Groups > comp.sys.mac.misc > #6717 > unrolled thread

Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

Started by	Tom Evans <tomevans9890@yahoo.ca>
First post	2018-11-07 21:59 -0800
Last post	2018-11-08 20:22 +0000
Articles	20 on this page of 131 — 7 participants

Back to article view | Back to comp.sys.mac.misc

Page 4 of 7 — ← Prev page 1 2 3 [4] 5 6 7 Next page →

#6827

From	nospam <nospam@nospam.invalid>
Date	2018-11-18 16:40 -0500
Message-ID	<181120181640326418%nospam@nospam.invalid>
In reply to	#6826

In article <2018111813332388718-tomevans9890@yahoo.ca>, Tom Evans
<tomevans9890@yahoo.ca> wrote:

> > Again: That was simply ONE example way you could have inadvertently 
> > given away your details. There are various other ways, including ones 
> > that have nothing to do with the computer at all. There's no possible 
> > way to know exactly how someone got your bank account details, but the 
> > chances of some hacker getting into your Mac to read a text file stored 
> > on it's drive are basically zero.
> 
> Your assurance sounds reassuring, and a few Apple tech support people 
> whom I consulted about this agree with you, but Jolly and Nospam 
> strongly disagree with you, so I still don't know which side to 
> believe, and whether or not I should get a security information program 
> such as Ipasscode to store my sensitive data on to prevent another 
> attack, or if I don't need to do so because text files on Macs are 
> already secure, and because the attack was conducted through a security 
> leak that didn't involve my negligence.

nothing i've said disagrees with that, other than if someone *does*
gain access to your system, a file called 'passwords.txt' is going to
be the first place they're going to look.

> As with so many other issues, there are two camps with adamant opposite 
> views on this basic issue.

no there aren't.

> Also, I still didn't get an answer about whether or not Apple's Notes 
> program (which can be locked with a passcode) would be an advisable 
> place to store my passcodes, user names and similar sensitve 
> information.

yes you did.

use a password manager because it's designed specifically for that task.

[toc] | [prev] | [next] | [standalone]

#6831

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-18 14:39 -0800
Message-ID	<2018111814393949511-tomevans9890@yahoo.ca>
In reply to	#6827

On 2018-11-18 21:40:32 +0000, nospam said:

> In article <2018111813332388718-tomevans9890@yahoo.ca>, Tom Evans
> <tomevans9890@yahoo.ca> wrote:
> 
>>> Again: That was simply ONE example way you could have inadvertently
>>> given away your details. There are various other ways, including ones
>>> that have nothing to do with the computer at all. There's no possible
>>> way to know exactly how someone got your bank account details, but the
>>> chances of some hacker getting into your Mac to read a text file stored
>>> on it's drive are basically zero.
>> 
>> Your assurance sounds reassuring, and a few Apple tech support people
>> whom I consulted about this agree with you, but Jolly and Nospam
>> strongly disagree with you, so I still don't know which side to
>> believe, and whether or not I should get a security information program
>> such as Ipasscode to store my sensitive data on to prevent another
>> attack, or if I don't need to do so because text files on Macs are
>> already secure, and because the attack was conducted through a security
>> leak that didn't involve my negligence.
> 
> nothing i've said disagrees with that, other than if someone *does*
> gain access to your system, a file called 'passwords.txt' is going to
> be the first place they're going to look.

Since this crisis, I changed the name of my file to something 
inconspicuous and then even trashed the version of that file on my 
computer, and have had my external drives off.  (I assume that access 
could also be gained by having the back-up files on my external drives.)

>> As with so many other issues, there are two camps with adamant opposite
>> views on this basic issue.
> 
> no there aren't.
> 
>> Also, I still didn't get an answer about whether or not Apple's Notes
>> program (which can be locked with a passcode) would be an advisable
>> place to store my passcodes, user names and similar sensitve
>> information.
> 
> yes you did.
> 
> use a password manager because it's designed specifically for that task.

Thanks, Nospam!

Are there any passcode managers that allow me to make my own notes 
alphabetically and use my own passcodes and allows users to print the 
alphabetical list that I would make?

Kaychain and Ipassword don't fit those qualifications.

Tom

[toc] | [prev] | [next] | [standalone]

#6834

From	nospam <nospam@nospam.invalid>
Date	2018-11-18 20:28 -0500
Message-ID	<181120182028337279%nospam@nospam.invalid>
In reply to	#6831

In article <2018111814393949511-tomevans9890@yahoo.ca>, Tom Evans
<tomevans9890@yahoo.ca> wrote:

> 
> Are there any passcode managers that allow me to make my own notes 
> alphabetically and use my own passcodes and allows users to print the 
> alphabetical list that I would make?
> 
> Kaychain and Ipassword don't fit those qualifications.

1password supports secure notes, either associated with a password
entry or an entirely separate note.
there is no need to print the passwords, and doing so is foolish.

[toc] | [prev] | [next] | [standalone]

#6837

From	Your Name <YourName@YourISP.com>
Date	2018-11-19 14:33 +1300
Message-ID	<pst3u4$5d4$1@gioia.aioe.org>
In reply to	#6831

On 2018-11-18 22:39:39 +0000, Tom Evans said:
> 
> Are there any passcode managers that allow me to make my own notes 
> alphabetically and use my own passcodes and allows users to print the 
> alphabetical list that I would make?
> 
> Kaychain and Ipassword don't fit those qualifications.

1Password has a Notes field that you can type anything you want into 
... but it can't do formatting of that text, which is what you wanted 
at one point. I don't any password manager will have the ability to 
format the text in the fields because it's largely pointless to the 
requirements of managing passwords.

You could create your own "password manager" in a database app like 
FileMaker Pro if you really needed such a feature, but it wouldn't be 
able to automatically fill in forms in a web browser like most real 
password manager apps can.

[toc] | [prev] | [next] | [standalone]

#6838

From	nospam <nospam@nospam.invalid>
Date	2018-11-18 20:35 -0500
Message-ID	<181120182035201726%nospam@nospam.invalid>
In reply to	#6837

In article <pst3u4$5d4$1@gioia.aioe.org>, Your Name
<YourName@YourISP.com> wrote:

> > Are there any passcode managers that allow me to make my own notes 
> > alphabetically and use my own passcodes and allows users to print the 
> > alphabetical list that I would make?
> > 
> > Kaychain and Ipassword don't fit those qualifications.
> 
> 1Password has a Notes field that you can type anything you want into 
> ... but it can't do formatting of that text, which is what you wanted 

yes it can.

> at one point. I don't any password manager will have the ability to 
> format the text in the fields because it's largely pointless to the 
> requirements of managing passwords.

maybe to you, but others don't consider it pointless.

> You could create your own "password manager" in a database app like 
> FileMaker Pro if you really needed such a feature, but it wouldn't be 
> able to automatically fill in forms in a web browser like most real 
> password manager apps can.

no point in that nor is it secure.

[toc] | [prev] | [next] | [standalone]

#6843

From	Chris Ridd <chrisridd@mac.com>
Date	2018-11-19 07:25 +0000
Message-ID	<pstoh0$v4t$1@dont-email.me>
In reply to	#6831

On 18/11/2018 22:39, Tom Evans wrote:
> Are there any passcode managers that allow me to make my own notes 
> alphabetically and use my own passcodes and allows users to print the 
> alphabetical list that I would make?
> 
> Kaychain and Ipassword don't fit those qualifications.

1Password can export into an unencrypted CSV file, which you can then 
import into Numbers/Excel/etc to print if you so want. Printing might 
make sense if you're keeping them in something like a fire-proof safe, 
but if you're going to keep the hard copy around and accessible you're 
just opening a wide open security hole. Why not save your money on 
1Password and write your passwords on post-it notes in that case?

-- 
Chris

[toc] | [prev] | [next] | [standalone]

#6844

From	Your Name <YourName@YourISP.com>
Date	2018-11-20 07:55 +1300
Message-ID	<psv0ue$1942$1@gioia.aioe.org>
In reply to	#6843

On 2018-11-19 07:25:20 +0000, Chris Ridd said:
> On 18/11/2018 22:39, Tom Evans wrote:
>> Are there any passcode managers that allow me to make my own notes 
>> alphabetically and use my own passcodes and allows users to print the 
>> alphabetical list that I would make?
>> 
>> Kaychain and Ipassword don't fit those qualifications.
> 
> 1Password can export into an unencrypted CSV file, which you can then 
> import into Numbers/Excel/etc to print if you so want. Printing might 
> make sense if you're keeping them in something like a fire-proof safe, 
> but if you're going to keep the hard copy around and accessible you're 
> just opening a wide open security hole. Why not save your money on 
> 1Password and write your passwords on post-it notes in that case?

You could just not bother remembering them at all and use the websites' 
option to remind you, or even better change it. Yes, it's a hassle 
having to keep going through that process, but at least for many 
websites it also forces you to change your password regularly.

[toc] | [prev] | [next] | [standalone]

#6849

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-25 18:54 -0800
Message-ID	<2018112518541256647-tomevans9890@yahoo.ca>
In reply to	#6843

On 2018-11-19 07:25:20 +0000, Chris Ridd said:

> On 18/11/2018 22:39, Tom Evans wrote:
>> Are there any passcode managers that allow me to make my own notes 
>> alphabetically and use my own passcodes and allows users to print the 
>> alphabetical list that I would make?
>> 
>> Kaychain and Ipassword don't fit those qualifications.
> 
> 1Password can export into an unencrypted CSV file, which you can then 
> import into Numbers/Excel/etc to print if you so want. Printing might 
> make sense if you're keeping them in something like a fire-proof safe, 
> but if you're going to keep the hard copy around and accessible you're 
> just opening a wide open security hole. Why not save your money on 
> 1Password and write your passwords on post-it notes in that case?

I can't easily copy a long URL or other long pieces of text with 
Post-It Notes.  And going through hundreds of Post-It notes, and trying 
to keep them in alphabetical order would be awkward.

It's also an absurd suggestion because Post-It notes are far too small.

Tom

[toc] | [prev] | [next] | [standalone]

#6836

From	Your Name <YourName@YourISP.com>
Date	2018-11-19 14:30 +1300
Message-ID	<pst3n7$531$1@gioia.aioe.org>
In reply to	#6826

On 2018-11-18 21:33:23 +0000, Tom Evans said:
> On 2018-11-16 20:43:30 +0000, Your Name said:
>> On 2018-11-16 16:07:56 +0000, Tom Evans said:
>>> On 2018-11-16 05:41:15 +0000, Your Name said:
>>>> On 2018-11-16 03:14:49 +0000, Tom Evans said:
>>>>> On 2018-11-16 01:23:06 +0000, Your Name said:
>>>>>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>>>>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>>>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>>>>>> 
>>>>>>>>>> the chances that someone hacked your mac is low, unless you clicked a 
>>>>>>>>>> phishing link, in which case, anything goes.
>>>>>>>>>> 
>>>>>>>>>> from your description of the unsubscribe link, it *probably* was not a 
>>>>>>>>>> phish, but that's impossible to know without examining the link.
>>>>>>>>> 
>>>>>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>>>>>> steal money from my credit card, or is there only one attack for each 
>>>>>>>>> click on the wrong email link in my email inbox?
>>>>>>>> 
>>>>>>>> Phishing relies on you entering details into a faked version of a real website.
>>>>>>>> 
>>>>>>>> For example, you click the link in an email that is *supposedly* from 
>>>>>>>> your bank telling you you need to log into your account. That link 
>>>>>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>>>>>> and password which teh website then stores for the hacker scumbags, and 
>>>>>>>> then it tells you the password is wrong and sends you to the real 
>>>>>>>> banking login page, where you login in as normal. You assume you made a 
>>>>>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>>>>>> banking user ID and password they can use whenever they want.
>>>>>>>> 
>>>>>>>> Because many people re-use passwords for various websites, obtaining 
>>>>>>>> your password may let the hacker scumbag get into those different 
>>>>>>>> websites, not necessarily connected to the original phishing email.
>>>>>>>> 
>>>>>>>> Once you change your password, then the information the hacker scumbag 
>>>>>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>>>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>>>>>> the hacker scumbag can still get into your account.
>>>>>>> 
>>>>>>> Thanks, Your.
>>>>>>> 
>>>>>>> Which account are you referring to, that I should change my passcode for?
>>>>>> 
>>>>>> Whichever one you think was supposedly hacked, but since you don't 
>>>>>> know, you'll have to change them all ... or at least all the ones that 
>>>>>> have any connection to the bank account or to other internet accounts 
>>>>>> that have connection to that bank account.
>>>>> 
>>>>> Do you mean my computer account or my bank accnounts?  You still 
>>>>> haven't specified that.
>>>> 
>>>> Because there's no way I can know. There's no way you can know either, 
>>>> nor can you know if it was or wasn't anything to do with the computer 
>>>> at all. At the very least you should change the passwords for your bank 
>>>> account and your email account.
> 
> I've changed my bank account passcodes.
> 
> How could my email be a security leak?  I neither send nor receive any 
> sensitive bank information by email -- either via Mail or Outlook.

You don't have to.

If some hacker has gained access to your email account at the server 
end, then they can simply go to the bank's website, claim they've 
forgotten the password to have the remainder / change email sent to 
your email address, which they can then read (and delte before you even 
see it) and can gain access to your account.

Again, that's simply one potential possibility, one that has nothing to 
do with your Mac.




>>>>>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>>>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>>>>>> you the link the email will be going to. The first part (before the 
>>>>>>>> firts slash character) of a real one will end with something like 
>>>>>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>>>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>>>>>> going to somewhere-else.com, not MyBank.com.
>>>>>>>> 
>>>>>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>>>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>>>>>> manually go to the bank's real website to login as normal.
>>>>>>> 
>>>>>>> I didn't do that.  I did recently get an email that I thought was from 
>>>>>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>>>>>> didn't try to log into my bank account by pressing on the link in the 
>>>>>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>>>>>> that appeared after I pressed a link in the email.
>>>> 
>>>> There's no point in unsubscribing from fake emails. If it is a scumbag, 
>>>> then you won't get unsubscribed and you'll simply be telling them that 
>>>> someone is opening the emails.
>>> 
>>> That's not the point.  The point is that people keep telling me the 
>>> danger is from clicking a link in emails and then typing passcodes and 
>>> account numbers on the resulting pages.  I keep repeating that I didn't 
>>> do that.  But then you change your position, stating that pressing on 
>>> an "Unsubscribe" button on a Web site is just as dangerous.
>> 
>> Again: That was simply ONE example way you could have inadvertently 
>> given away your details. There are various other ways, including ones 
>> that have nothing to do with the computer at all. There's no possible 
>> way to know exactly how someone got your bank account details, but the 
>> chances of some hacker getting into your Mac to read a text file stored 
>> on it's drive are basically zero.
> 
> Your assurance sounds reassuring, and a few Apple tech support people 
> whom I consulted about this agree with you, but Jolly and Nospam 
> strongly disagree with you,

Because NoSpam and Jolly Roger are know-nothing morons. They only know 
about what they and there five friends do (and blindly believe everyone 
else on the planet must do / does do the same) ... nothing about what 
goes on in the real world.

Despite all the wild scare-tactic claims, mostly by anti-malware 
sellers and anti-Apple nutters, *nobody* in the real world has ever had 
their Mac infected by malware unless it was their own fault (by 
installing hacked pirate software for example).



> so I still don't know which side to believe, and whether or not I 
> should get a security information program such as Ipasscode to store my 
> sensitive data on to prevent another attack, or if I don't need to do 
> so because text files on Macs are already secure, and because the 
> attack was conducted through a security leak that didn't involve my 
> negligence.
> 
> As with so many other issues, there are two camps with adamant opposite 
> views on this basic issue.
> 
> 
> Also, I still didn't get an answer about whether or not Apple's Notes 
> program (which can be locked with a passcode) would be an advisable 
> place to store my passcodes, user names and similar sensitve 
> information.

You can store them wherever you want - it makes no difference to anything.

You can use a password manager like 1Password or Dashlane, but since 
you plan on printing and exporting that data, it's not going to be any 
more secure than anything else. You may as well just use a plain text 
file or Word / Pages document ... or simply hand-write them into a 
notebook beside the computer or Post-It notes stuck to the edges of the 
display.

[toc] | [prev] | [next] | [standalone]

#6850

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-25 19:01 -0800
Message-ID	<2018112519011154843-tomevans9890@yahoo.ca>
In reply to	#6836

On 2018-11-19 01:30:18 +0000, Your Name said:

> On 2018-11-18 21:33:23 +0000, Tom Evans said:
>> On 2018-11-16 20:43:30 +0000, Your Name said:
>>> On 2018-11-16 16:07:56 +0000, Tom Evans said:
>>>> On 2018-11-16 05:41:15 +0000, Your Name said:
>>>>> On 2018-11-16 03:14:49 +0000, Tom Evans said:
>>>>>> On 2018-11-16 01:23:06 +0000, Your Name said:
>>>>>>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>>>>>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>>>>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>>>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>>>>>>> 
>>>>>>>>>>> the chances that someone hacked your mac is low, unless you clicked a 
>>>>>>>>>>> phishing link, in which case, anything goes.
>>>>>>>>>>> 
>>>>>>>>>>> from your description of the unsubscribe link, it *probably* was not a 
>>>>>>>>>>> phish, but that's impossible to know without examining the link.
>>>>>>>>>> 
>>>>>>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>>>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>>>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>>>>>>> steal money from my credit card, or is there only one attack for each 
>>>>>>>>>> click on the wrong email link in my email inbox?
>>>>>>>>> 
>>>>>>>>> Phishing relies on you entering details into a faked version of a real website.
>>>>>>>>> 
>>>>>>>>> For example, you click the link in an email that is *supposedly* from 
>>>>>>>>> your bank telling you you need to log into your account. That link 
>>>>>>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>>>>>>> and password which teh website then stores for the hacker scumbags, and 
>>>>>>>>> then it tells you the password is wrong and sends you to the real 
>>>>>>>>> banking login page, where you login in as normal. You assume you made a 
>>>>>>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>>>>>>> banking user ID and password they can use whenever they want.
>>>>>>>>> 
>>>>>>>>> Because many people re-use passwords for various websites, obtaining 
>>>>>>>>> your password may let the hacker scumbag get into those different 
>>>>>>>>> websites, not necessarily connected to the original phishing email.
>>>>>>>>> 
>>>>>>>>> Once you change your password, then the information the hacker scumbag 
>>>>>>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>>>>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>>>>>>> the hacker scumbag can still get into your account.
>>>>>>>> 
>>>>>>>> Thanks, Your.
>>>>>>>> 
>>>>>>>> Which account are you referring to, that I should change my passcode for?
>>>>>>> 
>>>>>>> Whichever one you think was supposedly hacked, but since you don't 
>>>>>>> know, you'll have to change them all ... or at least all the ones that 
>>>>>>> have any connection to the bank account or to other internet accounts 
>>>>>>> that have connection to that bank account.
>>>>>> 
>>>>>> Do you mean my computer account or my bank accnounts?  You still 
>>>>>> haven't specified that.
>>>>> 
>>>>> Because there's no way I can know. There's no way you can know either, 
>>>>> nor can you know if it was or wasn't anything to do with the computer 
>>>>> at all. At the very least you should change the passwords for your bank 
>>>>> account and your email account.
>> 
>> I've changed my bank account passcodes.
>> 
>> How could my email be a security leak?  I neither send nor receive any 
>> sensitive bank information by email -- either via Mail or Outlook.
> 
> You don't have to.
> 
> If some hacker has gained access to your email account at the server 
> end, then they can simply go to the bank's website, claim they've 
> forgotten the password to have the remainder / change email sent to 
> your email address, which they can then read (and delte before you even 
> see it) and can gain access to your account.
> 
> Again, that's simply one potential possibility, one that has nothing to 
> do with your Mac.
> 
> 
> 
> 
>>>>>>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>>>>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>>>>>>> you the link the email will be going to. The first part (before the 
>>>>>>>>> firts slash character) of a real one will end with something like 
>>>>>>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>>>>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>>>>>>> going to somewhere-else.com, not MyBank.com.
>>>>>>>>> 
>>>>>>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>>>>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>>>>>>> manually go to the bank's real website to login as normal.
>>>>>>>> 
>>>>>>>> I didn't do that.  I did recently get an email that I thought was from 
>>>>>>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>>>>>>> didn't try to log into my bank account by pressing on the link in the 
>>>>>>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>>>>>>> that appeared after I pressed a link in the email.
>>>>> 
>>>>> There's no point in unsubscribing from fake emails. If it is a scumbag, 
>>>>> then you won't get unsubscribed and you'll simply be telling them that 
>>>>> someone is opening the emails.
>>>> 
>>>> That's not the point.  The point is that people keep telling me the 
>>>> danger is from clicking a link in emails and then typing passcodes and 
>>>> account numbers on the resulting pages.  I keep repeating that I didn't 
>>>> do that.  But then you change your position, stating that pressing on 
>>>> an "Unsubscribe" button on a Web site is just as dangerous.
>>> 
>>> Again: That was simply ONE example way you could have inadvertently 
>>> given away your details. There are various other ways, including ones 
>>> that have nothing to do with the computer at all. There's no possible 
>>> way to know exactly how someone got your bank account details, but the 
>>> chances of some hacker getting into your Mac to read a text file stored 
>>> on it's drive are basically zero.
>> 
>> Your assurance sounds reassuring, and a few Apple tech support people 
>> whom I consulted about this agree with you, but Jolly and Nospam 
>> strongly disagree with you,
> 
> Because NoSpam and Jolly Roger are know-nothing morons. They only know 
> about what they and there five friends do (and blindly believe everyone 
> else on the planet must do / does do the same) ... nothing about what 
> goes on in the real world.
> 
> Despite all the wild scare-tactic claims, mostly by anti-malware 
> sellers and anti-Apple nutters, *nobody* in the real world has ever had 
> their Mac infected by malware unless it was their own fault (by 
> installing hacked pirate software for example).



> so I still don't know which side to believe, and whether or not I 
> should get a security information program such as Ipasscode to store my 
> sensitive data on to prevent another attack, or if I don't need to do 
> so because text files on Macs are already secure, and because the 
> attack was conducted through a security leak that didn't involve my 
> negligence.
>> 
>> As with so many other issues, there are two camps with adamant opposite 
>> views on this basic issue.
>> 
>> 
>> Also, I still didn't get an answer about whether or not Apple's Notes 
>> program (which can be locked with a passcode) would be an advisable 
>> place to store my passcodes, user names and similar sensitve 
>> information.
> 
> You can store them wherever you want - it makes no difference to anything.
> 
> You can use a password manager like 1Password or Dashlane, but since 
> you plan on printing and exporting that data, it's not going to be any 
> more secure than anything else. You may as well just use a plain text 
> file or Word / Pages document ... or simply hand-write them into a 
> notebook beside the computer or Post-It notes stuck to the edges of the 
> display.

Thanks so much for your advice, Your!  I sincerely appreciate all of 
Your advice!

Tom

[toc] | [prev] | [next] | [standalone]

#6851

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-25 19:09 -0800
Message-ID	<2018112519092027519-tomevans9890@yahoo.ca>
In reply to	#6836

On 2018-11-19 01:30:18 +0000, Your Name said:

> On 2018-11-18 21:33:23 +0000, Tom Evans said:
>> On 2018-11-16 20:43:30 +0000, Your Name said:
>>> On 2018-11-16 16:07:56 +0000, Tom Evans said:
>>>> On 2018-11-16 05:41:15 +0000, Your Name said:
>>>>> On 2018-11-16 03:14:49 +0000, Tom Evans said:
>>>>>> On 2018-11-16 01:23:06 +0000, Your Name said:
>>>>>>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>>>>>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>>>>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>>>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>>>>>>> 
>>>>>>>>>>> the chances that someone hacked your mac is low, unless you clicked a 
>>>>>>>>>>> phishing link, in which case, anything goes.
>>>>>>>>>>> 
>>>>>>>>>>> from your description of the unsubscribe link, it *probably* was not a 
>>>>>>>>>>> phish, but that's impossible to know without examining the link.
>>>>>>>>>> 
>>>>>>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>>>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>>>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>>>>>>> steal money from my credit card, or is there only one attack for each 
>>>>>>>>>> click on the wrong email link in my email inbox?
>>>>>>>>> 
>>>>>>>>> Phishing relies on you entering details into a faked version of a real website.
>>>>>>>>> 
>>>>>>>>> For example, you click the link in an email that is *supposedly* from 
>>>>>>>>> your bank telling you you need to log into your account. That link 
>>>>>>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>>>>>>> and password which teh website then stores for the hacker scumbags, and 
>>>>>>>>> then it tells you the password is wrong and sends you to the real 
>>>>>>>>> banking login page, where you login in as normal. You assume you made a 
>>>>>>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>>>>>>> banking user ID and password they can use whenever they want.
>>>>>>>>> 
>>>>>>>>> Because many people re-use passwords for various websites, obtaining 
>>>>>>>>> your password may let the hacker scumbag get into those different 
>>>>>>>>> websites, not necessarily connected to the original phishing email.
>>>>>>>>> 
>>>>>>>>> Once you change your password, then the information the hacker scumbag 
>>>>>>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>>>>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>>>>>>> the hacker scumbag can still get into your account.
>>>>>>>> 
>>>>>>>> Thanks, Your.
>>>>>>>> 
>>>>>>>> Which account are you referring to, that I should change my passcode for?
>>>>>>> 
>>>>>>> Whichever one you think was supposedly hacked, but since you don't 
>>>>>>> know, you'll have to change them all ... or at least all the ones that 
>>>>>>> have any connection to the bank account or to other internet accounts 
>>>>>>> that have connection to that bank account.
>>>>>> 
>>>>>> Do you mean my computer account or my bank accnounts?  You still 
>>>>>> haven't specified that.
>>>>> 
>>>>> Because there's no way I can know. There's no way you can know either, 
>>>>> nor can you know if it was or wasn't anything to do with the computer 
>>>>> at all. At the very least you should change the passwords for your bank 
>>>>> account and your email account.
>> 
>> I've changed my bank account passcodes.
>> 
>> How could my email be a security leak?  I neither send nor receive any 
>> sensitive bank information by email -- either via Mail or Outlook.
> 
> You don't have to.
> 
> If some hacker has gained access to your email account at the server 
> end, then they can simply go to the bank's website, claim they've 
> forgotten the password to have the remainder / change email sent to 
> your email address, which they can then read (and delte before you even 
> see it) and can gain access to your account.
> 
> Again, that's simply one potential possibility, one that has nothing to 
> do with your Mac.
> 
> 
> 
> 
>>>>>>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>>>>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>>>>>>> you the link the email will be going to. The first part (before the 
>>>>>>>>> firts slash character) of a real one will end with something like 
>>>>>>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>>>>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>>>>>>> going to somewhere-else.com, not MyBank.com.
>>>>>>>>> 
>>>>>>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>>>>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>>>>>>> manually go to the bank's real website to login as normal.
>>>>>>>> 
>>>>>>>> I didn't do that.  I did recently get an email that I thought was from 
>>>>>>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>>>>>>> didn't try to log into my bank account by pressing on the link in the 
>>>>>>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>>>>>>> that appeared after I pressed a link in the email.
>>>>> 
>>>>> There's no point in unsubscribing from fake emails. If it is a scumbag, 
>>>>> then you won't get unsubscribed and you'll simply be telling them that 
>>>>> someone is opening the emails.
>>>> 
>>>> That's not the point.  The point is that people keep telling me the 
>>>> danger is from clicking a link in emails and then typing passcodes and 
>>>> account numbers on the resulting pages.  I keep repeating that I didn't 
>>>> do that.  But then you change your position, stating that pressing on 
>>>> an "Unsubscribe" button on a Web site is just as dangerous.
>>> 
>>> Again: That was simply ONE example way you could have inadvertently 
>>> given away your details. There are various other ways, including ones 
>>> that have nothing to do with the computer at all. There's no possible 
>>> way to know exactly how someone got your bank account details, but the 
>>> chances of some hacker getting into your Mac to read a text file stored 
>>> on it's drive are basically zero.
>> 
>> Your assurance sounds reassuring, and a few Apple tech support people 
>> whom I consulted about this agree with you, but Jolly and Nospam 
>> strongly disagree with you,
> 
> Because NoSpam and Jolly Roger are know-nothing morons. They only know 
> about what they and there five friends do (and blindly believe everyone 
> else on the planet must do / does do the same) ... nothing about what 
> goes on in the real world.
> 
> Despite all the wild scare-tactic claims, mostly by anti-malware 
> sellers and anti-Apple nutters, *nobody* in the real world has ever had 
> their Mac infected by malware unless it was their own fault (by 
> installing hacked pirate software for example).
> 
> 
> 
>> so I still don't know which side to believe, and whether or not I 
>> should get a security information program such as Ipasscode to store my 
>> sensitive data on to prevent another attack, or if I don't need to do 
>> so because text files on Macs are already secure, and because the 
>> attack was conducted through a security leak that didn't involve my 
>> negligence.
>> 
>> As with so many other issues, there are two camps with adamant opposite 
>> views on this basic issue.
>> 
>> 
>> Also, I still didn't get an answer about whether or not Apple's Notes 
>> program (which can be locked with a passcode) would be an advisable 
>> place to store my passcodes, user names and similar sensitve 
>> information.
> 
> You can store them wherever you want - it makes no difference to anything.
> 
> You can use a password manager like 1Password or Dashlane, but since 
> you plan on printing and exporting that data, it's not going to be any 
> more secure than anything else. You may as well just use a plain text 
> file or Word / Pages document ... or simply hand-write them into a 
> notebook beside the computer or Post-It notes stuck to the edges of the 
> display.

The idea of having a back-up of my sensitive data on paper would be in 
case of computer failure.  And the idea is to keep those paper files in 
a place on the premises where a thief or thieves would be unlikely to 
look for valuables.  Thieves usually don't spend a lot of time in the 
premises that they break into, because they don't want to get causght.  
So they're unlikely to search every square foot of the premises they 
break into.  So obvioulsy I wouldn't keep the printed pages for a long 
time on my desks, which are by my computer.

Tom

[toc] | [prev] | [next] | [standalone]

#6738

From	Your Name <YourName@YourISP.com>
Date	2018-11-10 09:44 +1300
Message-ID	<ps4rjv$1g7l$1@gioia.aioe.org>
In reply to	#6734

On 2018-11-09 04:55:06 +0000, Tom Evans said:
> On 2018-11-08 22:10:58 +0000, nospam said:
>> In article <2018110813514766717-tomevans9890@yahoo.ca>, Tom Evans
>> <tomevans9890@yahoo.ca> wrote:
>>> 
>>> I thought maybe the thief was able to hack into my Mac and find my bank
>>> information there.  (I have my user names and passcodes stored on my
>>> Mac, but in a text program and not in Keychain.)
>> 
>> that's *not* a good idea.
> 
> Two messages down, Your Name wrote that it's "immensely unlikely" that 
> a hacker hack into my bank data on  my Mac, and two messages up, Callum 
> wrote "If nobody else has physical access to that desktop Mac [which 
> nobody does] it's very safe indeed, especially if you don't sync the 
> keychain via iCloud to any other Mac" [which I haven't].
> 
> So who's right, those two guys, or Nospam here, who wrote that it's 
> "not a good idea" to store sensitive data in a text file on a Mac?
> 
> The opinions seems to be contradictory.

One of the simple rules to remember around here is: Nospam is never 
right. (Neither is Jolly Roger).

The chances of you having malware on a Mac are basically nil. In well 
over 30 years of computer use, via my own computers, school computers, 
university computers, work client computers, etc. I have never ever 
come across any Mac with malware on it. Despite the claims of the 
anti-malware sellers, nobdy has ever had any of the malware they 
scaremonger the general public with.

Even the almighty issues with CPU chips that affected pretty much every 
chip maker, have not been an actual problem for users.

It's simply a case of "the sky is falling" and the same stupidty that 
saw IT "professionals" charging through the nose to "repair" things 
that the supposed Y2K bug was never ever going to affect anyway.   :-\

[toc] | [prev] | [next] | [standalone]

#6742

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-09 17:18 -0800
Message-ID	<2018110917180927234-tomevans9890@yahoo.ca>
In reply to	#6738

On 2018-11-09 20:44:49 +0000, Your Name said:

> On 2018-11-09 04:55:06 +0000, Tom Evans said:
>> On 2018-11-08 22:10:58 +0000, nospam said:
>>> In article <2018110813514766717-tomevans9890@yahoo.ca>, Tom Evans
>>> <tomevans9890@yahoo.ca> wrote:
>>>> 
>>>> I thought maybe the thief was able to hack into my Mac and find my bank
>>>> information there.  (I have my user names and passcodes stored on my
>>>> Mac, but in a text program and not in Keychain.)
>>> 
>>> that's *not* a good idea.
>> 
>> Two messages down, Your Name wrote that it's "immensely unlikely" that 
>> a hacker hack into my bank data on  my Mac, and two messages up, Callum 
>> wrote "If nobody else has physical access to that desktop Mac [which 
>> nobody does] it's very safe indeed, especially if you don't sync the 
>> keychain via iCloud to any other Mac" [which I haven't].
>> 
>> So who's right, those two guys, or Nospam here, who wrote that it's 
>> "not a good idea" to store sensitive data in a text file on a Mac?
>> 
>> The opinions seems to be contradictory.
> 
> 
> The chances of you having malware on a Mac are basically nil. In well 
> over 30 years of computer use, via my own computers, school computers, 
> university computers, work client computers, etc. I have never ever 
> come across any Mac with malware on it. Despite the claims of the 
> anti-malware sellers, nobdy has ever had any of the malware they 
> scaremonger the general public with.
> 
> Even the almighty issues with CPU chips that affected pretty much every 
> chip maker, have not been an actual problem for users.
> 
> It's simply a case of "the sky is falling" and the same stupidty that 
> saw IT "professionals" charging through the nose to "repair" things 
> that the supposed Y2K bug was never ever going to affect anyway.   :-\

That's interesting, Your Name.

I have noticed a tendency for some advisors on the newsgroups to be 
overly cautious.  For example, one advised that having three back-up 
drives (with one or two of them off-site at all times in a secure 
location) is insufficient and that I should have four back-ups.

So what you're implying is that having banking information in a text 
program (with an obscure file name) would be safe from hackers.

But I've spoken with employees from my bank about this fraud attempt, 
and they advised me not to store my bank information on my computer, so 
that's another source of contradictory advice.

Tom

[toc] | [prev] | [next] | [standalone]

#6745

From	nospam <nospam@nospam.invalid>
Date	2018-11-09 20:22 -0500
Message-ID	<091120182022309187%nospam@nospam.invalid>
In reply to	#6742

In article <2018110917180927234-tomevans9890@yahoo.ca>, Tom Evans
<tomevans9890@yahoo.ca> wrote:

> I have noticed a tendency for some advisors on the newsgroups to be 
> overly cautious.  For example, one advised that having three back-up 
> drives (with one or two of them off-site at all times in a secure 
> location) is insufficient and that I should have four back-ups.

the more backups the better.

> So what you're implying is that having banking information in a text 
> program (with an obscure file name) would be safe from hackers.

*anyone* who has access to your mac, hacker or just someone nosier than
they should be, will be able to get your banking information and a
whole lot more.

> But I've spoken with employees from my bank about this fraud attempt, 
> and they advised me not to store my bank information on my computer, so 
> that's another source of contradictory advice.

it's fine if it's encrypted.

it's *not* fine if it's in plain text.

[toc] | [prev] | [next] | [standalone]

#6746

From	Your Name <YourName@YourISP.com>
Date	2018-11-10 14:59 +1300
Message-ID	<ps5e14$b9u$1@gioia.aioe.org>
In reply to	#6742

On 2018-11-10 01:18:09 +0000, Tom Evans said:
> On 2018-11-09 20:44:49 +0000, Your Name said:
>> On 2018-11-09 04:55:06 +0000, Tom Evans said:
>>> On 2018-11-08 22:10:58 +0000, nospam said:
>>>> In article <2018110813514766717-tomevans9890@yahoo.ca>, Tom Evans
>>>> <tomevans9890@yahoo.ca> wrote:
>>>>> 
>>>>> I thought maybe the thief was able to hack into my Mac and find my bank
>>>>> information there.  (I have my user names and passcodes stored on my
>>>>> Mac, but in a text program and not in Keychain.)
>>>> 
>>>> that's *not* a good idea.
>>> 
>>> Two messages down, Your Name wrote that it's "immensely unlikely" that 
>>> a hacker hack into my bank data on  my Mac, and two messages up, Callum 
>>> wrote "If nobody else has physical access to that desktop Mac [which 
>>> nobody does] it's very safe indeed, especially if you don't sync the 
>>> keychain via iCloud to any other Mac" [which I haven't].
>>> 
>>> So who's right, those two guys, or Nospam here, who wrote that it's 
>>> "not a good idea" to store sensitive data in a text file on a Mac?
>>> 
>>> The opinions seems to be contradictory.
>> 
>> The chances of you having malware on a Mac are basically nil. In well 
>> over 30 years of computer use, via my own computers, school computers, 
>> university computers, work client computers, etc. I have never ever 
>> come across any Mac with malware on it. Despite the claims of the 
>> anti-malware sellers, nobdy has ever had any of the malware they 
>> scaremonger the general public with.
>> 
>> Even the almighty issues with CPU chips that affected pretty much every 
>> chip maker, have not been an actual problem for users.
>> 
>> It's simply a case of "the sky is falling" and the same stupidty that 
>> saw IT "professionals" charging through the nose to "repair" things 
>> that the supposed Y2K bug was never ever going to affect anyway.   :-\
> 
> That's interesting, Your Name.
> 
> I have noticed a tendency for some advisors on the newsgroups to be 
> overly cautious.  For example, one advised that having three back-up 
> drives (with one or two of them off-site at all times in a secure 
> location) is insufficient and that I should have four back-ups.
> 
> So what you're implying is that having banking information in a text 
> program (with an obscure file name) would be safe from hackers.

Use whatever filename you want, it doesn't have to be "obscure".

The only real world way someone is going to be able to read that file 
is if they have physical access to your computer and it's logged into 
your user account (or your computer password is very simple to guess, 
or you're stupid enough to have it written on a sticky note attache to 
the display!).

The only possible exception is if you install software from a dodgy 
source. For example, never click on a pop-up link in your web browser 
that claims you need to update / install software (such as Flash or 
Java). Even then the chances are extremely low.

If you really want to check your computer for any mythical malware, you 
can use Malwarebytes (free) <https://www.malwarebytes.com/mac/>
or one of the other paid and free products listed at TechRadar
<https://www.techradar.com/au/news/the-best-mac-antivirus-software>

BUT, be aware that these can produce false positives by detecting 
something they think *MIGHT* be malware, but really isn't, so you 
really need to know what you're doing before going around dleting files.

Even better, take it to an authorised Apple tech centre, but you'll be 
paying money and the liklihood of them actually finding any problem is 
basically zero.

> But I've spoken with employees from my bank about this fraud attempt, 
> and they advised me not to store my bank information on my computer, so 
> that's another source of contradictory advice.

Bank employees, like most of the world (especially 'help' desk 
operators), are all Windoze drones and have zero understanding of Apple 
devices. In fact most 'help' desk operators have zero understanding of 
anything and simply read off a script on their screen or do Google 
searches for answers.   :-\

I've been told by such fools that I *have* to install the "xyz" 
anti-malware software on my computer ... despite the fact that it 
doesn't even exist for Macs because it's a Windoze-only app.

[toc] | [prev] | [next] | [standalone]

#6748

From	nospam <nospam@nospam.invalid>
Date	2018-11-09 21:07 -0500
Message-ID	<091120182107140216%nospam@nospam.invalid>
In reply to	#6746

In article <ps5e14$b9u$1@gioia.aioe.org>, Your Name
<YourName@YourISP.com> wrote:

> 
> The only real world way someone is going to be able to read that file 
> is if they have physical access to your computer and it's logged into 
> your user account (or your computer password is very simple to guess, 
> or you're stupid enough to have it written on a sticky note attache to 
> the display!).

wrong.

if someone has physical access to the computer, they don't need to log
in at all. 

either boot off an external drive or put the mac into target drive mode
and they'll have full access to *anything* on the drive.

unless of course, it's encrypted...

> The only possible exception is if you install software from a dodgy 
> source. For example, never click on a pop-up link in your web browser 
> that claims you need to update / install software (such as Flash or 
> Java). Even then the chances are extremely low.

wrong on that too.

clicking on a link makes the chances extremely *high* something bad
will be installed.

> 
> Even better, take it to an authorised Apple tech centre, but you'll be 
> paying money and the liklihood of them actually finding any problem is 
> basically zero.

wrong yet again.

apple stores don't charge anything.

> > But I've spoken with employees from my bank about this fraud attempt, 
> > and they advised me not to store my bank information on my computer, so 
> > that's another source of contradictory advice.
> 
> Bank employees, like most of the world (especially 'help' desk 
> operators), are all Windoze drones and have zero understanding of Apple 
> devices. In fact most 'help' desk operators have zero understanding of 
> anything and simply read off a script on their screen or do Google 
> searches for answers.   :-\

wrong once more. 

it's not an apple/windows issue.

storing private information, including bank logins and passwords, in an
unencrypted file is flat out stupid, regardless of platform.

either encrypt it, or better yet and has been suggested, use a password
manager which does the encryption for you and without the hassles.

[toc] | [prev] | [next] | [standalone]

#6749

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-09 22:23 -0800
Message-ID	<2018110922232686127-tomevans9890@yahoo.ca>
In reply to	#6748

On 2018-11-10 02:07:14 +0000, nospam said:

> In article <ps5e14$b9u$1@gioia.aioe.org>, Your Name
> <YourName@YourISP.com> wrote:
> 
>> 
>> The only real world way someone is going to be able to read that file
>> is if they have physical access to your computer and it's logged into
>> your user account (or your computer password is very simple to guess,
>> or you're stupid enough to have it written on a sticky note attache to
>> the display!).
> 
> wrong.
> 
> if someone has physical access to the computer, they don't need to log
> in at all.

No one else but me has physical access to my Mac, so I deactivated my passcode.

But this reminds me of another worry:  It it possible for a hacker to 
hack via System Preferences > Users and Groups > Other Users?  I have 
an alternate account there with my name on it, whcih is marked 
"Standard" and a Guest account, but both of those usersare show in in 
gray type and the Guest account says it's "Off".

> either boot off an external drive or put the mac into target drive mode
> and they'll have full access to *anything* on the drive.
> 
> unless of course, it's encrypted...
> 
>> The only possible exception is if you install software from a dodgy
>> source. For example, never click on a pop-up link in your web browser
>> that claims you need to update / install software (such as Flash or
>> Java). Even then the chances are extremely low.
> 
> wrong on that too.
> 
> clicking on a link makes the chances extremely *high* something bad
> will be installed.
> 
> 
> 
>> 
>> Even better, take it to an authorised Apple tech centre, but you'll be
>> paying money and the liklihood of them actually finding any problem is
>> basically zero.
> 
> wrong yet again.
> 
> apple stores don't charge anything.
> 
> 
>>> But I've spoken with employees from my bank about this fraud attempt,
>>> and they advised me not to store my bank information on my computer, so
>>> that's another source of contradictory advice.
>> 
>> Bank employees, like most of the world (especially 'help' desk
>> operators), are all Windoze drones and have zero understanding of Apple
>> devices. In fact most 'help' desk operators have zero understanding of
>> anything and simply read off a script on their screen or do Google
>> searches for answers.   :-\
> 
> wrong once more.
> 
> it's not an apple/windows issue.
> 
> storing private information, including bank logins and passwords, in an
> unencrypted file is flat out stupid, regardless of platform.

I think my Mac must have been 'hacked' because how else could the 
fraudster know my name, log into my credit card account by phone and 
steal $1,700 from my credit card account, before someone at the bank 
spotted the suspicous transaction and reversed the charge to my 
account?  After that, the same day (Wednesday) I got an urgent phone 
message from the bank as me to call the bank as soon as possible.

Today I phoned the bank's loss prevention department again and found 
out that the caller called the bank from a distant part of the country. 
 One of the bank employees even gave me the phone number used by the 
criminal to phone the bank and attempt the theft and impersonation, but 
refused to divulge details.

> either encrypt it, or better yet and has been suggested, use a password
> manager which does the encryption for you and without the hassles.

I'll do that, after I deccide which passcode manager to use.  (I think 
I'll try Keychain first.)  In the meantime, I've trashed and emptied 
from the trash the files of passcodes and similar info from my Mac, and 
ejected my back-up drives so that they, too, can't be accessed for the 
same files, until I have the data stored in Keychain or a similar 
program, and then I'll take the sensitive data off of my back-up drives 
as well.

Tom

[toc] | [prev] | [next] | [standalone]

#6750

From	nospam <nospam@nospam.invalid>
Date	2018-11-10 08:38 -0500
Message-ID	<101120180838076042%nospam@nospam.invalid>
In reply to	#6749

In article <2018110922232686127-tomevans9890@yahoo.ca>, Tom Evans
<tomevans9890@yahoo.ca> wrote:

> >> The only real world way someone is going to be able to read that file
> >> is if they have physical access to your computer and it's logged into
> >> your user account (or your computer password is very simple to guess,
> >> or you're stupid enough to have it written on a sticky note attache to
> >> the display!).
> > 
> > wrong.
> > 
> > if someone has physical access to the computer, they don't need to log
> > in at all.
> 
> No one else but me has physical access to my Mac, so I deactivated my
> passcode.

if the computer is lost or stolen, they would.

the point is that if someone has physical access, nothing else matters.
they do *not* need to be logged in. they can do whatever they want with
the drive, even removing it from the computer and forensically
examining it.

unless it's encrypted, in which case, they won't get very far. 

> But this reminds me of another worry:  It it possible for a hacker to 
> hack via System Preferences > Users and Groups > Other Users?  I have 
> an alternate account there with my name on it, whcih is marked 
> "Standard" and a Guest account, but both of those usersare show in in 
> gray type and the Guest account says it's "Off".

possible, sure. likely, no.

> 
> I think my Mac must have been 'hacked' because how else could the 
> fraudster know my name, log into my credit card account by phone and 
> steal $1,700 from my credit card account, before someone at the bank 
> spotted the suspicous transaction and reversed the charge to my 
> account?  After that, the same day (Wednesday) I got an urgent phone 
> message from the bank as me to call the bank as soon as possible.

it's possible that your information was compromised in some other way.

equifax published information on just about everyone in the usa as well
as some in canada and the uk. target had a data breach a few years ago.
delta airlines and british airways recently had a breach. there are
many others.

you're not responsible for fraudulent charges.

> Today I phoned the bank's loss prevention department again and found 
> out that the caller called the bank from a distant part of the country. 
>  One of the bank employees even gave me the phone number used by the 
> criminal to phone the bank and attempt the theft and impersonation, but 
> refused to divulge details.

that's extremely unusual. normally they will not say *anything* about
it, other than they are investigating.

[toc] | [prev] | [next] | [standalone]

#6758

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-10 20:25 -0800
Message-ID	<2018111020252950101-tomevans9890@yahoo.ca>
In reply to	#6750

On 2018-11-10 13:38:07 +0000, nospam said:

> In article <2018110922232686127-tomevans9890@yahoo.ca>, Tom Evans
> <tomevans9890@yahoo.ca> wrote:
> 
>>>> The only real world way someone is going to be able to read that file
>>>> is if they have physical access to your computer and it's logged into
>>>> your user account (or your computer password is very simple to guess,
>>>> or you're stupid enough to have it written on a sticky note attache to
>>>> the display!).
>>> 
>>> wrong.
>>> 
>>> if someone has physical access to the computer, they don't need to log
>>> in at all.
>> 
>> No one else but me has physical access to my Mac, so I deactivated my
>> passcode.
> 
> if the computer is lost or stolen, they would.
> 
> the point is that if someone has physical access, nothing else matters.
> they do *not* need to be logged in. they can do whatever they want with
> the drive, even removing it from the computer and forensically
> examining it.
> 
> unless it's encrypted, in which case, they won't get very far.

My point was that no one else has access to my Mac, and it's unlikely 
anyone will, because I have an alarm system, and a security company 
alert decal on my door to warn potential thieves of that alarm system.

>> But this reminds me of another worry:  It it possible for a hacker to
>> hack via System Preferences > Users and Groups > Other Users?  I have
>> an alternate account there with my name on it, whcih is marked
>> "Standard" and a Guest account, but both of those usersare show in in
>> gray type and the Guest account says it's "Off".
> 
> possible, sure. likely, no.
> 
> 
>> 
>> I think my Mac must have been 'hacked' because how else could the
>> fraudster know my name, log into my credit card account by phone and
>> steal $1,700 from my credit card account, before someone at the bank
>> spotted the suspicous transaction and reversed the charge to my
>> account?  After that, the same day (Wednesday) I got an urgent phone
>> message from the bank as me to call the bank as soon as possible.
> 
> it's possible that your information was compromised in some other way.
> 
> equifax published information on just about everyone in the usa as well
> as some in canada and the uk. target had a data breach a few years ago.
> delta airlines and british airways recently had a breach. there are
> many others.
> 
> you're not responsible for fraudulent charges.

That's good, but some here have written that I'm stupid to have had my 
sensitive information in a text file on my Mac, and that hackers could 
easily get the necessary information that way.

>> Today I phoned the bank's loss prevention department again and found
>> out that the caller called the bank from a distant part of the country.
>> One of the bank employees even gave me the phone number used by the
>> criminal to phone the bank and attempt the theft and impersonation, but
>> refused to divulge details.
> 
> that's extremely unusual. normally they will not say *anything* about
> it, other than they are investigating.

Well, I told him how frustrated I was by the time-consuming incident, 
like repeatedly having the bank's phone agents refer me to go to to my 
local bank branch, and then after going to my local bank branch tellers 
advising me that can't help me and referring me back to the phone 
agents, and that cycle repeating, and being transfereed so many times 
to different departments while on the phone and being given new PINs 
and account numbers that didn't work, and being given contradictory 
information by different people (like what happens in thsee newsgroups 
all the time!) and not being able to use my bank account online, 
despite being told that my account freeze had been lifted, etcetera.

Also I told him that if we victims know what the security questions 
were that the crook was able to answer, it might help me to figure out 
if the breach was done through my computer or not.

In addition, I'm a former journalist, so I'm inquisitive and persistent 
by nature and training when I ask for information, and I hate being 
given "the runaround".  And that phone agent in the loss prevention 
department might have thought if he gave me that phone number that the 
crook used to impersonate me when he called the bank to try to use my 
credit card infromation and rob my account, I'd be satisfied with that 
tip, and get off of the phone and stop bugging him.

Tom

[toc] | [prev] | [next] | [standalone]

#6770

From	"John Varela" <newlamps@verizon.net>
Date	2018-11-11 23:48 +0000
Message-ID	<51W5y0sPNk52-pn2-muo0Vi8ZhRvd@localhost>
In reply to	#6758

On Sun, 11 Nov 2018 04:25:29 UTC, Tom Evans <tomevans9890@yahoo.ca> 
wrote:

> On 2018-11-10 13:38:07 +0000, nospam said:
> 
> > In article <2018110922232686127-tomevans9890@yahoo.ca>, Tom Evans
> > <tomevans9890@yahoo.ca> wrote:
> > 
> >>>> The only real world way someone is going to be able to read that file
> >>>> is if they have physical access to your computer and it's logged into
> >>>> your user account (or your computer password is very simple to guess,
> >>>> or you're stupid enough to have it written on a sticky note attache to
> >>>> the display!).
> >>> 
> >>> wrong.
> >>> 
> >>> if someone has physical access to the computer, they don't need to log
> >>> in at all.
> >> 
> >> No one else but me has physical access to my Mac, so I deactivated my
> >> passcode.
> > 
> > if the computer is lost or stolen, they would.
> > 
> > the point is that if someone has physical access, nothing else matters.
> > they do *not* need to be logged in. they can do whatever they want with
> > the drive, even removing it from the computer and forensically
> > examining it.
> > 
> > unless it's encrypted, in which case, they won't get very far.
> 
> My point was that no one else has access to my Mac, and it's unlikely 
> anyone will, because I have an alarm system, and a security company 
> alert decal on my door to warn potential thieves of that alarm system.

I deliberately did NOT put the ADT sign in my yard because if the 
thief has half a brain that would be the signal to him to go cut the
telephone wire between the pole and the house before breaking in.

-- 
John Varela

[toc] | [prev] | [next] | [standalone]

Page 4 of 7 — ← Prev page 1 2 3 [4] 5 6 7 Next page →

csiph-web

Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

Contents

#6827

#6831

#6834

#6837

#6838

#6843

#6844

#6849

#6836

#6850

#6851

#6738

#6742

#6745

#6746

#6748

#6749

#6750

#6758

#6770