Groups > comp.sys.mac.misc > #6717 > unrolled thread

Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

Started by	Tom Evans <tomevans9890@yahoo.ca>
First post	2018-11-07 21:59 -0800
Last post	2018-11-08 20:22 +0000
Articles	20 on this page of 131 — 7 participants

Back to article view | Back to comp.sys.mac.misc

Page 5 of 7 — ← Prev page 1 2 3 4 [5] 6 7 Next page →

#6771

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-12 10:44 -0800
Message-ID	<2018111210444077200-tomevans9890@yahoo.ca>
In reply to	#6770

On 2018-11-11 23:48:17 +0000, John Varela said:

> On Sun, 11 Nov 2018 04:25:29 UTC, Tom Evans <tomevans9890@yahoo.ca>
> wrote:
> 
>> My point was that no one else has access to my Mac, and it's unlikely
>> anyone will, because I have an alarm system, and a security company
>> alert decal on my door to warn potential thieves of that alarm system.
> 
> I deliberately did NOT put the ADT sign in my yard because if the
> thief has half a brain that would be the signal to him to go cut the
> telephone wire between the pole and the house before breaking in.

I've never heard of thieves climbing telephone poles to cut the pwer 
lines that lead to apartment buildings, and thereby gaining access to 
the apartments and stealing things.

And when the power goes off, the tenants of apartment buildings tend to 
go into the halls to talk to each other to discuss the power outage, so 
people would be suspicous if they heard and saw someone trying to break 
down an apartment door, especially right after such a power loss.

Also, even if the extremely unlikely and even unheard-of scenario were 
to occur, one or two thieves (it's usually not more than two thieves 
perpetrating each break-in) would be very unlikely to break into my 
apartment and steal my computer because there are dozens of apartments 
in my building.

Also, if the threat of homeowners being at risk of thieves climbing 
telepone poles to cut the power, the security companies would have long 
ago stopping giving security alert lawn signs and decals to their 
customers, because they'd have learned  that such warnings would invite 
thieves and increase break-ins and losses, rather than deterring them.

Tom

[toc] | [prev] | [next] | [standalone]

#6775

From	"John Varela" <newlamps@verizon.net>
Date	2018-11-12 23:43 +0000
Message-ID	<51W5y0sPNk52-pn2-dpXDqyRcb7od@localhost>
In reply to	#6771

On Mon, 12 Nov 2018 18:44:40 UTC, Tom Evans <tomevans9890@yahoo.ca> 
wrote:

> On 2018-11-11 23:48:17 +0000, John Varela said:
> 
> > On Sun, 11 Nov 2018 04:25:29 UTC, Tom Evans <tomevans9890@yahoo.ca>
> > wrote:
> > 
> >> My point was that no one else has access to my Mac, and it's unlikely
> >> anyone will, because I have an alarm system, and a security company
> >> alert decal on my door to warn potential thieves of that alarm system.
> > 
> > I deliberately did NOT put the ADT sign in my yard because if the
> > thief has half a brain that would be the signal to him to go cut the
> > telephone wire between the pole and the house before breaking in.
> 
> I've never heard of thieves climbing telephone poles to cut the pwer 
> lines that lead to apartment buildings, and thereby gaining access to 
> the apartments and stealing things.
> 
> And when the power goes off, the tenants of apartment buildings tend to 
> go into the halls to talk to each other to discuss the power outage, so 
> people would be suspicous if they heard and saw someone trying to break 
> down an apartment door, especially right after such a power loss.
> 
> Also, even if the extremely unlikely and even unheard-of scenario were 
> to occur, one or two thieves (it's usually not more than two thieves 
> perpetrating each break-in) would be very unlikely to break into my 
> apartment and steal my computer because there are dozens of apartments 
> in my building.

An apartment would be different.  The wire to my house is too high 
up to be reached without a ladder, but a pole pruner would do the 
job handily.
 
> Also, if the threat of homeowners being at risk of thieves climbing 
> telepone poles to cut the power, the security companies would have long 
> ago stopping giving security alert lawn signs and decals to their 
> customers, because they'd have learned  that such warnings would invite 
> thieves and increase break-ins and losses, rather than deterring them.

They would continue to give away those signs because the the signs 
are advertising for them.  They are in business to earn money, not 
to prevent burglary.

-- 
John Varela

[toc] | [prev] | [next] | [standalone]

#6752

From	Your Name <YourName@YourISP.com>
Date	2018-11-11 10:24 +1300
Message-ID	<ps7ib5$1ma6$1@gioia.aioe.org>
In reply to	#6749

On 2018-11-10 06:23:26 +0000, Tom Evans said:
> On 2018-11-10 02:07:14 +0000, nospam said:
>> In article <ps5e14$b9u$1@gioia.aioe.org>, Your Name
>> <YourName@YourISP.com> wrote:
>>> 
>>> The only real world way someone is going to be able to read that file
>>> is if they have physical access to your computer and it's logged into
>>> your user account (or your computer password is very simple to guess,
>>> or you're stupid enough to have it written on a sticky note attache to
>>> the display!).
>> 
>> wrong.
>> 
>> if someone has physical access to the computer, they don't need to log
>> in at all.

They do if you've set a firmware password (and make sure to remember 
that) which then disables access to the recovery options and external 
drive booting without the correct password.

> No one else but me has physical access to my Mac, so I deactivated my passcode.

They will have access if they break into your house and / or steal the 
computer. It's best to leave the login options to require the password, 
and set the computer to require that password on wakeup from sleep 
(even from screensaver if it's a laptop you actually take off the desk 
to other locations).

> But this reminds me of another worry:  It it possible for a hacker to 
> hack via System Preferences > Users and Groups > Other Users?  I have 
> an alternate account there with my name on it, whcih is marked 
> "Standard" and a Guest account, but both of those usersare show in in 
> gray type and the Guest account says it's "Off".

If you have Guest turned off, then nobody can get in without the password.

Even if you ave Guest turned on, they have limited access and cannot 
access your user's files.

Other user accounts cannot access your user's files either, unless you 
have set them to have Admin privileges ... an Admin account and 
password can access basically everything on the computer.

>> either boot off an external drive or put the mac into target drive mode
>> and they'll have full access to *anything* on the drive.
>> 
>> unless of course, it's encrypted...

Or you have set the firmware password.

>>> The only possible exception is if you install software from a dodgy
>>> source. For example, never click on a pop-up link in your web browser
>>> that claims you need to update / install software (such as Flash or
>>> Java). Even then the chances are extremely low.
>> 
>> wrong on that too.
>> 
>> clicking on a link makes the chances extremely *high* something bad
>> will be installed.

Only if you then also enter your Admin password. Something you should 
never do when you don't really know why the computer is asking for it.

>>> Even better, take it to an authorised Apple tech centre, but you'll be
>>> paying money and the liklihood of them actually finding any problem is
>>> basically zero.
>> 
>> wrong yet again.
>> 
>> apple stores don't charge anything.

I said Authorised Apple tech centre. Official Apple stores's Genius Bar 
may not charge, but the indpendently owned stores can and do.

>>>> But I've spoken with employees from my bank about this fraud attempt,
>>>> and they advised me not to store my bank information on my computer, so
>>>> that's another source of contradictory advice.
>>> 
>>> Bank employees, like most of the world (especially 'help' desk
>>> operators), are all Windoze drones and have zero understanding of Apple
>>> devices. In fact most 'help' desk operators have zero understanding of
>>> anything and simply read off a script on their screen or do Google
>>> searches for answers.   :-\
>> 
>> wrong once more.
>> 
>> it's not an apple/windows issue.
>> 
>> storing private information, including bank logins and passwords, in an
>> unencrypted file is flat out stupid, regardless of platform.
> 
> I think my Mac must have been 'hacked' because how else could the 
> fraudster know my name, log into my credit card account by phone and 
> steal $1,700 from my credit card account, before someone at the bank 
> spotted the suspicous transaction and reversed the charge to my 
> account?  After that, the same day (Wednesday) I got an urgent phone 
> message from the bank as me to call the bank as soon as possible.

It's relatively easy to do and happens thousands of times a day to 
people who don't even own a computer.

It is extremely doubtful your Mac has been "hacked".

More likely is that you entered information into a web form, even 
perhaps entering a dodgey competition, that gave the criminal the 
initial start to track down you mother's maiden name.

Or, even more likely, maybe you use the same information for a Yahoo 
account or Amazon account (for example) and it was that which was 
hacked at the Yahoo / Amazon server end. There's nothing you can do 
about that, other than use different passwords and security questions 
for each account.

> Today I phoned the bank's loss prevention department again and found 
> out that the caller called the bank from a distant part of the country. 
>  One of the bank employees even gave me the phone number used by the 
> criminal to phone the bank and attempt the theft and impersonation, but 
> refused to divulge details.
> 
>> either encrypt it, or better yet and has been suggested, use a password
>> manager which does the encryption for you and without the hassles.
> 
> I'll do that, after I deccide which passcode manager to use.  (I think 
> I'll try Keychain first.)  In the meantime, I've trashed and emptied 
> from the trash the files of passcodes and similar info from my Mac, and 
> ejected my back-up drives so that they, too, can't be accessed for the 
> same files, until I have the data stored in Keychain or a similar 
> program, and then I'll take the sensitive data off of my back-up drives 
> as well.

You're WAY over-thinking what is almost certainly a one-off occurence 
that had nothing to do with your own computer.

If I had a million dollars I would be make a million dollar bet that 
that is no malware on your computer ... because nobody has *ever* 
actually found any on a Mac in the real world for a normal user. Those 
who download pirate material are a different case and get what they 
deserve. (Windoze computers on the other hand can get malware just 
because you blinked "wrong" while looking at the display!!)

[toc] | [prev] | [next] | [standalone]

#6753

From	nospam <nospam@nospam.invalid>
Date	2018-11-10 16:56 -0500
Message-ID	<101120181656410887%nospam@nospam.invalid>
In reply to	#6752

In article <ps7ib5$1ma6$1@gioia.aioe.org>, Your Name
<YourName@YourISP.com> wrote:

> >>> The only real world way someone is going to be able to read that file
> >>> is if they have physical access to your computer and it's logged into
> >>> your user account (or your computer password is very simple to guess,
> >>> or you're stupid enough to have it written on a sticky note attache to
> >>> the display!).
> >> 
> >> wrong.
> >> 
> >> if someone has physical access to the computer, they don't need to log
> >> in at all.
> 
> They do if you've set a firmware password (and make sure to remember 
> that) which then disables access to the recovery options and external 
> drive booting without the correct password.

you didn't say anything about a firmware password, which only slows
someone down. they can (in most cases) remove the hard drive, at which
point, a firmware password no longer matters. 

some macs make drive removal difficult to impossible, but other than
the ones with a t2 chip, it's still possible to extract data.

disabling booting from external drives is going to be an incredible
pain in the ass for home users, who are likely to want to boot off an
external drive at some point.

> > No one else but me has physical access to my Mac, so I deactivated my
> > passcode.
> 
> They will have access if they break into your house and / or steal the 
> computer. It's best to leave the login options to require the password, 
> and set the computer to require that password on wakeup from sleep 
> (even from screensaver if it's a laptop you actually take off the desk 
> to other locations).

sleep/wake password won't stop anyone.

> > But this reminds me of another worry:  It it possible for a hacker to 
> > hack via System Preferences > Users and Groups > Other Users?  I have 
> > an alternate account there with my name on it, whcih is marked 
> > "Standard" and a Guest account, but both of those usersare show in in 
> > gray type and the Guest account says it's "Off".
> 
> If you have Guest turned off, then nobody can get in without the password.
>
> Even if you ave Guest turned on, they have limited access and cannot 
> access your user's files.
> 
> Other user accounts cannot access your user's files either, unless you 
> have set them to have Admin privileges ... an Admin account and 
> password can access basically everything on the computer.

all of that is wrong.

reboot from a usb stick and *everything* is accessible.

> >> either boot off an external drive or put the mac into target drive mode
> >> and they'll have full access to *anything* on the drive.
> >> 
> >> unless of course, it's encrypted...
> 
> Or you have set the firmware password.

nope. see above.

> >>> The only possible exception is if you install software from a dodgy
> >>> source. For example, never click on a pop-up link in your web browser
> >>> that claims you need to update / install software (such as Flash or
> >>> Java). Even then the chances are extremely low.
> >> 
> >> wrong on that too.
> >> 
> >> clicking on a link makes the chances extremely *high* something bad
> >> will be installed.
> 
> Only if you then also enter your Admin password. Something you should 
> never do when you don't really know why the computer is asking for it.

an admin password is not always required to pwn a system.

> >>> Even better, take it to an authorised Apple tech centre, but you'll be
> >>> paying money and the liklihood of them actually finding any problem is
> >>> basically zero.
> >> 
> >> wrong yet again.
> >> 
> >> apple stores don't charge anything.
> 
> I said Authorised Apple tech centre. Official Apple stores's Genius Bar 
> may not charge,

do not charge, other than for hardware failures out of warranty, and
even then, they sometimes waive fees. 

> but the indpendently owned stores can and do.

some do, some don't.

[toc] | [prev] | [next] | [standalone]

#6754

From	Jolly Roger <jollyroger@pobox.com>
Date	2018-11-10 23:11 +0000
Message-ID	<g4p6siF1q6uU1@mid.individual.net>
In reply to	#6753

On 2018-11-10, nospam <nospam@nospam.invalid> wrote:
> In article <ps7ib5$1ma6$1@gioia.aioe.org>, Your Name
><YourName@YourISP.com> wrote:
>> 
>> They do if you've set a firmware password (and make sure to remember 
>> that) which then disables access to the recovery options and external 
>> drive booting without the correct password.
>
> you didn't say anything about a firmware password, which only slows
> someone down. they can (in most cases) remove the hard drive, at which
> point, a firmware password no longer matters. 

A firmware password prevents starting up from any internal or external
storage device other than the startup disk you've selected in the System
Preferences > Startup Disk panel. And if the startup drive is FileVault
encrypted, you can't throw it into an enclosure or another Mac to start
up on it since it's securely locked. I always recommend Mac users use a
firmware password and FileVault for this reason. 

I also recommend they enable Find My Mac, which lets you lock, erase,
sounds alerts, and display messages on your Mac remotely with any Find
My *** app on any iOS device or on the iCloud.com website. I use all
three and have tested them with all of my Macs, and am happy to report
they work great. 

> disabling booting from external drives is going to be an incredible
> pain in the ass for home users, who are likely to want to boot off an
> external drive at some point.

With a firmware password set, you can still boot from any disk you want;
you just need to set it in the System Preferences > Startup Disk panel
first.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#6755

From	nospam <nospam@nospam.invalid>
Date	2018-11-10 19:18 -0500
Message-ID	<101120181918180757%nospam@nospam.invalid>
In reply to	#6754

In article <g4p6siF1q6uU1@mid.individual.net>, Jolly Roger
<jollyroger@pobox.com> wrote:

> >> They do if you've set a firmware password (and make sure to remember 
> >> that) which then disables access to the recovery options and external 
> >> drive booting without the correct password.
> >
> > you didn't say anything about a firmware password, which only slows
> > someone down. they can (in most cases) remove the hard drive, at which
> > point, a firmware password no longer matters. 
> 
> A firmware password prevents starting up from any internal or external
> storage device other than the startup disk you've selected in the System
> Preferences > Startup Disk panel.

that doesn't matter if the drive is removed. 

as i said, it just slows someone down. 

> And if the startup drive is FileVault
> encrypted, you can't throw it into an enclosure or another Mac to start
> up on it since it's securely locked. I always recommend Mac users use a
> firmware password and FileVault for this reason. 

filevault is the key, ideally done *not* via system preferences, which
links it to user accounts. instead, install or copy a system to an
already encrypted drive. 

> I also recommend they enable Find My Mac, which lets you lock, erase,
> sounds alerts, and display messages on your Mac remotely with any Find
> My *** app on any iOS device or on the iCloud.com website. I use all
> three and have tested them with all of my Macs, and am happy to report
> they work great. 

that's also useful.

[toc] | [prev] | [next] | [standalone]

#6762

From	Jolly Roger <jollyroger@pobox.com>
Date	2018-11-11 16:41 +0000
Message-ID	<g4r4ekFes8tU2@mid.individual.net>
In reply to	#6755

On 2018-11-11, nospam <nospam@nospam.invalid> wrote:
> In article <g4p6siF1q6uU1@mid.individual.net>, Jolly Roger
><jollyroger@pobox.com> wrote:
>
>>>> They do if you've set a firmware password (and make sure to
>>>> remember that) which then disables access to the recovery options
>>>> and external drive booting without the correct password.
>>>
>>> you didn't say anything about a firmware password, which only slows
>>> someone down. they can (in most cases) remove the hard drive, at
>>> which point, a firmware password no longer matters. 
>> 
>> A firmware password prevents starting up from any internal or
>> external storage device other than the startup disk you've selected
>> in the System Preferences > Startup Disk panel.
>
> that doesn't matter if the drive is removed. 

They cannot boot the machine from any other drive. How does that not
matter?

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#6763

From	nospam <nospam@nospam.invalid>
Date	2018-11-11 11:48 -0500
Message-ID	<111120181148033796%nospam@nospam.invalid>
In reply to	#6762

In article <g4r4ekFes8tU2@mid.individual.net>, Jolly Roger
<jollyroger@pobox.com> wrote:

> >> A firmware password prevents starting up from any internal or
> >> external storage device other than the startup disk you've selected
> >> in the System Preferences > Startup Disk panel.
> >
> > that doesn't matter if the drive is removed. 
> 
> They cannot boot the machine from any other drive. How does that not
> matter?

once the drive is removed, the original machine no longer matters.

put the drive in an enclosure, connect it to another computer and
everything on that drive will be accessible, unless it's encrypted. 

recent macs with a t2 chip make this method impossible.

[toc] | [prev] | [next] | [standalone]

#6765

From	Jolly Roger <jollyroger@pobox.com>
Date	2018-11-11 18:58 +0000
Message-ID	<g4rcdtFgsabU1@mid.individual.net>
In reply to	#6763

nospam <nospam@nospam.invalid> wrote:
> In article <g4r4ekFes8tU2@mid.individual.net>, Jolly Roger
> <jollyroger@pobox.com> wrote:
> 
>>>> A firmware password prevents starting up from any internal or
>>>> external storage device other than the startup disk you've selected
>>>> in the System Preferences > Startup Disk panel.
>>> 
>>> that doesn't matter if the drive is removed. 
>> 
>> They cannot boot the machine from any other drive. How does that not
>> matter?
> 
> once the drive is removed, the original machine no longer matters.

The machine is virtually useless - that does matter, to me at least.

> put the drive in an enclosure, connect it to another computer and
> everything on that drive will be accessible, unless it's encrypted. 

But if it is encrypted, it is also virtually useless. All Mac users should
use FileVault.

> recent macs with a t2 chip make this method impossible.

What method?

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#6766

From	nospam <nospam@nospam.invalid>
Date	2018-11-11 14:17 -0500
Message-ID	<111120181417301807%nospam@nospam.invalid>
In reply to	#6765

In article <g4rcdtFgsabU1@mid.individual.net>, Jolly Roger
<jollyroger@pobox.com> wrote:

> >>>> A firmware password prevents starting up from any internal or
> >>>> external storage device other than the startup disk you've selected
> >>>> in the System Preferences > Startup Disk panel.
> >>> 
> >>> that doesn't matter if the drive is removed. 
> >> 
> >> They cannot boot the machine from any other drive. How does that not
> >> matter?
> > 
> > once the drive is removed, the original machine no longer matters.
> 
> The machine is virtually useless - that does matter, to me at least.

someone wanting to access your data doesn't care about that. 

it will stop a casual snoop, but that's about it. 

> > put the drive in an enclosure, connect it to another computer and
> > everything on that drive will be accessible, unless it's encrypted. 
> 
> But if it is encrypted, it is also virtually useless. All Mac users should
> use FileVault.

yep. they should. however, most do not.

> > recent macs with a t2 chip make this method impossible.
> 
> What method?

removing the drive.

even with soldered ssds, the chips can be accessed with data intact.

the t2 chip encrypts the data using a machine-specific key, so there is
no way to access the data, outside of cracking that key, which will be
billions of years. it also blocks booting untrusted operating systems
(unless disabled).

[toc] | [prev] | [next] | [standalone]

#6767

From	Jolly Roger <jollyroger@pobox.com>
Date	2018-11-11 21:10 +0000
Message-ID	<g4rk64Fiio2U1@mid.individual.net>
In reply to	#6766

nospam <nospam@nospam.invalid> wrote:
> In article <g4rcdtFgsabU1@mid.individual.net>, Jolly Roger
> <jollyroger@pobox.com> wrote:
> 
>>>>>> A firmware password prevents starting up from any internal or
>>>>>> external storage device other than the startup disk you've selected
>>>>>> in the System Preferences > Startup Disk panel.
>>>>> 
>>>>> that doesn't matter if the drive is removed. 
>>>> 
>>>> They cannot boot the machine from any other drive. How does that not
>>>> matter?
>>> 
>>> once the drive is removed, the original machine no longer matters.
>> 
>> The machine is virtually useless - that does matter, to me at least.
> 
> someone wanting to access your data doesn't care about that. 

Someone wanting to use your stolen computer certainly cares about it.

>>> put the drive in an enclosure, connect it to another computer and
>>> everything on that drive will be accessible, unless it's encrypted. 
>> 
>> But if it is encrypted, it is also virtually useless. All Mac users should
>> use FileVault.
> 
> yep. they should. however, most do not.

That’s their loss.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#6772

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-12 13:04 -0800
Message-ID	<2018111213044171566-tomevans9890@yahoo.ca>
In reply to	#6752

On 2018-11-10 21:24:55 +0000, Your Name said:

> On 2018-11-10 06:23:26 +0000, Tom Evans said:
>> On 2018-11-10 02:07:14 +0000, nospam said:
>>> In article <ps5e14$b9u$1@gioia.aioe.org>, Your Name
>>> <YourName@YourISP.com> wrote:
> 
>> But this reminds me of another worry:  It it possible for a hacker to 
>> hack via System Preferences > Users and Groups > Other Users?  I have 
>> an alternate account there with my name on it, whcih is marked 
>> "Standard" and a Guest account, but both of those usersare show in in 
>> gray type and the Guest account says it's "Off".
> 
> If you have Guest turned off, then nobody can get in without the password.
> 
> Even if you ave Guest turned on, they have limited access and cannot 
> access your user's files.
> 
> Other user accounts cannot access your user's files either, unless you 
> have set them to have Admin privileges ... an Admin account and 
> password can access basically everything on the computer.

What about the Public folder in my Users and Groups > Groups?

Under Groups, it says "Tom's Public Folder".  When I unlock that 
folder, there are three names -- "Tomevans", my alternate user name 
"Tom" and "Guest".  There are no check marks next to any of those three 
accounts.

Tom

[toc] | [prev] | [next] | [standalone]

#6776

From	Your Name <YourName@YourISP.com>
Date	2018-11-13 13:51 +1300
Message-ID	<psd75j$ul9$1@gioia.aioe.org>
In reply to	#6772

On 2018-11-12 21:04:41 +0000, Tom Evans said:
> On 2018-11-10 21:24:55 +0000, Your Name said:
>> On 2018-11-10 06:23:26 +0000, Tom Evans said:
>>> 
>>> But this reminds me of another worry:  It it possible for a hacker to 
>>> hack via System Preferences > Users and Groups > Other Users?  I have 
>>> an alternate account there with my name on it, whcih is marked 
>>> "Standard" and a Guest account, but both of those usersare show in in 
>>> gray type and the Guest account says it's "Off".
>> 
>> If you have Guest turned off, then nobody can get in without the password.
>> 
>> Even if you ave Guest turned on, they have limited access and cannot 
>> access your user's files.
>> 
>> Other user accounts cannot access your user's files either, unless you 
>> have set them to have Admin privileges ... an Admin account and 
>> password can access basically everything on the computer.
> 
> What about the Public folder in my Users and Groups > Groups?
> 
> Under Groups, it says "Tom's Public Folder".  When I unlock that 
> folder, there are three names -- "Tomevans", my alternate user name 
> "Tom" and "Guest".  There are no check marks next to any of those three 
> accounts.

Yes the Public and Shared folders are available to all users, but they 
aren't usually where anybody stores file, except on purpose.

[toc] | [prev] | [next] | [standalone]

#6744

From	Jolly Roger <jollyroger@pobox.com>
Date	2018-11-10 01:19 +0000
Message-ID	<g4mq1jFftsaU3@mid.individual.net>
In reply to	#6738

On 2018-11-09, Your Name <YourName@YourISP.com> wrote:
> On 2018-11-09 04:55:06 +0000, Tom Evans said:
>> On 2018-11-08 22:10:58 +0000, nospam said:
>>> In article <2018110813514766717-tomevans9890@yahoo.ca>, Tom Evans
>>> <tomevans9890@yahoo.ca> wrote:
>>>> 
>>>> I thought maybe the thief was able to hack into my Mac and find my bank
>>>> information there.  (I have my user names and passcodes stored on my
>>>> Mac, but in a text program and not in Keychain.)
>>> 
>>> that's *not* a good idea.
>> 
>> Two messages down, Your Name wrote that it's "immensely unlikely" that 
>> a hacker hack into my bank data on  my Mac, and two messages up, Callum 
>> wrote "If nobody else has physical access to that desktop Mac [which 
>> nobody does] it's very safe indeed, especially if you don't sync the 
>> keychain via iCloud to any other Mac" [which I haven't].
>> 
>> So who's right, those two guys, or Nospam here, who wrote that it's 
>> "not a good idea" to store sensitive data in a text file on a Mac?
>> 
>> The opinions seems to be contradictory.
>
> One of the simple rules to remember around here is: Nospam is never 
> right. (Neither is Jolly Roger).

That's rich, coming from Mr. Your Name himself...

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#6785

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-15 12:33 -0800
Message-ID	<2018111512335155297-tomevans9890@yahoo.ca>
In reply to	#6726

On 2018-11-08 22:10:58 +0000, nospam said:

> In article <2018110813514766717-tomevans9890@yahoo.ca>, Tom Evans
> <tomevans9890@yahoo.ca> wrote:
> 
>> 
>> The reason I asked if Keychain is safe is because a robber tried
>> (unsuccessfully) to steal $1,700 from one of my credit cards by calling
>> my bank and impersonating me yesterday.  The bank employee I spoke with
>> after the bank alerted me said that the thief knew my security
>> questions that were asked of him.
> 
> likely because you gave real answers to the insecurity questions.
> 
> most of those are public information, such as what was your first car,
> or can be easily determined with a bit of digging, such as what street
> you grew up on or who was your 1st grade teacher.

That's false.

My bank and credit card information is not publicly available.  When 
customers call VISA or my bank regarding my account, the employee asks 
security screening questions such as what was the dollar amount of a 
late transaction in one of my accounts, what my phone code is that I 
use for phoning the bank, what one of my account number is, if a 
particular account is joint or single and what my credit limit is in a 
particular account, or how many accounts I have and how many accounts 
are credit accounts and how many are debit accounts.

> or the information was compromised in another breach.
> 
>> I thought maybe the thief was able to hack into my Mac and find my bank
>> information there.  (I have my user names and passcodes stored on my
>> Mac, but in a text program and not in Keychain.)
> 
> that's *not* a good idea.
> 
> 
> 
>> I called Apple and two technicians on the phone said it's safe (from
>> hackers) to store sensitive info on the Mac even in a text program, and
>> that I don't need an anti-virus program.
> 
> anti-virus apps won't stop a password cracker. all they need is a copy
> of your text file...

What about Notes with a passcode?

Tom

[toc] | [prev] | [next] | [standalone]

#6786

From	nospam <nospam@nospam.invalid>
Date	2018-11-15 15:46 -0500
Message-ID	<151120181546019233%nospam@nospam.invalid>
In reply to	#6785

In article <2018111512335155297-tomevans9890@yahoo.ca>, Tom Evans
<tomevans9890@yahoo.ca> wrote:

> >> The reason I asked if Keychain is safe is because a robber tried
> >> (unsuccessfully) to steal $1,700 from one of my credit cards by calling
> >> my bank and impersonating me yesterday.  The bank employee I spoke with
> >> after the bank alerted me said that the thief knew my security
> >> questions that were asked of him.
> > 
> > likely because you gave real answers to the insecurity questions.
> > 
> > most of those are public information, such as what was your first car,
> > or can be easily determined with a bit of digging, such as what street
> > you grew up on or who was your 1st grade teacher.
> 
> That's false.

it's not.

> My bank and credit card information is not publicly available. 

actually, it is, and plenty of companies buy it to market stuff to you.

> When 
> customers call VISA or my bank regarding my account, the employee asks 
> security screening questions such as what was the dollar amount of a 
> late transaction in one of my accounts, what my phone code is that I 
> use for phoning the bank, what one of my account number is, if a 
> particular account is joint or single and what my credit limit is in a 
> particular account, or how many accounts I have and how many accounts 
> are credit accounts and how many are debit accounts.

<https://pando.com/2013/10/26/i-challenged-hackers-to-investigate-me-and-
what-they-found-out-is-chilling/>
  Equipped with my credit header, Cohn had what he needed to access a
  Federal Reserve database listing my deposit accounts, some of which I
  had long forgotten  $503 at Apple Bank for Savings in an account
  held by a long-ago landlord as a security deposit; $7 in a dormant
  savings account at Chase Manhattan Bank; $1,000 in another Chase
  account. A few days later Cohn located my Merrill Lynch cash
  management account, which I had opened a few months earlier. He then
  had my checking and savings account balances, direct deposits from
  work, withdrawals, ATM visits, check numbers with dates and amounts,
  and the name of my broker. In addition to my finances, he also
  obtained utility bills and two unlisted phone numbers, which
  cataloged a bevy of long distance and local phone calls I had made.

  Armed with this information, Cohn could have easily mapped out my
  routines. He knew how much cash I withdrew from ATMs each week, how
  much Forbes deposited into my checking account twice a month, the
  cafes and restaurants I frequented, the monthly checks I wrote to a
  shrink. He possessed my latest phone bill and a list of long distance
  calls to and from my home, including late-night fiber-optic
  dalliances with a woman I was dating and who worked for an
  advertising agency and traveled a lot. Cohn also divined phone
  numbers of a few of my sources, including a couple of computer
  hackers who had told me of their black hat activities.

[toc] | [prev] | [next] | [standalone]

#6790

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-15 13:59 -0800
Message-ID	<2018111513592856814-tomevans9890@yahoo.ca>
In reply to	#6786

On 2018-11-15 20:46:01 +0000, nospam said:

> In article <2018111512335155297-tomevans9890@yahoo.ca>, Tom Evans
> <tomevans9890@yahoo.ca> wrote:
> 
>>>> The reason I asked if Keychain is safe is because a robber tried
>>>> (unsuccessfully) to steal $1,700 from one of my credit cards by calling
>>>> my bank and impersonating me yesterday.  The bank employee I spoke with
>>>> after the bank alerted me said that the thief knew my security
>>>> questions that were asked of him.
>>> 
>>> likely because you gave real answers to the insecurity questions.
>>> 
>>> most of those are public information, such as what was your first car,
>>> or can be easily determined with a bit of digging, such as what street
>>> you grew up on or who was your 1st grade teacher.
>> 
>> That's false.
> 
> it's not.
> 
>> My bank and credit card information is not publicly available.
> 
> actually, it is, and plenty of companies buy it to market stuff to you.
> 
>> When
>> customers call VISA or my bank regarding my account, the employee asks
>> security screening questions such as what was the dollar amount of a
>> late transaction in one of my accounts, what my phone code is that I
>> use for phoning the bank, what one of my account number is, if a
>> particular account is joint or single and what my credit limit is in a
>> particular account, or how many accounts I have and how many accounts
>> are credit accounts and how many are debit accounts.

The security questions and answers I listed above are not the same type 
of information as the ones you quoted below.  My case involved a person 
somehow getting my bank and credit information and calling the bank to 
impersonate me to try to steal money.  That's not the same scenario as 
hwy you quoted.

My bank, VISA and I are the only parties that are supposed to know the 
answers to the questions I listed above, and my bank has no reason to 
share that information with anyone because that would mean they'd be 
leaking customer information which would cost them time and money to 
fix.

There's no reason why they would willingly breach their customer's 
privacy by sharing all that private information with other companies, 
and it's not necessary to share all that account information with other 
companies for companies to try to market products or services to me.

Also, if my bank and VISA knowingly shared my bank and VISA information 
with others, that would mean every bank and VISA customer would be 
subject to the same attempted bank fraud, and my bank has millions of 
customers, but my bank has not had millions of calls from fraudsters 
trying to steal money using the bank's customer's bank and credit 
information.

So your comparison of my case and that other case is not a good one.

Tom

> <https://pando.com/2013/10/26/i-challenged-hackers-to-investigate-me-and-
> what-they-found-out-is-chilling/>
>   Equipped with my credit header, Cohn had what he needed to access a
>   Federal Reserve database listing my deposit accounts, some of which I
>   had long forgotten  $503 at Apple Bank for Savings in an account
>   held by a long-ago landlord as a security deposit; $7 in a dormant
>   savings account at Chase Manhattan Bank; $1,000 in another Chase
>   account. A few days later Cohn located my Merrill Lynch cash
>   management account, which I had opened a few months earlier. He then
>   had my checking and savings account balances, direct deposits from
>   work, withdrawals, ATM visits, check numbers with dates and amounts,
>   and the name of my broker. In addition to my finances, he also
>   obtained utility bills and two unlisted phone numbers, which
>   cataloged a bevy of long distance and local phone calls I had made.
> 
>   Armed with this information, Cohn could have easily mapped out my
>   routines. He knew how much cash I withdrew from ATMs each week, how
>   much Forbes deposited into my checking account twice a month, the
>   cafes and restaurants I frequented, the monthly checks I wrote to a
>   shrink. He possessed my latest phone bill and a list of long distance
>   calls to and from my home, including late-night fiber-optic
>   dalliances with a woman I was dating and who worked for an
>   advertising agency and traveled a lot. Cohn also divined phone
>   numbers of a few of my sources, including a couple of computer
>   hackers who had told me of their black hat activities.

[toc] | [prev] | [next] | [standalone]

#6791

From	nospam <nospam@nospam.invalid>
Date	2018-11-15 17:10 -0500
Message-ID	<151120181710544848%nospam@nospam.invalid>
In reply to	#6790

In article <2018111513592856814-tomevans9890@yahoo.ca>, Tom Evans
<tomevans9890@yahoo.ca> wrote:

> My bank, VISA and I are the only parties that are supposed to know the 
> answers to the questions I listed above, and my bank has no reason to 
> share that information with anyone because that would mean they'd be 
> leaking customer information which would cost them time and money to 
> fix.

not intentionally, but shit happens. security is often an afterthought,
hackers can compromise it or rogue employees access it directly and
provide it to whomever.

due to the equifax breach, your credit report and those of hundreds of
millions of others, are now public. included in your credit report are
all of your open and closed accounts, credit limits, payment history,
address history and much more.

[toc] | [prev] | [next] | [standalone]

#6797

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-15 19:04 -0800
Message-ID	<2018111519040526705-tomevans9890@yahoo.ca>
In reply to	#6791

On 2018-11-15 22:10:54 +0000, nospam said:

> In article <2018111513592856814-tomevans9890@yahoo.ca>, Tom Evans
> <tomevans9890@yahoo.ca> wrote:
> 
>> My bank, VISA and I are the only parties that are supposed to know the
>> answers to the questions I listed above, and my bank has no reason to
>> share that information with anyone because that would mean they'd be
>> leaking customer information which would cost them time and money to
>> fix.
> 
> not intentionally, but shit happens. security is often an afterthought,
> hackers can compromise it or rogue employees access it directly and
> provide it to whomever.
> 
> due to the equifax breach, your credit report and those of hundreds of
> millions of others, are now public. included in your credit report are
> all of your open and closed accounts, credit limits, payment history,
> address history and much more.

if that's the case, and given the fact that I didn't type any sensitive 
information in any phishing email link such as my account numbers or 
passcodes or PINs, and given the fact that I'm the only person with 
access to my Mac, and given the fact that a criminal could not have 
found my bank and VISA information by going through my trash, the fraud 
attempt must have occurred through my bank or VISA -- not through my 
Mac or any lack of security on my Mac.

Tom

[toc] | [prev] | [next] | [standalone]

#6805

From	Your Name <YourName@YourISP.com>
Date	2018-11-16 18:44 +1300
Message-ID	<psllgg$fr3$1@gioia.aioe.org>
In reply to	#6797

On 2018-11-16 03:04:05 +0000, Tom Evans said:
> On 2018-11-15 22:10:54 +0000, nospam said:
>> In article <2018111513592856814-tomevans9890@yahoo.ca>, Tom Evans
>> <tomevans9890@yahoo.ca> wrote:
>>> 
>>> My bank, VISA and I are the only parties that are supposed to know the
>>> answers to the questions I listed above, and my bank has no reason to
>>> share that information with anyone because that would mean they'd be
>>> leaking customer information which would cost them time and money to
>>> fix.
>> 
>> not intentionally, but shit happens. security is often an afterthought,
>> hackers can compromise it or rogue employees access it directly and
>> provide it to whomever.
>> 
>> due to the equifax breach, your credit report and those of hundreds of
>> millions of others, are now public. included in your credit report are
>> all of your open and closed accounts, credit limits, payment history,
>> address history and much more.
> 
> if that's the case, and given the fact that I didn't type any sensitive 
> information in any phishing email link such as my account numbers or 
> passcodes or PINs, and given the fact that I'm the only person with 
> access to my Mac, and given the fact that a criminal could not have 
> found my bank and VISA information by going through my trash, the fraud 
> attempt must have occurred through my bank or VISA -- not through my 
> Mac or any lack of security on my Mac.

Which as we said at the start, it is highly unlikely to be the Mac's fault.

[toc] | [prev] | [next] | [standalone]

Page 5 of 7 — ← Prev page 1 2 3 4 [5] 6 7 Next page →

csiph-web

Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

Contents

#6771

#6775

#6752

#6753

#6754

#6755

#6762

#6763

#6765

#6766

#6767

#6772

#6776

#6744

#6785

#6786

#6790

#6791

#6797

#6805