Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

From	Tom Evans <tomevans9890@yahoo.ca>
Newsgroups	comp.sys.mac.misc
Date	2018-11-16 08:07 -0800
Message-ID	<2018111608075639149-tomevans9890@yahoo.ca> (permalink)
References	(7 earlier) <psgcdd$1ujq$1@gioia.aioe.org> <2018111513244194158-tomevans9890@yahoo.ca> <psl65o$1sh4$1@gioia.aioe.org> <2018111519144913678-tomevans9890@yahoo.ca> <psll9r$flq$1@gioia.aioe.org>
Subject	Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?
Show all headers | View raw
On 2018-11-16 05:41:15 +0000, Your Name said:

> On 2018-11-16 03:14:49 +0000, Tom Evans said:
>> On 2018-11-16 01:23:06 +0000, Your Name said:
>>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>>> 
>>>>>>> the chances that someone hacked your mac is low, unless you clicked a
>>>>>>> phishing link, in which case, anything goes.
>>>>>>> 
>>>>>>> from your description of the unsubscribe link, it *probably* was not a
>>>>>>> phish, but that's impossible to know without examining the link.
>>>>>> 
>>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>>> steal money from my credit card, or is there only one attack for each 
>>>>>> click on the wrong email link in my email inbox?
>>>>> 
>>>>> Phishing relies on you entering details into a faked version of a real website.
>>>>> 
>>>>> For example, you click the link in an email that is *supposedly* from 
>>>>> your bank telling you you need to log into your account. That link 
>>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>>> and password which teh website then stores for the hacker scumbags, and 
>>>>> then it tells you the password is wrong and sends you to the real 
>>>>> banking login page, where you login in as normal. You assume you made a 
>>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>>> banking user ID and password they can use whenever they want.
>>>>> 
>>>>> Because many people re-use passwords for various websites, obtaining 
>>>>> your password may let the hacker scumbag get into those different 
>>>>> websites, not necessarily connected to the original phishing email.
>>>>> 
>>>>> Once you change your password, then the information the hacker scumbag 
>>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>>> the hacker scumbag can still get into your account.
>>>> 
>>>> Thanks, Your.
>>>> 
>>>> Which account are you referring to, that I should change my passcode for?
>>> 
>>> Whichever one you think was supposedly hacked, but since you don't 
>>> know, you'll have to change them all ... or at least all the ones that 
>>> have any connection to the bank account or to other internet accounts 
>>> that have connection to that bank account.
>> 
>> Do you mean my computer account or my bank accnounts?  You still 
>> haven't specified that.
> 
> Because there's no way I can know. There's no way you can know either, 
> nor can you know if it was or wasn't anything to do with the computer 
> at all. At the very least you should change the passwords for your bank 
> account and your email account.
> 
> 
> 
>>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>>> you the link the email will be going to. The first part (before the 
>>>>> firts slash character) of a real one will end with something like 
>>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>>> going to somewhere-else.com, not MyBank.com.
>>>>> 
>>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>>> manually go to the bank's real website to login as normal.
>>>> 
>>>> I didn't do that.  I did recently get an email that I thought was from 
>>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>>> didn't try to log into my bank account by pressing on the link in the 
>>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>>> that appeared after I pressed a link in the email.
> 
> There's no point in unsubscribing from fake emails. If it is a scumbag, 
> then you won't get unsubscribed and you'll simply be telling them that 
> someone is opening the emails.

That's not the point.  The point is that people keep telling me the 
danger is from clicking a link in emails and then typing passcodes and 
account numbers on the resulting pages.  I keep repeating that I didn't 
do that.  But then you change your position, stating that pressing on 
an "Unsubscribe" button on a Web site is just as dangerous.

Tom


>>>>> There are other ways nasty people can get your information. You might 
>>>>> get an email / see a web-advert for a competition with an amazing prize 
>>>>> ... unless it's a well known organisation running the competition, stay 
>>>>> well clear because it may be a case of "too good to be true" and is 
>>>>> simply using the 'competition' entry form to get your name, address, 
>>>>> phone number, etc. Once they have those, it can be relatively easy to 
>>>>> obtain other details.
>>>> 
>>>> I also didn't do that.
>>> 
>>> You'd be surprised where and how often people enter their details 
>>> without even a second thought.
>> 
>> I DO -- and I DID -- give it a second thought, and I DID NOT enter any 
>> such competitons recently or earlier.
> 
> Competitions was only one example of a potential cause. Phishing 
> emails, weird software update requests (with you entering the admin 
> password to install it), strange phones calls from fake "help desk" 
> staff saying they know something is wrong with your computer, etc., 
> etc. ... there's a ton of options and that's even assuming that your 
> computer was actually hacked, which is highly unlikely,
Thread

csiph-web