Digital Personal Security

[duncs500]

I feel certain that someone on here will be a pro at this, so advice most welcome! A number of friends and colleagues have been hacked recently, I sense that the number of people able to do this is growing rapidly thanks to AI. One colleague they managed to hack his email, from there get into his phone company, clone his phone and hence defeat 2- factor authentication and enter his banking apps and all sorts.

I have been very bad with my online security, and frankly it's a miracle I haven't been robbed already. So I think it's time to take action.

So, what do I do? I believe there's like these password security apps that you should use to manage all your passwords. Set up two factor authentication on everything? Use authenticator apps?

The only thing is, it can be a fucker if you lose (or don't have your phone), my missus recently took my phone to work by accident. I was thinking "it's fine, I'd like to cut down on my SM anyway, I'll just do without it until she comes back in the evening". Then I realised that I could be shut out of all my work accounts because they randomly ask me to re-authenticate. They didn't thankfully, but I would prefer not to feel to wedded to my phone, probably not possible for this.

TL;DR? Cyber security, what do you do?

[dinny_g]

(Me too to ALL of that ... )

[mik]

Digital personal security.

You either have it.

Or you don’t.

[Mito Man]

Remember to always don your digital condom.

[duncs500]

Remember to always don your digital condom.

AI has certainly provided plenty of digital lube.

[Matty]

I'm always incredibly suspicious about people that claim to have been hacked....no offence to your friends Duncs but 99% of the time it's either:
1. Terrible passwords
2. They've not MFA'd something
3. They've been phished and or/socially engineered

Alas, most people don't admit to it, so usually claimed to have been hacked by some incredible process. I'm not saying it doesn't happen, but for them do it despite the above requires a lot of work.

Usual process
1. Secure passwords. Three words, add a number symbol if feeling fancy.
2. Password managers help, but make sure the account for that is also secure! (I heard you need a password for your password, etc)
2. MFA the shit out of everything - not via SMS.
3. Never click on email links, respond to calls or texts claiming to be from any company. Always get the proper details and call/email them direct.

Also if you've got a bunch of MFA codes on your phone, make sure the app prompts for authentication each time it opens. Also make sure it's backed up!

If you follow the basics, its very, very difficult for people to get access to your accounts.

[dinny_g]

Whats a good go to Password Manager app that can be trusted ??

[Gavster]

I’m not a pro but do exactly what Matty says for everything. I also go a step further and have a separate email and phone number for my social media accounts, so none of them are registered to details that could be identified online or via a hacked website (unless it was Meta, TikTok or YouTube that was hacked)

[Gavster]

It's worth getting a good password manager, I've got over 1,000 unique passwords for every different login I've created over the last 10 years. That means if one site gets hacked, it never compromises my logins on any other website. That in itself is half the battle. When combined with MFA, you're very well set.

If, however, you've used the same password for every login over the last 10 years, then you have a huge amount of tidying up to do

[dinny_g]

I'd say I've far fewer than that - probably less than 100 in truth.

There are about 10 or 12 critical ones - Banking, Insurance, Pensions etc that have individual, varied passwords that change regularly following a pattern which is easy for me to remember but generates random complex 12 to 15 character passwords.

The remainder typically use about 4 or 5 standard passwords so yeah, I do have a bit of work to do. I know this isn't what we should do but in truth, would I be that concerned if someone hacked, say, my OV9 account - You'd all know it wasn't me anyway when they didn't make mistakes in posts...

As sad as this is to admit, this is part of a a lot of work I'm doing at the moment to create "handover data" so that my partner or son could access things in the event of... well you know... It just seems sensible given my age...

[jamcg]

Use passkeys where it’s offered, so it looks for your Face ID on your phone instead of needing a password, as it can’t be intercepted

Don’t use the same password for multiple things

Don’t give out codes to anyone no matter how much they ask

If it feels weird it might well be

Thing I always get arsey with is when companies ring you like virgin media etc and ask for you to confirm your details, I always ask you called me so how can I confirm your details

[dinny_g]

I'm tin foil hat about that and will only call back, to a number I find directly online, from a different phone.

A mate got done by the Revolut scam and his business lost £12k

https://www.malwarebytes.com/blog/news/ ... o-the-bank

[IanF]

If you’re in the Apple world, just open the passwords app, which uses FaceID, and look at the security tab for passwords that are duplicated or been accessed ina data breach somewhere. It gives you a change password which opens up the site in question and then you can change to a random one and/or passkey

[Matty]

For password managers, I've got a couple but none of them store any critical passwords like banking, or my core email accounts.

Splitting email accounts like Gav does is a good idea too, although adds an additional layer of complexity/management.

I'm tin foil hat about that and will only call back, to a number I find directly online, from a different phone.

A mate got done by the Revolut scam and his business lost £12k

https://www.malwarebytes.com/blog/news/ ... o-the-bank

That's not tin foil hat at all, it's exactly what you should do.

[Gavster]

I’m a little extreme by splitting email accounts and it is only because I’m targeted on a daily basis by phishing scams trying to access my social media accounts because they have obvious value for scammers to either sell or hold me to ransom for.

[duncs500]

I'm always incredibly suspicious about people that claim to have been hacked....no offence to your friends Duncs but 99% of the time it's either:
1. Terrible passwords
2. They've not MFA'd something
3. They've been phished and or/socially engineered

To be fair I don't think they denied failing to do those things, I think it was the cloning of the phone and getting into banking apps that alarmed me the most, of course the weakness must have been that the email (I imagine the easiest hack) opened up everything and allowed them to bypass the all the other controls.

[mik]

I think it was the cloning of the phone and getting into banking apps that alarmed me

That sounds like it's related to the recent scam where someone phones to tell you that your SIM is expiring and they need to send you a new one?

I don't know all the details (I did receive a call however, and my mum also received a similar call). They confirm your email address as part of their identity checks, but they are putting that information into your phone providers website. They trigger a one-time-passcode whilst trying to log in, and tell you that they've just sent a one-time-passcode to your as the 2nd layer of their identity verification - please confirm the number you have just received. You tell them that - they say "that's correct" thank you - but actually they've just used that to get into your account, and subsequently order themselves a new handset or whatever yada yada

[Jobbo]

If you’re in the Apple world, just open the passwords app, which uses FaceID, and look at the security tab for passwords that are duplicated or been accessed ina data breach somewhere. It gives you a change password which opens up the site in question and then you can change to a random one and/or passkey

I keep getting reminders to do this - I've done it, the sites themselves are now defunct and I can't change my password or even access the site so it's not an issue. Other than the reminders continuing to pop up.

[duncs500]

I wonder whether it's best to get an extra device other than your phone/email also set up for recovery

I dropped my phone in an uber in Portugal once and then you realise that you can't do much of anything in terms of logging in and finding a way to contact the driver without your phone and you can only access your recovery accounts with your phone.

[IanF]

If you’re in the Apple world, just open the passwords app, which uses FaceID, and look at the security tab for passwords that are duplicated or been accessed ina data breach somewhere. It gives you a change password which opens up the site in question and then you can change to a random one and/or passkey

I keep getting reminders to do this - I've done it, the sites themselves are now defunct and I can't change my password or even access the site so it's not an issue. Other than the reminders continuing to pop up.

If it’s for particular sites, just swipe left and delete the stored info? Or am I misunderstanding your post?