Groups > comp.sys.mac.misc > #6717 > unrolled thread

Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

Started by	Tom Evans <tomevans9890@yahoo.ca>
First post	2018-11-07 21:59 -0800
Last post	2018-11-08 20:22 +0000
Articles	20 on this page of 131 — 7 participants

Back to article view | Back to comp.sys.mac.misc

Page 6 of 7 — ← Prev page 1 2 3 4 5 [6] 7 Next page →

#6808

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-16 08:12 -0800
Message-ID	<2018111608121718176-tomevans9890@yahoo.ca>
In reply to	#6805

On 2018-11-16 05:44:48 +0000, Your Name said:

> On 2018-11-16 03:04:05 +0000, Tom Evans said:
>> On 2018-11-15 22:10:54 +0000, nospam said:
>>> In article <2018111513592856814-tomevans9890@yahoo.ca>, Tom Evans
>>> <tomevans9890@yahoo.ca> wrote:
>>>> 
>>>> My bank, VISA and I are the only parties that are supposed to know the
>>>> answers to the questions I listed above, and my bank has no reason to
>>>> share that information with anyone because that would mean they'd be
>>>> leaking customer information which would cost them time and money to
>>>> fix.
>>> 
>>> not intentionally, but shit happens. security is often an afterthought,
>>> hackers can compromise it or rogue employees access it directly and
>>> provide it to whomever.
>>> 
>>> due to the equifax breach, your credit report and those of hundreds of
>>> millions of others, are now public. included in your credit report are
>>> all of your open and closed accounts, credit limits, payment history,
>>> address history and much more.
>> 
>> if that's the case, and given the fact that I didn't type any sensitive 
>> information in any phishing email link such as my account numbers or 
>> passcodes or PINs, and given the fact that I'm the only person with 
>> access to my Mac, and given the fact that a criminal could not have 
>> found my bank and VISA information by going through my trash, the fraud 
>> attempt must have occurred through my bank or VISA -- not through my 
>> Mac or any lack of security on my Mac.
> 
> Which as we said at the start, it is highly unlikely to be the Mac's fault.

So it's therefore also highly unlikely to be my fault?

Tom

[toc] | [prev] | [next] | [standalone]

#6811

From	Your Name <YourName@YourISP.com>
Date	2018-11-17 09:37 +1300
Message-ID	<psn9pa$19lt$1@gioia.aioe.org>
In reply to	#6808

On 2018-11-16 16:12:17 +0000, Tom Evans said:
> On 2018-11-16 05:44:48 +0000, Your Name said:
>> On 2018-11-16 03:04:05 +0000, Tom Evans said:
>>> On 2018-11-15 22:10:54 +0000, nospam said:
>>>> In article <2018111513592856814-tomevans9890@yahoo.ca>, Tom Evans
>>>> <tomevans9890@yahoo.ca> wrote:
>>>>> 
>>>>> My bank, VISA and I are the only parties that are supposed to know the
>>>>> answers to the questions I listed above, and my bank has no reason to
>>>>> share that information with anyone because that would mean they'd be
>>>>> leaking customer information which would cost them time and money to
>>>>> fix.
>>>> 
>>>> not intentionally, but shit happens. security is often an afterthought,
>>>> hackers can compromise it or rogue employees access it directly and
>>>> provide it to whomever.
>>>> 
>>>> due to the equifax breach, your credit report and those of hundreds of
>>>> millions of others, are now public. included in your credit report are
>>>> all of your open and closed accounts, credit limits, payment history,
>>>> address history and much more.
>>> 
>>> if that's the case, and given the fact that I didn't type any sensitive 
>>> information in any phishing email link such as my account numbers or 
>>> passcodes or PINs, and given the fact that I'm the only person with 
>>> access to my Mac, and given the fact that a criminal could not have 
>>> found my bank and VISA information by going through my trash, the fraud 
>>> attempt must have occurred through my bank or VISA -- not through my 
>>> Mac or any lack of security on my Mac.
>> 
>> Which as we said at the start, it is highly unlikely to be the Mac's fault.
> 
> So it's therefore also highly unlikely to be my fault?

Simple "user error" is more likely than "my Mac has been hacked / has malware".

[toc] | [prev] | [next] | [standalone]

#6796

From	Your Name <YourName@YourISP.com>
Date	2018-11-16 14:26 +1300
Message-ID	<psl6ba$1sma$1@gioia.aioe.org>
In reply to	#6785

On 2018-11-15 20:33:51 +0000, Tom Evans said:
> On 2018-11-08 22:10:58 +0000, nospam said:
>> In article <2018110813514766717-tomevans9890@yahoo.ca>, Tom Evans
>> <tomevans9890@yahoo.ca> wrote:
>>> 
>>> The reason I asked if Keychain is safe is because a robber tried
>>> (unsuccessfully) to steal $1,700 from one of my credit cards by calling
>>> my bank and impersonating me yesterday.  The bank employee I spoke with
>>> after the bank alerted me said that the thief knew my security
>>> questions that were asked of him.
>> 
>> likely because you gave real answers to the insecurity questions.
>> 
>> most of those are public information, such as what was your first car,
>> or can be easily determined with a bit of digging, such as what street
>> you grew up on or who was your 1st grade teacher.
> 
> That's false.
> 
> My bank and credit card information is not publicly available.  When 
> customers call VISA or my bank regarding my account, the employee asks 
> security screening questions such as what was the dollar amount of a 
> late transaction in one of my accounts, what my phone code is that I 
> use for phoning the bank, what one of my account number is, if a 
> particular account is joint or single and what my credit limit is in a 
> particular account, or how many accounts I have and how many accounts 
> are credit accounts and how many are debit accounts.
<snip>

But those "security questions" are usually worthless.

For example, they ask things like your mother's maiden name, which is 
easily found out from birth records once the hacker has your name, date 
of birth, and where you were born from you entering it into something 
like a fictitious survey or competition entry form.

[toc] | [prev] | [next] | [standalone]

#6798

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-15 19:09 -0800
Message-ID	<2018111519094870922-tomevans9890@yahoo.ca>
In reply to	#6796

On 2018-11-16 01:26:04 +0000, Your Name said:

> On 2018-11-15 20:33:51 +0000, Tom Evans said:
>> On 2018-11-08 22:10:58 +0000, nospam said:
>>> In article <2018110813514766717-tomevans9890@yahoo.ca>, Tom Evans
>>> <tomevans9890@yahoo.ca> wrote:
>>>> 
>>>> The reason I asked if Keychain is safe is because a robber tried
>>>> (unsuccessfully) to steal $1,700 from one of my credit cards by calling
>>>> my bank and impersonating me yesterday.  The bank employee I spoke with
>>>> after the bank alerted me said that the thief knew my security
>>>> questions that were asked of him.
>>> 
>>> likely because you gave real answers to the insecurity questions.
>>> 
>>> most of those are public information, such as what was your first car,
>>> or can be easily determined with a bit of digging, such as what street
>>> you grew up on or who was your 1st grade teacher.
>> 
>> That's false.
>> 
>> My bank and credit card information is not publicly available.  When 
>> customers call VISA or my bank regarding my account, the employee asks 
>> security screening questions such as what was the dollar amount of a 
>> late transaction in one of my accounts, what my phone code is that I 
>> use for phoning the bank, what one of my account number is, if a 
>> particular account is joint or single and what my credit limit is in a 
>> particular account, or how many accounts I have and how many accounts 
>> are credit accounts and how many are debit accounts.
> <snip>
> 
> But those "security questions" are usually worthless.
> 
> For example, they ask things like your mother's maiden name, which is 
> easily found out from birth records once the hacker has your name, date 
> of birth, and where you were born from you entering it into something 
> like a fictitious survey or competition entry form.

No; VISA and my bank are not so stupid.  As I already explained, they 
DO NOT ask any such questions that could be found by criminals 
searching public records.

As I already explained, when customers call VISA or my bank regarding 
my account, the employee asks security screening questions such as what 
was the dollar amount of a late transaction in one of my accounts, what 
my phone code is that I use for phoning the bank, what one of my 
account number is, if a particular account is joint or single and what 
my credit limit is in a particular account, or how many accounts I have 
and how many accounts are credit accounts and how many are debit 
accounts.

Tom

[toc] | [prev] | [next] | [standalone]

#6818

From	Your Name <YourName@YourISP.com>
Date	2018-11-17 14:21 +1300
Message-ID	<psnqe8$2bj$1@gioia.aioe.org>
In reply to	#6798

On 2018-11-16 03:09:48 +0000, Tom Evans said:
> On 2018-11-16 01:26:04 +0000, Your Name said:
>> On 2018-11-15 20:33:51 +0000, Tom Evans said:
>>> On 2018-11-08 22:10:58 +0000, nospam said:
>>>> In article <2018110813514766717-tomevans9890@yahoo.ca>, Tom Evans
>>>> <tomevans9890@yahoo.ca> wrote:
>>>>> 
>>>>> The reason I asked if Keychain is safe is because a robber tried
>>>>> (unsuccessfully) to steal $1,700 from one of my credit cards by calling
>>>>> my bank and impersonating me yesterday.  The bank employee I spoke with
>>>>> after the bank alerted me said that the thief knew my security
>>>>> questions that were asked of him.
>>>> 
>>>> likely because you gave real answers to the insecurity questions.
>>>> 
>>>> most of those are public information, such as what was your first car,
>>>> or can be easily determined with a bit of digging, such as what street
>>>> you grew up on or who was your 1st grade teacher.
>>> 
>>> That's false.
>>> 
>>> My bank and credit card information is not publicly available.  When 
>>> customers call VISA or my bank regarding my account, the employee asks 
>>> security screening questions such as what was the dollar amount of a 
>>> late transaction in one of my accounts, what my phone code is that I 
>>> use for phoning the bank, what one of my account number is, if a 
>>> particular account is joint or single and what my credit limit is in a 
>>> particular account, or how many accounts I have and how many accounts 
>>> are credit accounts and how many are debit accounts.
>> <snip>
>> 
>> But those "security questions" are usually worthless.
>> 
>> For example, they ask things like your mother's maiden name, which is 
>> easily found out from birth records once the hacker has your name, date 
>> of birth, and where you were born from you entering it into something 
>> like a fictitious survey or competition entry form.
> 
> No; VISA and my bank are not so stupid.  As I already explained, they 
> DO NOT ask any such questions that could be found by criminals 
> searching public records.
> 
> As I already explained, when customers call VISA or my bank regarding 
> my account, the employee asks security screening questions such as what 
> was the dollar amount of a late transaction in one of my accounts, what 
> my phone code is that I use for phoning the bank, what one of my 
> account number is, if a particular account is joint or single and what 
> my credit limit is in a particular account, or how many accounts I have 
> and how many accounts are credit accounts and how many are debit 
> accounts.

Those are potentially even worse than the standard bank "security" 
questions. Anyone who already has your online banking password could 
easily just look up such answers.

At least with the "mother's maiden name" type of questions the scammer 
has to put a bit more effort into finding the answers.

[toc] | [prev] | [next] | [standalone]

#6819

From	Chris Ridd <chrisridd@mac.com>
Date	2018-11-17 07:40 +0000
Message-ID	<psogl5$4p1$1@dont-email.me>
In reply to	#6818

On 17/11/2018 01:21, Your Name wrote:
> At least with the "mother's maiden name" type of questions the scammer 
> has to put a bit more effort into finding the answers.

Of course they're assuming that you set up those security questions with 
correct answers?

Naturally you know these fields are effectively passwords so they should 
a) not be the real answers and b) ideally more long random strings of 
characters.

-- 
Chris

[toc] | [prev] | [next] | [standalone]

#6820

From	Your Name <YourName@YourISP.com>
Date	2018-11-18 09:53 +1300
Message-ID	<pspv46$1a8q$1@gioia.aioe.org>
In reply to	#6819

On 2018-11-17 07:40:20 +0000, Chris Ridd said:
> On 17/11/2018 01:21, Your Name wrote:
>> 
>> At least with the "mother's maiden name" type of questions the scammer 
>> has to put a bit more effort into finding the answers.
> 
> Of course they're assuming that you set up those security questions 
> with correct answers?
> 
> Naturally you know these fields are effectively passwords so they 
> should a) not be the real answers and b) ideally more long random 
> strings of characters.

The teller at your local bank branch is probably not going to accept 
"b_nh^fg#3s" as your mother's maiden name, if only because it's 
impossible to pronounce.

In some cases (not necessarily banks) you have to have your birth 
certificate, which would prove your not giving them real information, 
which could then invalidate your entire account - when signing up for 
some sort of insurance for example.

[toc] | [prev] | [next] | [standalone]

#6821

From	Chris Ridd <chrisridd@mac.com>
Date	2018-11-18 09:19 +0000
Message-ID	<psrarm$k1d$1@dont-email.me>
In reply to	#6820

On 17/11/2018 20:53, Your Name wrote:
> On 2018-11-17 07:40:20 +0000, Chris Ridd said:
>> On 17/11/2018 01:21, Your Name wrote:
>>>
>>> At least with the "mother's maiden name" type of questions the 
>>> scammer has to put a bit more effort into finding the answers.
>>
>> Of course they're assuming that you set up those security questions 
>> with correct answers?
>>
>> Naturally you know these fields are effectively passwords so they 
>> should a) not be the real answers and b) ideally more long random 
>> strings of characters.
> 
> The teller at your local bank branch is probably not going to accept 
> "b_nh^fg#3s" as your mother's maiden name, if only because it's 
> impossible to pronounce.

We're talking about online accounts here. I've had to relay one of my 
random answers over the phone in the past. The banks here are busy 
shutting down as many physical branches as they can.

> In some cases (not necessarily banks) you have to have your birth 
> certificate, which would prove your not giving them real information, 
> which could then invalidate your entire account - when signing up for 
> some sort of insurance for example.

Indeed, I am assuming that the online security questions (name of your 
first cat's mother) are not something the online account part of the 
bank needs me to prove. It is just a piece of text, and it does not have 
to be truthful. You can usually tell the difference in the way they ask you.

-- 
Chris

[toc] | [prev] | [next] | [standalone]

#6822

From	nospam <nospam@nospam.invalid>
Date	2018-11-18 10:09 -0500
Message-ID	<181120181009318674%nospam@nospam.invalid>
In reply to	#6821

In article <psrarm$k1d$1@dont-email.me>, Chris Ridd <chrisridd@mac.com>
wrote:

> > The teller at your local bank branch is probably not going to accept 
> > "b_nh^fg#3s" as your mother's maiden name, if only because it's 
> > impossible to pronounce.
> 
> We're talking about online accounts here. I've had to relay one of my 
> random answers over the phone in the past. The banks here are busy 
> shutting down as many physical branches as they can.

not all of them.

<https://www.washingtonpost.com/lifestyle/style/chase-to-open-hundreds-o
f-offices-in-us-even-as-rivals-abandon-bank-branches/2018/04/22/002e7318-
441d-11e8-8569-26fda6b404c7_story.html>
  The move is part of a broader national strategy for JPMorgan Chase.
  It plans to enter 15 to 20 new regional markets around the United
  States by 2023, adding 400 branches to the 5,130 it has across the
  country.

> > In some cases (not necessarily banks) you have to have your birth 
> > certificate, which would prove your not giving them real information, 
> > which could then invalidate your entire account - when signing up for 
> > some sort of insurance for example.
> 
> Indeed, I am assuming that the online security questions (name of your 
> first cat's mother) are not something the online account part of the 
> bank needs me to prove. It is just a piece of text, and it does not have 
> to be truthful. You can usually tell the difference in the way they ask you.

it never has to be truthful (nor should it ever be since it's usually
public information), but in some cases, it's multiple choice, which
greatly narrows down the possibilities.

[toc] | [prev] | [next] | [standalone]

#6823

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-18 12:59 -0800
Message-ID	<2018111812593325242-tomevans9890@yahoo.ca>
In reply to	#6820

On 2018-11-17 20:53:28 +0000, Your Name said:

> On 2018-11-17 07:40:20 +0000, Chris Ridd said:
>> On 17/11/2018 01:21, Your Name wrote:
>>> 
>>> At least with the "mother's maiden name" type of questions the scammer 
>>> has to put a bit more effort into finding the answers.
>> 
>> Of course they're assuming that you set up those security questions 
>> with correct answers?
>> 
>> Naturally you know these fields are effectively passwords so they 
>> should a) not be the real answers and b) ideally more long random 
>> strings of characters.
> 
> The teller at your local bank branch is probably not going to accept 
> "b_nh^fg#3s" as your mother's maiden name, if only because it's 
> impossible to pronounce.

Neither the phone agents nor tellers of my bank have asked me my 
mother's maiden name as a security question, because that anme might be 
in a public record.

Tom

[toc] | [prev] | [next] | [standalone]

#6824

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-18 13:03 -0800
Message-ID	<2018111813033750700-tomevans9890@yahoo.ca>
In reply to	#6818

On 2018-11-17 01:21:15 +0000, Your Name said:

> On 2018-11-16 03:09:48 +0000, Tom Evans said:
>> On 2018-11-16 01:26:04 +0000, Your Name said:
>>> On 2018-11-15 20:33:51 +0000, Tom Evans said:
>>>> On 2018-11-08 22:10:58 +0000, nospam said:
>>>>> In article <2018110813514766717-tomevans9890@yahoo.ca>, Tom Evans
>>>>> <tomevans9890@yahoo.ca> wrote:
>>>>>> 
>>>>>> The reason I asked if Keychain is safe is because a robber tried
>>>>>> (unsuccessfully) to steal $1,700 from one of my credit cards by calling
>>>>>> my bank and impersonating me yesterday.  The bank employee I spoke with
>>>>>> after the bank alerted me said that the thief knew my security
>>>>>> questions that were asked of him.
>>>>> 
>>>>> likely because you gave real answers to the insecurity questions.
>>>>> 
>>>>> most of those are public information, such as what was your first car,
>>>>> or can be easily determined with a bit of digging, such as what street
>>>>> you grew up on or who was your 1st grade teacher.
>>>> 
>>>> That's false.
>>>> 
>>>> My bank and credit card information is not publicly available.  When 
>>>> customers call VISA or my bank regarding my account, the employee asks 
>>>> security screening questions such as what was the dollar amount of a 
>>>> late transaction in one of my accounts, what my phone code is that I 
>>>> use for phoning the bank, what one of my account number is, if a 
>>>> particular account is joint or single and what my credit limit is in a 
>>>> particular account, or how many accounts I have and how many accounts 
>>>> are credit accounts and how many are debit accounts.
>>> <snip>
>>> 
>>> But those "security questions" are usually worthless.
>>> 
>>> For example, they ask things like your mother's maiden name, which is 
>>> easily found out from birth records once the hacker has your name, date 
>>> of birth, and where you were born from you entering it into something 
>>> like a fictitious survey or competition entry form.
>> 
>> No; VISA and my bank are not so stupid.  As I already explained, they 
>> DO NOT ask any such questions that could be found by criminals 
>> searching public records.
>> 
>> As I already explained, when customers call VISA or my bank regarding 
>> my account, the employee asks security screening questions such as what 
>> was the dollar amount of a late transaction in one of my accounts, what 
>> my phone code is that I use for phoning the bank, what one of my 
>> account number is, if a particular account is joint or single and what 
>> my credit limit is in a particular account, or how many accounts I have 
>> and how many accounts are credit accounts and how many are debit 
>> accounts.
> 
> Those are potentially even worse than the standard bank "security" 
> questions. Anyone who already has your online banking password could 
> easily just look up such answers.

How could a hacker of my Mac find my banking passcode via 'phishing', 
given the fact that I didn't type sensitive information into any 
hyperlinks in emails I received?

Tony

> At least with the "mother's maiden name" type of questions the scammer 
> has to put a bit more effort into finding the answers.

[toc] | [prev] | [next] | [standalone]

#6825

From	nospam <nospam@nospam.invalid>
Date	2018-11-18 16:11 -0500
Message-ID	<181120181611110753%nospam@nospam.invalid>
In reply to	#6824

In article <2018111813033750700-tomevans9890@yahoo.ca>, Tom Evans
<tomevans9890@yahoo.ca> wrote:

> How could a hacker of my Mac find my banking passcode via 'phishing', 
> given the fact that I didn't type sensitive information into any 
> hyperlinks in emails I received?

by reading the unencrypted file you keep it in

[toc] | [prev] | [next] | [standalone]

#6832

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-18 14:46 -0800
Message-ID	<2018111814462788194-tomevans9890@yahoo.ca>
In reply to	#6825

On 2018-11-18 21:11:11 +0000, nospam said:

> In article <2018111813033750700-tomevans9890@yahoo.ca>, Tom Evans
> <tomevans9890@yahoo.ca> wrote:
> 
>> How could a hacker of my Mac find my banking passcode via 'phishing',
>> given the fact that I didn't type sensitive information into any
>> hyperlinks in emails I received?
> 
> by reading the unencrypted file you keep it in

How could a hacker read the unencrypted file via 'phishing', given the 
fact that I in addition to the above haven't entered Web competitions, 
or given out my bank information by phone to fake fraudulent callers 
posing as people working for companies I deal with such as my phone or 
TV service providers, and I haven't given information to robo-callers 
calling me to allegedly try to get me to sign up for lowering my 
interest rates or sign up for credit cards?

Tom

[toc] | [prev] | [next] | [standalone]

#6833

From	Your Name <YourName@YourISP.com>
Date	2018-11-19 14:20 +1300
Message-ID	<pst34i$4e6$1@gioia.aioe.org>
In reply to	#6832

On 2018-11-18 22:46:27 +0000, Tom Evans said:
> On 2018-11-18 21:11:11 +0000, nospam said:
>> In article <2018111813033750700-tomevans9890@yahoo.ca>, Tom Evans
>> <tomevans9890@yahoo.ca> wrote:
>>> 
>>> How could a hacker of my Mac find my banking passcode via 'phishing',
>>> given the fact that I didn't type sensitive information into any
>>> hyperlinks in emails I received?
>> 
>> by reading the unencrypted file you keep it in
> 
> How could a hacker read the unencrypted file via 'phishing', given the 
> fact that I in addition to the above haven't entered Web competitions, 
> or given out my bank information by phone to fake fraudulent callers 
> posing as people working for companies I deal with such as my phone or 
> TV service providers, and I haven't given information to robo-callers 
> calling me to allegedly try to get me to sign up for lowering my 
> interest rates or sign up for credit cards?

Those were simply a few potential examples. The possibilities are 
pretty much endless, including ones that are nothing to do with your 
computer such as your email account, Amazon account, Farcebook account, 
etc. being hacked at the server end (it has happend to Yahoo accounts 
at least a few times), but someone "hacking" the files on your Mac is 
pretty much the bottom of the list.

You'll never ever know exactly how it happened. The best thing to do is 
to change all your passwords.

[toc] | [prev] | [next] | [standalone]

#6860

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-12-08 22:29 -0800
Message-ID	<2018120822290083830-tomevans9890@yahoo.ca>
In reply to	#6833

On 2018-11-19 01:20:21 +0000, Your Name said:

> On 2018-11-18 22:46:27 +0000, Tom Evans said:
>> On 2018-11-18 21:11:11 +0000, nospam said:
>>> In article <2018111813033750700-tomevans9890@yahoo.ca>, Tom Evans
>>> <tomevans9890@yahoo.ca> wrote:
>>>> 
>>>> How could a hacker of my Mac find my banking passcode via 'phishing',
>>>> given the fact that I didn't type sensitive information into any
>>>> hyperlinks in emails I received?
>>> 
>>> by reading the unencrypted file you keep it in
>> 
>> How could a hacker read the unencrypted file via 'phishing', given the 
>> fact that I in addition to the above haven't entered Web competitions, 
>> or given out my bank information by phone to fake fraudulent callers 
>> posing as people working for companies I deal with such as my phone or 
>> TV service providers, and I haven't given information to robo-callers 
>> calling me to allegedly try to get me to sign up for lowering my 
>> interest rates or sign up for credit cards?
> 
> Those were simply a few potential examples. The possibilities are 
> pretty much endless, including ones that are nothing to do with your 
> computer such as your email account, Amazon account, Farcebook account, 
> etc. being hacked at the server end (it has happend to Yahoo accounts 
> at least a few times), but someone "hacking" the files on your Mac is 
> pretty much the bottom of the list.
> 
> You'll never ever know exactly how it happened. The best thing to do is 
> to change all your passwords.

So I should log in and out out of my Outlook email every time I use it, 
typing in my user name and passcode every time I log in?

I access Outlook about 15 times every day.

Tom Evans

[toc] | [prev] | [next] | [standalone]

#6861

From	Your Name <YourName@YourISP.com>
Date	2018-12-09 19:40 +1300
Message-ID	<puiddb$4bg$1@gioia.aioe.org>
In reply to	#6860

On 2018-12-09 06:29:00 +0000, Tom Evans said:
> On 2018-11-19 01:20:21 +0000, Your Name said:
>> On 2018-11-18 22:46:27 +0000, Tom Evans said:
>>> On 2018-11-18 21:11:11 +0000, nospam said:
>>>> In article <2018111813033750700-tomevans9890@yahoo.ca>, Tom Evans
>>>> <tomevans9890@yahoo.ca> wrote:
>>>>> 
>>>>> How could a hacker of my Mac find my banking passcode via 'phishing',
>>>>> given the fact that I didn't type sensitive information into any
>>>>> hyperlinks in emails I received?
>>>> 
>>>> by reading the unencrypted file you keep it in
>>> 
>>> How could a hacker read the unencrypted file via 'phishing', given the 
>>> fact that I in addition to the above haven't entered Web competitions, 
>>> or given out my bank information by phone to fake fraudulent callers 
>>> posing as people working for companies I deal with such as my phone or 
>>> TV service providers, and I haven't given information to robo-callers 
>>> calling me to allegedly try to get me to sign up for lowering my 
>>> interest rates or sign up for credit cards?
>> 
>> Those were simply a few potential examples. The possibilities are 
>> pretty much endless, including ones that are nothing to do with your 
>> computer such as your email account, Amazon account, Farcebook account, 
>> etc. being hacked at the server end (it has happend to Yahoo accounts 
>> at least a few times), but someone "hacking" the files on your Mac is 
>> pretty much the bottom of the list.
>> 
>> You'll never ever know exactly how it happened. The best thing to do is 
>> to change all your passwords.
> 
> So I should log in and out out of my Outlook email every time I use it, 
> typing in my user name and passcode every time I log in?
> 
> I access Outlook about 15 times every day.

There's no need to do that on your own Mac ... unless it's a laptop and 
you stupidly tend to leave it unattended in a public place without it 
set ot go to sleep with the user required to re-log-in.

[toc] | [prev] | [next] | [standalone]

#6835

From	nospam <nospam@nospam.invalid>
Date	2018-11-18 20:28 -0500
Message-ID	<181120182028347333%nospam@nospam.invalid>
In reply to	#6832

In article <2018111814462788194-tomevans9890@yahoo.ca>, Tom Evans
<tomevans9890@yahoo.ca> wrote:

> >> How could a hacker of my Mac find my banking passcode via 'phishing',
> >> given the fact that I didn't type sensitive information into any
> >> hyperlinks in emails I received?
> > 
> > by reading the unencrypted file you keep it in
> 
> How could a hacker read the unencrypted file via 'phishing', given the 
> fact that I in addition to the above haven't entered Web competitions, 
> or given out my bank information by phone to fake fraudulent callers 
> posing as people working for companies I deal with such as my phone or 
> TV service providers, and I haven't given information to robo-callers 
> calling me to allegedly try to get me to sign up for lowering my 
> interest rates or sign up for credit cards?

if they have access to your computer, they can do whatever they want
with whatever unencrypted files they can find. 

the chances may be low, but it's not zero.

[toc] | [prev] | [next] | [standalone]

#6859

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-12-08 22:26 -0800
Message-ID	<2018120822262346227-tomevans9890@yahoo.ca>
In reply to	#6835

On 2018-11-19 01:28:34 +0000, nospam said:

> In article <2018111814462788194-tomevans9890@yahoo.ca>, Tom Evans
> <tomevans9890@yahoo.ca> wrote:
> 
>>>> How could a hacker of my Mac find my banking passcode via 'phishing',
>>>> given the fact that I didn't type sensitive information into any
>>>> hyperlinks in emails I received?
>>> 
>>> by reading the unencrypted file you keep it in
>> 
>> How could a hacker read the unencrypted file via 'phishing', given the
>> fact that I in addition to the above haven't entered Web competitions,
>> or given out my bank information by phone to fake fraudulent callers
>> posing as people working for companies I deal with such as my phone or
>> TV service providers, and I haven't given information to robo-callers
>> calling me to allegedly try to get me to sign up for lowering my
>> interest rates or sign up for credit cards?
> 
> if they have access to your computer, they can do whatever they want
> with whatever unencrypted files they can find.
> 
> the chances may be low, but it's not zero.

I'm the only person who has physical access to my Imac.

Tom Evans

[toc] | [prev] | [next] | [standalone]

#6728

From	Your Name <YourName@YourISP.com>
Date	2018-11-09 15:36 +1300
Message-ID	<ps2rrk$sf$1@gioia.aioe.org>
In reply to	#6725

On 2018-11-08 21:51:47 +0000, Tom Evans said:

> Thanks, Callum.
> 
> The reason I asked if Keychain is safe is because a robber tried 
> (unsuccessfully) to steal $1,700 from one of my credit cards by calling 
> my bank and impersonating me yesterday.  The bank employee I spoke with 
> after the bank alerted me said that the thief knew my security 
> questions that were asked of him.

The bank's "security" questions are often useless crap. Things like 
mother's maiden name, place of birth, etc. Things that any determined 
person could find out in various ways. In many countries you can get 
such details from the Births, Detahs, and Marriages department of the 
government without even needing to show proof of who you are!!



> I thought maybe the thief was able to hack into my Mac and find my bank 
> information there.  (I have my user names and passcodes stored on my 
> Mac, but in a text program and not in Keychain.)

Immensely unlikely. Far more likely would be that you may possibly have 
used a link in a scam email and entered your details yourself on their 
scam website.



> My credit card account online showed that $1,700 was added to my credit 
> card debt yesterday, but a bank employee flagged the transaction as 
> suspicious and the bank then reinstated that money to my account and a 
> bank employee phoned me and left a message in my voice mail, asking me 
> to phone the bank immediately to ask me about this issue.
> 
> The bank deactivated both of my credit cards and both of my debit cards 
> yesterday, so I'm getting replacement cards, but the process is 
> troublesome.  I want to try to figure out how the breach migh have 
> happened, so I can prevent another attack.
> 
> I called Apple and two technicians on the phone said it's safe (from 
> hackers) to store sensitive info on the Mac even in a text program, and 
> that I don't need an anti-virus program.

Yep. You're more likely to win the top prize in every lottery draw for 
a year rather than get malware on a Mac. The exception is if you do 
stupid things like visit porn or pirate software / movie / music sites, 
and especially if you install pirated software

BUT, the weak point is the user ... you do have to careful about things 
like scam emails that may look legit, but take you to faked websites to 
enter your details. Best bet is to never go to your online banking via 
an email link.

[toc] | [prev] | [next] | [standalone]

#6730

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-08 20:00 -0800
Message-ID	<2018110820004159341-tomevans9890@yahoo.ca>
In reply to	#6728

On 2018-11-09 02:36:39 +0000, Your Name said:

> On 2018-11-08 21:51:47 +0000, Tom Evans said:
> 
>> Thanks, Callum.
>> 
>> The reason I asked if Keychain is safe is because a robber tried 
>> (unsuccessfully) to steal $1,700 from one of my credit cards by calling 
>> my bank and impersonating me yesterday.  The bank employee I spoke with 
>> after the bank alerted me said that the thief knew my security 
>> questions that were asked of him.
> 
> The bank's "security" questions are often useless crap. Things like 
> mother's maiden name, place of birth, etc. Things that any determined 
> person could find out in various ways. In many countries you can get 
> such details from the Births, Detahs, and Marriages department of the 
> government without even needing to show proof of who you are!!
> 
> 
> 
>> I thought maybe the thief was able to hack into my Mac and find my bank 
>> information there.  (I have my user names and passcodes stored on my 
>> Mac, but in a text program and not in Keychain.)
> 
> Immensely unlikely. Far more likely would be that you may possibly have 
> used a link in a scam email and entered your details yourself on their 
> scam website.
> 
> 
> 
>> My credit card account online showed that $1,700 was added to my credit 
>> card debt yesterday, but a bank employee flagged the transaction as 
>> suspicious and the bank then reinstated that money to my account and a 
>> bank employee phoned me and left a message in my voice mail, asking me 
>> to phone the bank immediately to ask me about this issue.
>> 
>> The bank deactivated both of my credit cards and both of my debit cards 
>> yesterday, so I'm getting replacement cards, but the process is 
>> troublesome.  I want to try to figure out how the breach migh have 
>> happened, so I can prevent another attack.
>> 
>> I called Apple and two technicians on the phone said it's safe (from 
>> hackers) to store sensitive info on the Mac even in a text program, and 
>> that I don't need an anti-virus program.
> 
> Yep. You're more likely to win the top prize in every lottery draw for 
> a year rather than get malware on a Mac. The exception is if you do 
> stupid things like visit porn or pirate software / movie / music sites, 
> and especially if you install pirated software

I have looked at some sites that show short, free movies.

> BUT, the weak point is the user ... you do have to careful about things 
> like scam emails that may look legit, but take you to faked websites to 
> enter your details. Best bet is to never go to your online banking via 
> an email link.

I may have recently pressed the "Unsubscribe" button recently on an 
email from what I thought was from my bank.  (I can't remember if I did 
that.)  After that, on the resultig page (if I clicked on the link), 
the most data that I might have entered was my email address to try to 
unsubscribe.

How can I determine if I have malware?

Tom

[toc] | [prev] | [next] | [standalone]

Page 6 of 7 — ← Prev page 1 2 3 4 5 [6] 7 Next page →

csiph-web

Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

Contents

#6808

#6811

#6796

#6798

#6818

#6819

#6820

#6821

#6822

#6823

#6824

#6825

#6832

#6833

#6860

#6861

#6835

#6859

#6728

#6730