Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

From	Your Name <YourName@YourISP.com>
Newsgroups	comp.sys.mac.misc
Subject	Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?
Date	2018-11-19 14:30 +1300
Organization	Aioe.org NNTP Server
Message-ID	<pst3n7$531$1@gioia.aioe.org> (permalink)
References	<2018111210444077200-tomevans9890@yahoo.ca> <2018111813332388718-tomevans9890@yahoo.ca>
Show all headers | View raw
On 2018-11-18 21:33:23 +0000, Tom Evans said:
> On 2018-11-16 20:43:30 +0000, Your Name said:
>> On 2018-11-16 16:07:56 +0000, Tom Evans said:
>>> On 2018-11-16 05:41:15 +0000, Your Name said:
>>>> On 2018-11-16 03:14:49 +0000, Tom Evans said:
>>>>> On 2018-11-16 01:23:06 +0000, Your Name said:
>>>>>> On 2018-11-15 21:24:41 +0000, Tom Evans said:
>>>>>>> On 2018-11-14 05:38:54 +0000, Your Name said:
>>>>>>>> On 2018-11-14 05:19:04 +0000, Tom Evans said:
>>>>>>>>> On 2018-11-09 05:23:05 +0000, nospam said:
>>>>>>>>>> 
>>>>>>>>>> the chances that someone hacked your mac is low, unless you clicked a 
>>>>>>>>>> phishing link, in which case, anything goes.
>>>>>>>>>> 
>>>>>>>>>> from your description of the unsubscribe link, it *probably* was not a 
>>>>>>>>>> phish, but that's impossible to know without examining the link.
>>>>>>>>> 
>>>>>>>>> If it did happen from phishing, and if I don't secure my sensitve data, 
>>>>>>>>> could my Mac be phished again by the same attacker in the same way, to 
>>>>>>>>> steal sensitive bank data that the attacker could again use to try to 
>>>>>>>>> steal money from my credit card, or is there only one attack for each 
>>>>>>>>> click on the wrong email link in my email inbox?
>>>>>>>> 
>>>>>>>> Phishing relies on you entering details into a faked version of a real website.
>>>>>>>> 
>>>>>>>> For example, you click the link in an email that is *supposedly* from 
>>>>>>>> your bank telling you you need to log into your account. That link 
>>>>>>>> takes you to a fake website that looks real, so you enter your user ID 
>>>>>>>> and password which teh website then stores for the hacker scumbags, and 
>>>>>>>> then it tells you the password is wrong and sends you to the real 
>>>>>>>> banking login page, where you login in as normal. You assume you made a 
>>>>>>>> typo and don't worry about it ... but the hacker scumbag now has your 
>>>>>>>> banking user ID and password they can use whenever they want.
>>>>>>>> 
>>>>>>>> Because many people re-use passwords for various websites, obtaining 
>>>>>>>> your password may let the hacker scumbag get into those different 
>>>>>>>> websites, not necessarily connected to the original phishing email.
>>>>>>>> 
>>>>>>>> Once you change your password, then the information the hacker scumbag 
>>>>>>>> has is worthless since it will no longer work. *YOU* *HAVE* *TO* 
>>>>>>>> *CHANGE* *YOUR* *PASSWORD* - as long as the password stays the same, 
>>>>>>>> the hacker scumbag can still get into your account.
>>>>>>> 
>>>>>>> Thanks, Your.
>>>>>>> 
>>>>>>> Which account are you referring to, that I should change my passcode for?
>>>>>> 
>>>>>> Whichever one you think was supposedly hacked, but since you don't 
>>>>>> know, you'll have to change them all ... or at least all the ones that 
>>>>>> have any connection to the bank account or to other internet accounts 
>>>>>> that have connection to that bank account.
>>>>> 
>>>>> Do you mean my computer account or my bank accnounts?  You still 
>>>>> haven't specified that.
>>>> 
>>>> Because there's no way I can know. There's no way you can know either, 
>>>> nor can you know if it was or wasn't anything to do with the computer 
>>>> at all. At the very least you should change the passwords for your bank 
>>>> account and your email account.
> 
> I've changed my bank account passcodes.
> 
> How could my email be a security leak?  I neither send nor receive any 
> sensitive bank information by email -- either via Mail or Outlook.

You don't have to.

If some hacker has gained access to your email account at the server 
end, then they can simply go to the bank's website, claim they've 
forgotten the password to have the remainder / change email sent to 
your email address, which they can then read (and delte before you even 
see it) and can gain access to your account.

Again, that's simply one potential possibility, one that has nothing to 
do with your Mac.




>>>>>>>> You can always tell the phishing link by simply pointing (not clicking) 
>>>>>>>> the mouse cursor at it. Most email apps and webmail systems will show 
>>>>>>>> you the link the email will be going to. The first part (before the 
>>>>>>>> firts slash character) of a real one will end with something like 
>>>>>>>> MyBank.com, while a faked one will be something else - sometimes it may 
>>>>>>>> look real like MyBank.somewhere-else.com, but that is faked and is 
>>>>>>>> going to somewhere-else.com, not MyBank.com.
>>>>>>>> 
>>>>>>>> The easiest way to avoid this is to NEVER click a link in an email 
>>>>>>>> asking you to login for some reason. Instead go to your webbrowser and 
>>>>>>>> manually go to the bank's real website to login as normal.
>>>>>>> 
>>>>>>> I didn't do that.  I did recently get an email that I thought was from 
>>>>>>> my bank, but after this crisis I realized it was a fake email.  But I 
>>>>>>> didn't try to log into my bank account by pressing on the link in the 
>>>>>>> email.  All I did was to press the "Unsubscribe" button on the Web page 
>>>>>>> that appeared after I pressed a link in the email.
>>>> 
>>>> There's no point in unsubscribing from fake emails. If it is a scumbag, 
>>>> then you won't get unsubscribed and you'll simply be telling them that 
>>>> someone is opening the emails.
>>> 
>>> That's not the point.  The point is that people keep telling me the 
>>> danger is from clicking a link in emails and then typing passcodes and 
>>> account numbers on the resulting pages.  I keep repeating that I didn't 
>>> do that.  But then you change your position, stating that pressing on 
>>> an "Unsubscribe" button on a Web site is just as dangerous.
>> 
>> Again: That was simply ONE example way you could have inadvertently 
>> given away your details. There are various other ways, including ones 
>> that have nothing to do with the computer at all. There's no possible 
>> way to know exactly how someone got your bank account details, but the 
>> chances of some hacker getting into your Mac to read a text file stored 
>> on it's drive are basically zero.
> 
> Your assurance sounds reassuring, and a few Apple tech support people 
> whom I consulted about this agree with you, but Jolly and Nospam 
> strongly disagree with you,

Because NoSpam and Jolly Roger are know-nothing morons. They only know 
about what they and there five friends do (and blindly believe everyone 
else on the planet must do / does do the same) ... nothing about what 
goes on in the real world.

Despite all the wild scare-tactic claims, mostly by anti-malware 
sellers and anti-Apple nutters, *nobody* in the real world has ever had 
their Mac infected by malware unless it was their own fault (by 
installing hacked pirate software for example).



> so I still don't know which side to believe, and whether or not I 
> should get a security information program such as Ipasscode to store my 
> sensitive data on to prevent another attack, or if I don't need to do 
> so because text files on Macs are already secure, and because the 
> attack was conducted through a security leak that didn't involve my 
> negligence.
> 
> As with so many other issues, there are two camps with adamant opposite 
> views on this basic issue.
> 
> 
> Also, I still didn't get an answer about whether or not Apple's Notes 
> program (which can be locked with a passcode) would be an advisable 
> place to store my passcodes, user names and similar sensitve 
> information.

You can store them wherever you want - it makes no difference to anything.

You can use a password manager like 1Password or Dashlane, but since 
you plan on printing and exporting that data, it's not going to be any 
more secure than anything else. You may as well just use a plain text 
file or Word / Pages document ... or simply hand-write them into a 
notebook beside the computer or Post-It notes stuck to the edges of the 
display.
Thread

csiph-web