
>     her to start using Dashlane (and give up the little book she
>     formerly used to keep track of her passwords).
>     <https://www.youtube.com/watch?v=cnRq8xfJ-_c>
> 
>     You (or your mom) can download a free copy of Dashlane and
>     take control of your passwords on one device. The premium
>     version, which costs $4.99 per month, lets you sync passwords
>     and credit card details across devices. Premium users also
>     can take advantage of Dashlane's new VPN and Dark Web
>     Monitoring service for even more security.

Thanks, Your.

I found a video that says Dashlane has extensions for Chrome, Firefox 
and Internet Explorer, but Safari wasn't mentioned.

I was just chided her for not using Safari, so I'm planning to switch 
my browser from Chrome to Safari.

Tom

[toc] | [prev] | [next] | [standalone]

#6794

From	Your Name <YourName@YourISP.com>
Date	2018-11-16 14:19 +1300
Message-ID	<psl5vl$1saq$1@gioia.aioe.org>
In reply to	#6788

On 2018-11-15 21:11:47 +0000, Tom Evans said:
> On 2018-11-15 05:30:18 +0000, Your Name said:
>> On 2018-11-10 01:09:45 +0000, Your Name said:
>>> On 2018-11-09 19:03:43 +0000, Tom Evans said:
>>>> 
>>>> What passcode management programs do you recommend?
>>>> 
>>>> I checked Keychain, but it seems like it would be hard to find the 
>>>> company information I want to look for there.
>>>> 
>>>> I want to have a list of companies that I deal with, shown in 
>>>> alphabetical order (such as Amazon, Apple, Best Buy, Costco, etcetera), 
>>>> with each company's information in one place under the company's name 
>>>> heading in bold type, but instead  Keychain has one folder for 
>>>> passcodes, and another folder for Secure Notes, so I'd have to have 
>>>> each company's passcodes and notes into separate folders, and then 
>>>> scroll through those two folders to see each company's passcodes and 
>>>> notes.
>>>> 
>>>> Also, Keychain (in the login folder) shows a long list of odd names 
>>>> such as "com.apple.cloudd.deviceidentifier.production".  It feels like 
>>>> I'm in Terminal.
>>> 
>>> Keychain utility isn't really for looking up passwords. The passwords 
>>> are used automatically in apps like Safari. Keychain utility is for 
>>> deleting entries.
>>> 
>>> 
>>> Of the proper password manager apps, 1Password is probably the best, 
>>> but with their latest version they've changed to a silly monthly 
>>> subscription pricing.
>>> https://1password.com
>>> 
>>> Other popular alternatives, according to Macworld, are:
>>> 
>>> - Dashlane (free for one device)
>>> https://www.dashlane.com
>>> 
>>> - LastPass (free)
>>> https://www.lastpass.com
>>> 
>>> - Keeper(free)
>>> https://itunes.apple.com/us/app/keeper-password-manager/id414781829
>>> 
>>> - EnPass (free)
>>> https://www.enpass.io
>>> 
>>> <https://www.macworld.co.uk/feature/mac-software/best-passwords-managers-for-mac-3672527/> 
>>> 
>>> 
>>> The free ones do have a more powerful version and/or multi-device / 
>>> cloud syncing options you have to pay for as well, but the free version 
>>> might be enough for your needs.
>> 
>> Apparently Dashlane is so easy to use that even the mother of the Cult 
>> of Mac blogger can use it. This is from today's junk emails ...
>> 
>> A password manager so easy, my mom uses it
>> ------------------------------------------
>> My mom loves her Apple technology. She's a full-fledged member
>> of the Cult, with an iPhone, iPad, MacBook, iMac and Apple TV.
>> She uses them all the time, to do everything. But she always
>> had trouble with passwords - at least until I introduced her
>> to Dashlane, the official password manager of Cult of Mac.
>> 
>> In our video below, you can see exactly how easy it was for
>> her to start using Dashlane (and give up the little book she
>> formerly used to keep track of her passwords).
>> <https://www.youtube.com/watch?v=cnRq8xfJ-_c>
>> 
>> You (or your mom) can download a free copy of Dashlane and
>> take control of your passwords on one device. The premium
>> version, which costs $4.99 per month, lets you sync passwords
>> and credit card details across devices. Premium users also
>> can take advantage of Dashlane's new VPN and Dark Web
>> Monitoring service for even more security.
> 
> Thanks, Your.
> 
> I found a video that says Dashlane has extensions for Chrome, Firefox 
> and Internet Explorer, but Safari wasn't mentioned.
> 
> I was just chided her for not using Safari, so I'm planning to switch 
> my browser from Chrome to Safari.
> 
> Tom

You can use whichever webbrowser you want. Dashlane will work with all 
of them ...

    Dashlane can only support the release versions of these
    browsers:

      - Chrome (Windows & Mac OS X)
      - Firefox (Windows & Mac OS X)
      - Internet Explorer (Windows)
      - Edge (Windows)
      - Safari (Mac OS X)

Since it mentions Internet Explorer, the video you saw was for Windows 
computers. There is no Internet Explorer for Mac any longer and there's 
no Safari for Windows.

[toc] | [prev] | [next] | [standalone]

#6743

From	Jolly Roger <jollyroger@pobox.com>
Date	2018-11-10 01:18 +0000
Message-ID	<g4mpvmFftsaU2@mid.individual.net>
In reply to	#6736

On 2018-11-09, Tom Evans <tomevans9890@yahoo.ca> wrote:
>
> What passcode management programs do you recommend?

Keychain is fine.

> I checked Keychain, but it seems like it would be hard to find the 
> company information I want to look for there.

Not at all. Open Keychain Access, and look at the "Secure Notes" item on
the left sidebar. Add notes there at will. Search them using the
top-right search field. Simple.

> I want to have a list of companies that I deal with, shown in 
> alphabetical order (such as Amazon, Apple, Best Buy, Costco, etcetera), 
> with each company's information in one place under the company's name 
> heading in bold type, but instead  Keychain has one folder for 
> passcodes, and another folder for Secure Notes, so I'd have to have 
> each company's passcodes and notes into separate folders, and then 
> scroll through those two folders to see each company's passcodes and 
> notes.

Nope, you can put them all under Secure Notes. Passwords is where
*applications* on your devices/computers store their passwords. Secure
Notes is where *you* store your own things. And again, there's a search
bar at the top-right corner that lets you find whatever it is you want.

> Also, Keychain (in the login folder) shows a long list of odd names 
> such as "com.apple.cloudd.deviceidentifier.production".  It feels like 
> I'm in Terminal.

Do you find it hard to ignore things that don't interest you in other
situations, or just here?

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#6756

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-10 19:52 -0800
Message-ID	<201811101952165115-tomevans9890@yahoo.ca>
In reply to	#6743

On 2018-11-10 01:18:46 +0000, Jolly Roger said:

> On 2018-11-09, Tom Evans <tomevans9890@yahoo.ca> wrote:
>> 
>> What passcode management programs do you recommend?
> 
> Keychain is fine.
> 
>> I checked Keychain, but it seems like it would be hard to find the
>> company information I want to look for there.
> 
> Not at all. Open Keychain Access, and look at the "Secure Notes" item on
> the left sidebar. Add notes there at will. Search them using the
> top-right search field. Simple.
> 
>> I want to have a list of companies that I deal with, shown in
>> alphabetical order (such as Amazon, Apple, Best Buy, Costco, etcetera),
>> with each company's information in one place under the company's name
>> heading in bold type, but instead  Keychain has one folder for
>> passcodes, and another folder for Secure Notes, so I'd have to have
>> each company's passcodes and notes into separate folders, and then
>> scroll through those two folders to see each company's passcodes and
>> notes.
> 
> Nope, you can put them all under Secure Notes. Passwords is where
> *applications* on your devices/computers store their passwords. Secure
> Notes is where *you* store your own things. And again, there's a search
> bar at the top-right corner that lets you find whatever it is you want.
> 
>> Also, Keychain (in the login folder) shows a long list of odd names
>> such as "com.apple.cloudd.deviceidentifier.production".  It feels like
>> I'm in Terminal.
> 
> Do you find it hard to ignore things that don't interest you in other
> situations, or just here?

I tried Keychain today, but it didn't work.  I even called it up with 
Spotlight prior to getting to a Web site where I was planning to 
register with that site, but when I got to the site's registration 
page, Keychain didn't open to ask me if I wanted to save my user name 
and passocode into Keychain for that site.

Tom

[toc] | [prev] | [next] | [standalone]

#6764

From	Jolly Roger <jollyroger@pobox.com>
Date	2018-11-11 16:49 +0000
Message-ID	<g4r4stFes8tU3@mid.individual.net>
In reply to	#6756

On 2018-11-11, Tom Evans <tomevans9890@yahoo.ca> wrote:
>
> I tried Keychain today, but it didn't work.  I even called it up with 
> Spotlight prior to getting to a Web site where I was planning to 
> register with that site, but when I got to the site's registration 
> page, Keychain didn't open to ask me if I wanted to save my user name 
> and passocode into Keychain for that site.

You're confused. That's not how it works. You don't have to open
Keychain Access when browsing the web for your computer to remember
passwords you enter on websites.

It's hard to imagine anyone using Macs for any length of time without
seeing at least one Safari dialog asking if you want to save a password.

How sure are you that the information wasn't saved in Keychain? Did you
open Keychain Access and search for the website in question to see if
there are any passwords saved for it?

Some websites (especially banking websites) are written to prevent
password managers from saving passwords. 

Which website are you referring to specifically? 

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#6768

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-11 14:32 -0800
Message-ID	<2018111114321828627-tomevans9890@yahoo.ca>
In reply to	#6764

On 2018-11-11 16:49:33 +0000, Jolly Roger said:

> On 2018-11-11, Tom Evans <tomevans9890@yahoo.ca> wrote:
>> 
>> I tried Keychain today, but it didn't work.  I even called it up with
>> Spotlight prior to getting to a Web site where I was planning to
>> register with that site, but when I got to the site's registration
>> page, Keychain didn't open to ask me if I wanted to save my user name
>> and passocode into Keychain for that site.
> 
> You're confused. That's not how it works. You don't have to open
> Keychain Access when browsing the web for your computer to remember
> passwords you enter on websites.

I know that Keychain is supposed to open by itself while one is on a 
passcode/username registration page, but I opened it anyway just in 
case, because I'm new to using it.

> It's hard to imagine anyone using Macs for any length of time without
> seeing at least one Safari dialog asking if you want to save a password.

I've seen that pop-up window many times, but this time it didn't 
appear.  When it appears, it gives me the option to save in keychain 
and "not now" or "never' or something like that.

My standard browser is Chrome.  Could that be an obstacle?

> How sure are you that the information wasn't saved in Keychain? Did you
> open Keychain Access and search for the website in question to see if
> there are any passwords saved for it?

Good point,  I just checked.  I did find in Keychain > Local Items 
folder, the Web site's URL, followed by "Passwords not saved").

I checked in all of Keychains folders by "Date Modified" but couldn't 
see any other informatin that related to this Web site.

> Some websites (especially banking websites) are written to prevent
> password managers from saving passwords.
> 
> Which website are you referring to specifically?

I don't want to reveal that, so as no to give too much information 
about myself to attacker/hackers from the newsgroups.  It's sufficient 
to explain that the Web site stores my lab test health reports, which 
are linked to my pharmacy.

Thank you, Jolly, for trying to help me.

Tom

[toc] | [prev] | [next] | [standalone]

#6769

From	Jolly Roger <jollyroger@pobox.com>
Date	2018-11-11 22:38 +0000
Message-ID	<g4rpabFjkdcU1@mid.individual.net>
In reply to	#6768

On 2018-11-11, Tom Evans <tomevans9890@yahoo.ca> wrote:
> On 2018-11-11 16:49:33 +0000, Jolly Roger said:
>
>> On 2018-11-11, Tom Evans <tomevans9890@yahoo.ca> wrote:
>>> 
>>> I tried Keychain today, but it didn't work.  I even called it up with
>>> Spotlight prior to getting to a Web site where I was planning to
>>> register with that site, but when I got to the site's registration
>>> page, Keychain didn't open to ask me if I wanted to save my user name
>>> and passocode into Keychain for that site.
>> 
>> You're confused. That's not how it works. You don't have to open
>> Keychain Access when browsing the web for your computer to remember
>> passwords you enter on websites.
>
> I know that Keychain is supposed to open by itself while one is on a 
> passcode/username registration page, but I opened it anyway just in 
> case, because I'm new to using it.
>
>> It's hard to imagine anyone using Macs for any length of time without
>> seeing at least one Safari dialog asking if you want to save a password.
>
> I've seen that pop-up window many times, but this time it didn't 
> appear.  When it appears, it gives me the option to save in keychain 
> and "not now" or "never' or something like that.
>
> My standard browser is Chrome.  Could that be an obstacle?

Keychain is integrated with Safari. Other browsers use their own often
less secure password storage mechanisms. Chrome is a crappy browser
choice anyway, IMO. It's a RAM and CPU hog, and has been known to gobble
disk space as well by storing update packages indefinitely.

>> How sure are you that the information wasn't saved in Keychain? Did you
>> open Keychain Access and search for the website in question to see if
>> there are any passwords saved for it?
>
> Good point,  I just checked.  I did find in Keychain > Local Items 
> folder, the Web site's URL, followed by "Passwords not saved").
>
> I checked in all of Keychains folders by "Date Modified" but couldn't 
> see any other informatin that related to this Web site.

That's because you weren't using Safari.

>> Some websites (especially banking websites) are written to prevent
>> password managers from saving passwords.
>> 
>> Which website are you referring to specifically?
>
> I don't want to reveal that, so as no to give too much information 
> about myself to attacker/hackers from the newsgroups.  It's sufficient 
> to explain that the Web site stores my lab test health reports, which 
> are linked to my pharmacy.

Medical websites also often try to prevent password saving measures.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#6773

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-12 13:27 -0800
Message-ID	<2018111213270320652-tomevans9890@yahoo.ca>
In reply to	#6769

On 2018-11-11 22:38:04 +0000, Jolly Roger said:

> On 2018-11-11, Tom Evans <tomevans9890@yahoo.ca> wrote:
>> On 2018-11-11 16:49:33 +0000, Jolly Roger said:
>> 
>>> On 2018-11-11, Tom Evans <tomevans9890@yahoo.ca> wrote:
>>>> 
>>>> I tried Keychain today, but it didn't work.  I even called it up with
>>>> Spotlight prior to getting to a Web site where I was planning to
>>>> register with that site, but when I got to the site's registration
>>>> page, Keychain didn't open to ask me if I wanted to save my user name
>>>> and passocode into Keychain for that site.
>>> 
>>> You're confused. That's not how it works. You don't have to open
>>> Keychain Access when browsing the web for your computer to remember
>>> passwords you enter on websites.
>> 
>> I know that Keychain is supposed to open by itself while one is on a
>> passcode/username registration page, but I opened it anyway just in
>> case, because I'm new to using it.
>> 
>>> It's hard to imagine anyone using Macs for any length of time without
>>> seeing at least one Safari dialog asking if you want to save a password.
>> 
>> I've seen that pop-up window many times, but this time it didn't
>> appear.  When it appears, it gives me the option to save in keychain
>> and "not now" or "never' or something like that.
>> 
>> My standard browser is Chrome.  Could that be an obstacle?
> 
> Keychain is integrated with Safari. Other browsers use their own often
> less secure password storage mechanisms. Chrome is a crappy browser
> choice anyway, IMO. It's a RAM and CPU hog, and has been known to gobble
> disk space as well by storing update packages indefinitely.

>>> How sure are you that the information wasn't saved in Keychain? Did you
>>> open Keychain Access and search for the website in question to see if
>>> there are any passwords saved for it?
>> 
>> Good point,  I just checked.  I did find in Keychain > Local Items
>> folder, the Web site's URL, followed by "Passwords not saved").
>> 
>> I checked in all of Keychains folders by "Date Modified" but couldn't
>> see any other informatin that related to this Web site.
> 
> That's because you weren't using Safari.

So I need to switch from Chrome back to Safari.  What do I need to know 
about that?  Are there likely to be issues with importing my Chrome 
bookmarks to Safari?

(I switched years ago from Safari to Chrome because Safari was very 
problematic.)

Thanks, Jolly!

Tom

[toc] | [prev] | [next] | [standalone]

#6780

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-13 21:19 -0800
Message-ID	<2018111321190411384-tomevans9890@yahoo.ca>
In reply to	#6735

On 2018-11-09 05:23:05 +0000, nospam said:

> the chances that someone hacked your mac is low, unless you clicked a
> phishing link, in which case, anything goes.
> 
> from your description of the unsubscribe link, it *probably* was not a
> phish, but that's impossible to know without examining the link.

If it did happen from phishing, and if I don't secure my sensitve data, 
could my Mac be phished again by the same attacker in the same way, to 
steal sensitive bank data that the attacker could again use to try to 
steal money from my credit card, or is there only one attack for each 
click on the wrong email link in my email inbox?

Tom

[toc] | [prev] | [next] | [standalone]

#6781

From	Your Name <YourName@YourISP.com>
Date	2018-11-14 18:38 +1300
Message-ID	<psgcdd$1ujq$1@gioia.aioe.org>
In reply to	#6780

On 2018-11-14 05:19:04 +0000, Tom Evans said:
> On 2018-11-09 05:23:05 +0000, nospam said:
>> 
>> the chances that someone hacked your mac is low, unless you clicked a
>> phishing link, in which case, anything goes.
>> 
>> from your description of the unsubscribe link, it *probably* was not a
>> phish, but that's impossible to know without examining the link.
> 
> If it did happen from phishing, and if I don't secure my sensitve data, 
> could my Mac be phished again by the same attacker in the same way, to 
> steal sensitive bank data that the attacker could again use to try to 
> steal money from my credit card, or is there only one attack for each 
> click on the wrong email link in my email inbox?

Phishing relies on you entering details into a faked version of a real website.

For example, you click the link in an email that is *supposedly* from 
your bank telling you you need to log into your account. That link 
takes you to a fake website that looks real, so you enter your user ID 
and password which teh website then stores for the hacker scumbags, and 
then it tells you the password is wrong and sends you to the real 
banking login page, where you login in as normal. You assume you made a 
typo and don't worry about it ... but the hacker scumbag now has your 
banking user ID and password they can use whenever they want.

Because many people re-use passwords for various websites, obtaining 
your password may let the hacker scumbag get into those different 
websites, not necessarily connected to the original phishing email.

Once you change your password, then the information the hacker scumbag 
has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
*CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
the hacker scumbag can still get into your account.

You can always tell the phishing link by simply pointing (not clicking) 
the mouse cursor at it. Most email apps and webmail systems will show 
you the link the email will be going to. The first part (before the 
firts slash character) of a real one will end with something like 
MyBank.com, while a faked one will be something else - sometimes it may 
look real like MyBank.somewhere-else.com, but that is faked and is 
going to somewhere-else.com, not MyBank.com.

The easiest way to avoid this is to NEVER click a link in an email 
asking you to login for some reason. Instead go to your webbrowser and 
manually go to the bank's real website to login as normal.



There are other ways nasty people can get your information. You might 
get an email / see a web-advert for a competition with an amazing prize 
... unless it's a well known organisation running the competition, stay 
well clear because it may be a case of "too good to be true" and is 
simply using the 'competition' entry form to get your name, address, 
phone number, etc. Once they have those, it can be relatively easy to 
obtain other details.

[toc] | [prev] | [next] | [standalone]

#6789

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-15 13:24 -0800
Message-ID	<2018111513244194158-tomevans9890@yahoo.ca>
In reply to	#6781

On 2018-11-14 05:38:54 +0000, Your Name said:

> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>> On 2018-11-09 05:23:05 +0000, nospam said:
>>> 
>>> the chances that someone hacked your mac is low, unless you clicked a
>>> phishing link, in which case, anything goes.
>>> 
>>> from your description of the unsubscribe link, it *probably* was not a
>>> phish, but that's impossible to know without examining the link.
>> 
>> If it did happen from phishing, and if I don't secure my sensitve data, 
>> could my Mac be phished again by the same attacker in the same way, to 
>> steal sensitive bank data that the attacker could again use to try to 
>> steal money from my credit card, or is there only one attack for each 
>> click on the wrong email link in my email inbox?
> 
> Phishing relies on you entering details into a faked version of a real website.
> 
> For example, you click the link in an email that is *supposedly* from 
> your bank telling you you need to log into your account. That link 
> takes you to a fake website that looks real, so you enter your user ID 
> and password which teh website then stores for the hacker scumbags, and 
> then it tells you the password is wrong and sends you to the real 
> banking login page, where you login in as normal. You assume you made a 
> typo and don't worry about it ... but the hacker scumbag now has your 
> banking user ID and password they can use whenever they want.
> 
> Because many people re-use passwords for various websites, obtaining 
> your password may let the hacker scumbag get into those different 
> websites, not necessarily connected to the original phishing email.
> 
> Once you change your password, then the information the hacker scumbag 
> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
> the hacker scumbag can still get into your account.

Thanks, Your.

Which account are you referring to, that I should change my passcode for?

> You can always tell the phishing link by simply pointing (not clicking) 
> the mouse cursor at it. Most email apps and webmail systems will show 
> you the link the email will be going to. The first part (before the 
> firts slash character) of a real one will end with something like 
> MyBank.com, while a faked one will be something else - sometimes it may 
> look real like MyBank.somewhere-else.com, but that is faked and is 
> going to somewhere-else.com, not MyBank.com.

> The easiest way to avoid this is to NEVER click a link in an email 
> asking you to login for some reason. Instead go to your webbrowser and 
> manually go to the bank's real website to login as normal.

I didn't do that.  I did recently get an email that I thought was from 
my bank, but after this crisis I realized it was a fake email.  But I 
didn't try to log into my bank account by pressing on the link in the 
email.  All I did was to press the "Unsubscribe" button on the Web page 
that appeared after I pressed a link in the email.

> There are other ways nasty people can get your information. You might 
> get an email / see a web-advert for a competition with an amazing prize 
> ... unless it's a well known organisation running the competition, stay 
> well clear because it may be a case of "too good to be true" and is 
> simply using the 'competition' entry form to get your name, address, 
> phone number, etc. Once they have those, it can be relatively easy to 
> obtain other details.

I also didn't do that.

Tom

[toc] | [prev] | [next] | [standalone]

#6795

From	Your Name <YourName@YourISP.com>
Date	2018-11-16 14:23 +1300
Message-ID	<psl65o$1sh4$1@gioia.aioe.org>
In reply to	#6789

On 2018-11-15 21:24:41 +0000, Tom Evans said:
> On 2018-11-14 05:38:54 +0000, Your Name said:
>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>> 
>>>> the chances that someone hacked your mac is low, unless you clicked a
>>>> phishing link, in which case, anything goes.
>>>> 
>>>> from your description of the unsubscribe link, it *probably* was not a
>>>> phish, but that's impossible to know without examining the link.
>>> 
>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>> could my Mac be phished again by the same attacker in the same way, to 
>>> steal sensitive bank data that the attacker could again use to try to 
>>> steal money from my credit card, or is there only one attack for each 
>>> click on the wrong email link in my email inbox?
>> 
>> Phishing relies on you entering details into a faked version of a real website.
>> 
>> For example, you click the link in an email that is *supposedly* from 
>> your bank telling you you need to log into your account. That link 
>> takes you to a fake website that looks real, so you enter your user ID 
>> and password which teh website then stores for the hacker scumbags, and 
>> then it tells you the password is wrong and sends you to the real 
>> banking login page, where you login in as normal. You assume you made a 
>> typo and don't worry about it ... but the hacker scumbag now has your 
>> banking user ID and password they can use whenever they want.
>> 
>> Because many people re-use passwords for various websites, obtaining 
>> your password may let the hacker scumbag get into those different 
>> websites, not necessarily connected to the original phishing email.
>> 
>> Once you change your password, then the information the hacker scumbag 
>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>> the hacker scumbag can still get into your account.
> 
> Thanks, Your.
> 
> Which account are you referring to, that I should change my passcode for?

Whichever one you think was supposedly hacked, but since you don't 
know, you'll have to change them all ... or at least all the ones that 
have any connection to the bank account or to other internet accounts 
that have connection to that bank account.

You'll also have to change the password, etc. for that bank account 
itself via a bank branch taking proof of identity with you.



>> You can always tell the phishing link by simply pointing (not clicking) 
>> the mouse cursor at it. Most email apps and webmail systems will show 
>> you the link the email will be going to. The first part (before the 
>> firts slash character) of a real one will end with something like 
>> MyBank.com, while a faked one will be something else - sometimes it may 
>> look real like MyBank.somewhere-else.com, but that is faked and is 
>> going to somewhere-else.com, not MyBank.com.
>> 
>> The easiest way to avoid this is to NEVER click a link in an email 
>> asking you to login for some reason. Instead go to your webbrowser and 
>> manually go to the bank's real website to login as normal.
> 
> I didn't do that.  I did recently get an email that I thought was from 
> my bank, but after this crisis I realized it was a fake email.  But I 
> didn't try to log into my bank account by pressing on the link in the 
> email.  All I did was to press the "Unsubscribe" button on the Web page 
> that appeared after I pressed a link in the email.
> 
>> There are other ways nasty people can get your information. You might 
>> get an email / see a web-advert for a competition with an amazing prize 
>> ... unless it's a well known organisation running the competition, stay 
>> well clear because it may be a case of "too good to be true" and is 
>> simply using the 'competition' entry form to get your name, address, 
>> phone number, etc. Once they have those, it can be relatively easy to 
>> obtain other details.
> 
> I also didn't do that.

You'd be surprised where and how often people enter their details 
without even a second thought.

[toc] | [prev] | [next] | [standalone]

#6799

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-15 19:14 -0800
Message-ID	<2018111519144913678-tomevans9890@yahoo.ca>
In reply to	#6795

On 2018-11-16 01:23:06 +0000, Your Name said:

> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>> 
>>>>> the chances that someone hacked your mac is low, unless you clicked a
>>>>> phishing link, in which case, anything goes.
>>>>> 
>>>>> from your description of the unsubscribe link, it *probably* was not a
>>>>> phish, but that's impossible to know without examining the link.
>>>> 
>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>> steal sensitive bank data that the attacker could again use to try to 
>>>> steal money from my credit card, or is there only one attack for each 
>>>> click on the wrong email link in my email inbox?
>>> 
>>> Phishing relies on you entering details into a faked version of a real website.
>>> 
>>> For example, you click the link in an email that is *supposedly* from 
>>> your bank telling you you need to log into your account. That link 
>>> takes you to a fake website that looks real, so you enter your user ID 
>>> and password which teh website then stores for the hacker scumbags, and 
>>> then it tells you the password is wrong and sends you to the real 
>>> banking login page, where you login in as normal. You assume you made a 
>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>> banking user ID and password they can use whenever they want.
>>> 
>>> Because many people re-use passwords for various websites, obtaining 
>>> your password may let the hacker scumbag get into those different 
>>> websites, not necessarily connected to the original phishing email.
>>> 
>>> Once you change your password, then the information the hacker scumbag 
>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>> the hacker scumbag can still get into your account.
>> 
>> Thanks, Your.
>> 
>> Which account are you referring to, that I should change my passcode for?
> 
> Whichever one you think was supposedly hacked, but since you don't 
> know, you'll have to change them all ... or at least all the ones that 
> have any connection to the bank account or to other internet accounts 
> that have connection to that bank account.

Do you mean my computer account or my bank accnounts?  You still 
haven't specified that.

> You'll also have to change the password, etc. for that bank account 
> itself via a bank branch taking proof of identity with you.

My banking information has all been changed.

>>> You can always tell the phishing link by simply pointing (not clicking) 
>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>> you the link the email will be going to. The first part (before the 
>>> firts slash character) of a real one will end with something like 
>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>> going to somewhere-else.com, not MyBank.com.
>>> 
>>> The easiest way to avoid this is to NEVER click a link in an email 
>>> asking you to login for some reason. Instead go to your webbrowser and 
>>> manually go to the bank's real website to login as normal.
>> 
>> I didn't do that.  I did recently get an email that I thought was from 
>> my bank, but after this crisis I realized it was a fake email.  But I 
>> didn't try to log into my bank account by pressing on the link in the 
>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>> that appeared after I pressed a link in the email.
>> 
>>> There are other ways nasty people can get your information. You might 
>>> get an email / see a web-advert for a competition with an amazing prize 
>>> ... unless it's a well known organisation running the competition, stay 
>>> well clear because it may be a case of "too good to be true" and is 
>>> simply using the 'competition' entry form to get your name, address, 
>>> phone number, etc. Once they have those, it can be relatively easy to 
>>> obtain other details.
>> 
>> I also didn't do that.
> 
> You'd be surprised where and how often people enter their details 
> without even a second thought.

I DO -- and I DID -- give it a second thought, and I DID NOT enter any 
such competitons recently or earlier.

Tom

[toc] | [prev] | [next] | [standalone]

#6802

From	Your Name <YourName@YourISP.com>
Date	2018-11-16 18:41 +1300
Message-ID	<psll9r$flq$1@gioia.aioe.org>
In reply to	#6799

On 2018-11-16 03:14:49 +0000, Tom Evans said:
> On 2018-11-16 01:23:06 +0000, Your Name said:
>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>> 
>>>>>> the chances that someone hacked your mac is low, unless you clicked a
>>>>>> phishing link, in which case, anything goes.
>>>>>> 
>>>>>> from your description of the unsubscribe link, it *probably* was not a
>>>>>> phish, but that's impossible to know without examining the link.
>>>>> 
>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>> steal money from my credit card, or is there only one attack for each 
>>>>> click on the wrong email link in my email inbox?
>>>> 
>>>> Phishing relies on you entering details into a faked version of a real website.
>>>> 
>>>> For example, you click the link in an email that is *supposedly* from 
>>>> your bank telling you you need to log into your account. That link 
>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>> and password which teh website then stores for the hacker scumbags, and 
>>>> then it tells you the password is wrong and sends you to the real 
>>>> banking login page, where you login in as normal. You assume you made a 
>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>> banking user ID and password they can use whenever they want.
>>>> 
>>>> Because many people re-use passwords for various websites, obtaining 
>>>> your password may let the hacker scumbag get into those different 
>>>> websites, not necessarily connected to the original phishing email.
>>>> 
>>>> Once you change your password, then the information the hacker scumbag 
>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>> the hacker scumbag can still get into your account.
>>> 
>>> Thanks, Your.
>>> 
>>> Which account are you referring to, that I should change my passcode for?
>> 
>> Whichever one you think was supposedly hacked, but since you don't 
>> know, you'll have to change them all ... or at least all the ones that 
>> have any connection to the bank account or to other internet accounts 
>> that have connection to that bank account.
> 
> Do you mean my computer account or my bank accnounts?  You still 
> haven't specified that.

Because there's no way I can know. There's no way you can know either, 
nor can you know if it was or wasn't anything to do with the computer 
at all. At the very least you should change the passwords for your bank 
account and your email account.



>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>> you the link the email will be going to. The first part (before the 
>>>> firts slash character) of a real one will end with something like 
>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>> going to somewhere-else.com, not MyBank.com.
>>>> 
>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>> manually go to the bank's real website to login as normal.
>>> 
>>> I didn't do that.  I did recently get an email that I thought was from 
>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>> didn't try to log into my bank account by pressing on the link in the 
>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>> that appeared after I pressed a link in the email.

There's no point in unsubscribing from fake emails. If it is a scumbag, 
then you won't get unsubscribed and you'll simply be telling them that 
someone is opening the emails.



>>>> There are other ways nasty people can get your information. You might 
>>>> get an email / see a web-advert for a competition with an amazing prize 
>>>> ... unless it's a well known organisation running the competition, stay 
>>>> well clear because it may be a case of "too good to be true" and is 
>>>> simply using the 'competition' entry form to get your name, address, 
>>>> phone number, etc. Once they have those, it can be relatively easy to 
>>>> obtain other details.
>>> 
>>> I also didn't do that.
>> 
>> You'd be surprised where and how often people enter their details 
>> without even a second thought.
> 
> I DO -- and I DID -- give it a second thought, and I DID NOT enter any 
> such competitons recently or earlier.

Competitions was only one example of a potential cause. Phishing 
emails, weird software update requests (with you entering the admin 
password to install it), strange phones calls from fake "help desk" 
staff saying they know something is wrong with your computer, etc., 
etc. ... there's a ton of options and that's even assuming that your 
computer was actually hacked, which is highly unlikely,

[toc] | [prev] | [next] | [standalone]

#6807

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-16 08:07 -0800
Message-ID	<2018111608075639149-tomevans9890@yahoo.ca>
In reply to	#6802

On 2018-11-16 05:41:15 +0000, Your Name said:

> On 2018-11-16 03:14:49 +0000, Tom Evans said:
>> On 2018-11-16 01:23:06 +0000, Your Name said:
>>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>>> 
>>>>>>> the chances that someone hacked your mac is low, unless you clicked a
>>>>>>> phishing link, in which case, anything goes.
>>>>>>> 
>>>>>>> from your description of the unsubscribe link, it *probably* was not a
>>>>>>> phish, but that's impossible to know without examining the link.
>>>>>> 
>>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>>> steal money from my credit card, or is there only one attack for each 
>>>>>> click on the wrong email link in my email inbox?
>>>>> 
>>>>> Phishing relies on you entering details into a faked version of a real website.
>>>>> 
>>>>> For example, you click the link in an email that is *supposedly* from 
>>>>> your bank telling you you need to log into your account. That link 
>>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>>> and password which teh website then stores for the hacker scumbags, and 
>>>>> then it tells you the password is wrong and sends you to the real 
>>>>> banking login page, where you login in as normal. You assume you made a 
>>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>>> banking user ID and password they can use whenever they want.
>>>>> 
>>>>> Because many people re-use passwords for various websites, obtaining 
>>>>> your password may let the hacker scumbag get into those different 
>>>>> websites, not necessarily connected to the original phishing email.
>>>>> 
>>>>> Once you change your password, then the information the hacker scumbag 
>>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>>> the hacker scumbag can still get into your account.
>>>> 
>>>> Thanks, Your.
>>>> 
>>>> Which account are you referring to, that I should change my passcode for?
>>> 
>>> Whichever one you think was supposedly hacked, but since you don't 
>>> know, you'll have to change them all ... or at least all the ones that 
>>> have any connection to the bank account or to other internet accounts 
>>> that have connection to that bank account.
>> 
>> Do you mean my computer account or my bank accnounts?  You still 
>> haven't specified that.
> 
> Because there's no way I can know. There's no way you can know either, 
> nor can you know if it was or wasn't anything to do with the computer 
> at all. At the very least you should change the passwords for your bank 
> account and your email account.
> 
> 
> 
>>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>>> you the link the email will be going to. The first part (before the 
>>>>> firts slash character) of a real one will end with something like 
>>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>>> going to somewhere-else.com, not MyBank.com.
>>>>> 
>>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>>> manually go to the bank's real website to login as normal.
>>>> 
>>>> I didn't do that.  I did recently get an email that I thought was from 
>>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>>> didn't try to log into my bank account by pressing on the link in the 
>>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>>> that appeared after I pressed a link in the email.
> 
> There's no point in unsubscribing from fake emails. If it is a scumbag, 
> then you won't get unsubscribed and you'll simply be telling them that 
> someone is opening the emails.

That's not the point.  The point is that people keep telling me the 
danger is from clicking a link in emails and then typing passcodes and 
account numbers on the resulting pages.  I keep repeating that I didn't 
do that.  But then you change your position, stating that pressing on 
an "Unsubscribe" button on a Web site is just as dangerous.

Tom


>>>>> There are other ways nasty people can get your information. You might 
>>>>> get an email / see a web-advert for a competition with an amazing prize 
>>>>> ... unless it's a well known organisation running the competition, stay 
>>>>> well clear because it may be a case of "too good to be true" and is 
>>>>> simply using the 'competition' entry form to get your name, address, 
>>>>> phone number, etc. Once they have those, it can be relatively easy to 
>>>>> obtain other details.
>>>> 
>>>> I also didn't do that.
>>> 
>>> You'd be surprised where and how often people enter their details 
>>> without even a second thought.
>> 
>> I DO -- and I DID -- give it a second thought, and I DID NOT enter any 
>> such competitons recently or earlier.
> 
> Competitions was only one example of a potential cause. Phishing 
> emails, weird software update requests (with you entering the admin 
> password to install it), strange phones calls from fake "help desk" 
> staff saying they know something is wrong with your computer, etc., 
> etc. ... there's a ton of options and that's even assuming that your 
> computer was actually hacked, which is highly unlikely,

[toc] | [prev] | [next] | [standalone]

#6813

From	Your Name <YourName@YourISP.com>
Date	2018-11-17 09:43 +1300
Message-ID	<psna5g$1ac5$1@gioia.aioe.org>
In reply to	#6807

On 2018-11-16 16:07:56 +0000, Tom Evans said:
> On 2018-11-16 05:41:15 +0000, Your Name said:
>> On 2018-11-16 03:14:49 +0000, Tom Evans said:
>>> On 2018-11-16 01:23:06 +0000, Your Name said:
>>>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>>>> 
>>>>>>>> the chances that someone hacked your mac is low, unless you clicked a
>>>>>>>> phishing link, in which case, anything goes.
>>>>>>>> 
>>>>>>>> from your description of the unsubscribe link, it *probably* was not a
>>>>>>>> phish, but that's impossible to know without examining the link.
>>>>>>> 
>>>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>>>> steal money from my credit card, or is there only one attack for each 
>>>>>>> click on the wrong email link in my email inbox?
>>>>>> 
>>>>>> Phishing relies on you entering details into a faked version of a real website.
>>>>>> 
>>>>>> For example, you click the link in an email that is *supposedly* from 
>>>>>> your bank telling you you need to log into your account. That link 
>>>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>>>> and password which teh website then stores for the hacker scumbags, and 
>>>>>> then it tells you the password is wrong and sends you to the real 
>>>>>> banking login page, where you login in as normal. You assume you made a 
>>>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>>>> banking user ID and password they can use whenever they want.
>>>>>> 
>>>>>> Because many people re-use passwords for various websites, obtaining 
>>>>>> your password may let the hacker scumbag get into those different 
>>>>>> websites, not necessarily connected to the original phishing email.
>>>>>> 
>>>>>> Once you change your password, then the information the hacker scumbag 
>>>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>>>> the hacker scumbag can still get into your account.
>>>>> 
>>>>> Thanks, Your.
>>>>> 
>>>>> Which account are you referring to, that I should change my passcode for?
>>>> 
>>>> Whichever one you think was supposedly hacked, but since you don't 
>>>> know, you'll have to change them all ... or at least all the ones that 
>>>> have any connection to the bank account or to other internet accounts 
>>>> that have connection to that bank account.
>>> 
>>> Do you mean my computer account or my bank accnounts?  You still 
>>> haven't specified that.
>> 
>> Because there's no way I can know. There's no way you can know either, 
>> nor can you know if it was or wasn't anything to do with the computer 
>> at all. At the very least you should change the passwords for your bank 
>> account and your email account.
>> 
>> 
>> 
>>>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>>>> you the link the email will be going to. The first part (before the 
>>>>>> firts slash character) of a real one will end with something like 
>>>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>>>> going to somewhere-else.com, not MyBank.com.
>>>>>> 
>>>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>>>> manually go to the bank's real website to login as normal.
>>>>> 
>>>>> I didn't do that.  I did recently get an email that I thought was from 
>>>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>>>> didn't try to log into my bank account by pressing on the link in the 
>>>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>>>> that appeared after I pressed a link in the email.
>> 
>> There's no point in unsubscribing from fake emails. If it is a scumbag, 
>> then you won't get unsubscribed and you'll simply be telling them that 
>> someone is opening the emails.
> 
> That's not the point.  The point is that people keep telling me the 
> danger is from clicking a link in emails and then typing passcodes and 
> account numbers on the resulting pages.  I keep repeating that I didn't 
> do that.  But then you change your position, stating that pressing on 
> an "Unsubscribe" button on a Web site is just as dangerous.

Again: That was simply ONE example way you could have inadvertently 
given away your details. There are various other ways, including ones 
that have nothing to do with the computer at all. There's no possible 
way to know exactly how someone got your bank account details, but the 
chances of some hacker getting into your Mac to read a text file stored 
on it's drive are basically zero.

[toc] | [prev] | [next] | [standalone]

#6826

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-18 13:33 -0800
Message-ID	<2018111813332388718-tomevans9890@yahoo.ca>
In reply to	#6813

On 2018-11-16 20:43:30 +0000, Your Name said:

> On 2018-11-16 16:07:56 +0000, Tom Evans said:
>> On 2018-11-16 05:41:15 +0000, Your Name said:
>>> On 2018-11-16 03:14:49 +0000, Tom Evans said:
>>>> On 2018-11-16 01:23:06 +0000, Your Name said:
>>>>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>>>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>>>>> 
>>>>>>>>> the chances that someone hacked your mac is low, unless you clicked a
>>>>>>>>> phishing link, in which case, anything goes.
>>>>>>>>> 
>>>>>>>>> from your description of the unsubscribe link, it *probably* was not a
>>>>>>>>> phish, but that's impossible to know without examining the link.
>>>>>>>> 
>>>>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>>>>> steal money from my credit card, or is there only one attack for each 
>>>>>>>> click on the wrong email link in my email inbox?
>>>>>>> 
>>>>>>> Phishing relies on you entering details into a faked version of a real website.
>>>>>>> 
>>>>>>> For example, you click the link in an email that is *supposedly* from 
>>>>>>> your bank telling you you need to log into your account. That link 
>>>>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>>>>> and password which teh website then stores for the hacker scumbags, and 
>>>>>>> then it tells you the password is wrong and sends you to the real 
>>>>>>> banking login page, where you login in as normal. You assume you made a 
>>>>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>>>>> banking user ID and password they can use whenever they want.
>>>>>>> 
>>>>>>> Because many people re-use passwords for various websites, obtaining 
>>>>>>> your password may let the hacker scumbag get into those different 
>>>>>>> websites, not necessarily connected to the original phishing email.
>>>>>>> 
>>>>>>> Once you change your password, then the information the hacker scumbag 
>>>>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>>>>> the hacker scumbag can still get into your account.
>>>>>> 
>>>>>> Thanks, Your.
>>>>>> 
>>>>>> Which account are you referring to, that I should change my passcode for?
>>>>> 
>>>>> Whichever one you think was supposedly hacked, but since you don't 
>>>>> know, you'll have to change them all ... or at least all the ones that 
>>>>> have any connection to the bank account or to other internet accounts 
>>>>> that have connection to that bank account.
>>>> 
>>>> Do you mean my computer account or my bank accnounts?  You still 
>>>> haven't specified that.
>>> 
>>> Because there's no way I can know. There's no way you can know either, 
>>> nor can you know if it was or wasn't anything to do with the computer 
>>> at all. At the very least you should change the passwords for your bank 
>>> account and your email account.

I've changed my bank account passcodes.

How could my email be a security leak?  I neither send nor receive any 
sensitive bank information by email -- either via Mail or Outlook.

>>>>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>>>>> you the link the email will be going to. The first part (before the 
>>>>>>> firts slash character) of a real one will end with something like 
>>>>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>>>>> going to somewhere-else.com, not MyBank.com.
>>>>>>> 
>>>>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>>>>> manually go to the bank's real website to login as normal.
>>>>>> 
>>>>>> I didn't do that.  I did recently get an email that I thought was from 
>>>>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>>>>> didn't try to log into my bank account by pressing on the link in the 
>>>>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>>>>> that appeared after I pressed a link in the email.
>>> 
>>> There's no point in unsubscribing from fake emails. If it is a scumbag, 
>>> then you won't get unsubscribed and you'll simply be telling them that 
>>> someone is opening the emails.
>> 
>> That's not the point.  The point is that people keep telling me the 
>> danger is from clicking a link in emails and then typing passcodes and 
>> account numbers on the resulting pages.  I keep repeating that I didn't 
>> do that.  But then you change your position, stating that pressing on 
>> an "Unsubscribe" button on a Web site is just as dangerous.
> 
> Again: That was simply ONE example way you could have inadvertently 
> given away your details. There are various other ways, including ones 
> that have nothing to do with the computer at all. There's no possible 
> way to know exactly how someone got your bank account details, but the 
> chances of some hacker getting into your Mac to read a text file stored 
> on it's drive are basically zero.

Your assurance sounds reassuring, and a few Apple tech support people 
whom I consulted about this agree with you, but Jolly and Nospam 
strongly disagree with you, so I still don't know which side to 
believe, and whether or not I should get a security information program 
such as Ipasscode to store my sensitive data on to prevent another 
attack, or if I don't need to do so because text files on Macs are 
already secure, and because the attack was conducted through a security 
leak that didn't involve my negligence.

As with so many other issues, there are two camps with adamant opposite 
views on this basic issue.


Also, I still didn't get an answer about whether or not Apple's Notes 
program (which can be locked with a passcode) would be an advisable 
place to store my passcodes, user names and similar sensitve 
information.

Tom

[toc] | [prev] | [next] | [standalone]

Page 3 of 7 — ← Prev page 1 2 [3] 4 5 6 7 Next page →

csiph-web

Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

Contents

#6783

#6787

#6792

#6788

#6794

#6743

#6756

#6764

#6768

#6769

#6773

#6780

#6781

#6789

#6795

#6799

#6802

#6807

#6813

#6826