Beware the scam...

[coonmanx]

This just happened to me today. I was over on AudioKarma. Logged out and shut down my computer. Went to work. Came back and could not get into my account. Looked at my email and figured out that someone had gotten into my account and changed both the email and password associated with my account. So I had to make a new account to get back in. At that point I was able to get a hold of a moderator who fixed the problem. First they had to make sure that I was telling the truth and I was really the true owner of that account. Then I was able to get a new password and get back in. After that I got back into my original account and realized what they had done. They had posted up an ad for a Marantz receiver and someone had paid over $1200 for it. I saw the transaction in my messages. The person who was scammed did pay by Paypal so he can get the money back. I immediately contacted him. But I never figured that something like this could happen. I now have new passwords. These scammers have some sophisticated techniques for sure. Glad that I did get it sorted out in the end.

 

[voodooless]

Moral of the story: don’t reuse passwords!

 

[diddley]

and the recovery email adres ended ...@163?

 

[amirm]

We have had a number of account take overs like that here. Luckily there is not much they can abuse other than posting spam. Strong passwords and two factor authentication is necessary to reduce the risk of these things.

And related, put a block on your phone number transfer at your mobile carrier. People have been known to hijack your phone number and then get into your account using 2FA!

 

[aamwgm]

Passkeys FTW. And thank you @amirm for enabling it on the forum!

 

[Cogito]

Biometrics FTW!

 

[somebodyelse]

And related, put a block on your phone number transfer at your mobile carrier. People have been known to hijack your phone number and then get into your account using 2FA!

Don't enable phone number as 2FA - and don't trust any provider that has that as their only 2FA option.

Biometrics FTW!

Highly dependent on implementation. Many of your biometrics are readily available, and you can't change them easily. Fingerprints are often badly defined or entirely unreadable in the older population and those in trades where they wear smooth.

 

[coonmanx]

The IP address of the person who hacked my account was from Paris and was known to be associated with spam and brute force attacks. Yeah that was a wake up call...

I was using the same password here but changed that immediately last night. I just never figured that an audio forum would be the place that I would get hacked. But scammers gonna scam...

 

[somebodyelse]

Don't enable phone number as 2FA - and don't trust any provider that has that as their only 2FA option.

Coincidentally MS are discontinuing use of SMS for 2FA because "SMS-based authentication is now a leading source of fraud"
https://support.microsoft.com/en-us...-stop-sending-sms-codes-for-personal-accounts

 

[somebodyelse]

I just never figured that an audio forum would be the place that I would get hacked. But scammers gonna scam...

...and they'll probably get a better hit rate in places where people aren't expecting it.

 

[Roland68]

The IP address of the person who hacked my account was from Paris and was known to be associated with spam and brute force attacks. Yeah that was a wake up call...

I was using the same password here but changed that immediately last night. I just never figured that an audio forum would be the place that I would get hacked. But scammers gonna scam...

This has long been standard practice on all platforms—such as classifieds sites and forums—where items can be sold.
I pay for purchases exclusively using standard PayPal; it recently saved me €240, even though everything appeared legitimate.

A tip for anyone looking to buy items from classified ads: check the images using Google Image Search to see if they have already been used in other listings. If that is the case, it is 99% likely to be a scam.
Additionally, check the exact wording of the text using Google Search; the descriptions are often copied word-for-word.

 

[coonmanx]

This has long been standard practice on all platforms—such as classifieds sites and forums—where items can be sold.
I pay for purchases exclusively using standard PayPal; it recently saved me €240, even though everything appeared legitimate.

A tip for anyone looking to buy items from classified ads: check the images using Google Image Search to see if they have already been used in other listings. If that is the case, it is 99% likely to be a scam.
Additionally, check the exact wording of the text using Google Search; the descriptions are often copied word-for-word.

I think in this case they merely used a screenshot of the Ebay post. LOL. So yeah, it had the exact same wording...

 

[Ruediger]

One infostealer dropped on a PC can ruin lifes.

 

[Roland68]

One infostealer dropped on a PC can ruin lifes.

Unfortunately, however, many people are also partly to blame themselves.
Do not open links in emails from senders you do not recognize. Do not open obvious spam emails.
Whether they are links related to financial transactions or alert emails—purportedly from PayPal, banks, eBay, Amazon, classifieds sites, etc.—you can go directly to the actual website to check for yourself; do not use the links provided in the email. If the information isn't there, it is a fake—just like the emails and the links themselves.

The same applies to prize notifications, millionaires wanting to give you money, and similar offers. Do not click on the links; otherwise, you’ll be the ones looking like idiots.

And passwords—seriously, folks.
There are excellent, highly encrypted password managers available that can generate long, secure, and cryptic passwords for you.
I have been using a password manager like this for over 10 years now; I have hundreds of different passwords—a unique one for every single account—and all my critical passwords are at least 20 characters long, cryptic, and include special characters.
Since adopting this system, I haven't forgotten or lost a single one of my passwords.

 

[Sir Sanders Zingmore]

Unfortunately, however, many people are also partly to blame themselves.
Do not open links in emails from senders you do not recognize. Do not open obvious spam emails.
Whether they are links related to financial transactions or alert emails—purportedly from PayPal, banks, eBay, Amazon, classifieds sites, etc.—you can go directly to the actual website to check for yourself; do not use the links provided in the email. If the information isn't there, it is a fake—just like the emails and the links themselves.

The same applies to prize notifications, millionaires wanting to give you money, and similar offers. Do not click on the links; otherwise, you’ll be the ones looking like idiots.

And passwords—seriously, folks.
There are excellent, highly encrypted password managers available that can generate long, secure, and cryptic passwords for you.
I have been using a password manager like this for over 10 years now; I have hundreds of different passwords—a unique one for every single account—and all my critical passwords are at least 20 characters long, cryptic, and include special characters.
Since adopting this system, I haven't forgotten or lost a single one of my passwords.

I have a serious question about password managers. Aren’t you essentially reducing all your passwords to a single password - the one that opens your password manager?

 

[Roland68]

I have a serious question about password managers. Aren’t you essentially reducing all your passwords to a single password - the one that opens your password manager?

That is precisely the whole point: a single, complex password that you need to memorize.
For added security, you can—physically!—write it down in a safe place and change it at regular intervals.
Of course, at this stage, you must also exercise common sense: do not back up your password safe via cloud services, nor store a backup copy in the cloud or on network storage.

 

[respice finem]

Probably the most convenient way would be biometric login.
But it would need to be 100% safe - and nothing really is...

 

[Ruediger]

I have a serious question about password managers. Aren’t you essentially reducing all your passwords to a single password - the one that opens your password manager?

Common and logical question. Yes, that's the personal usage benefit. No, it doesn't give the bad guys an edge.

I could dive into how a proper designed password manager like f.e. Bitwarden works under the hood, but that would get long and boring for non-IT folks.

But some key things:

- the password manager provides an encrypted space where contents are owned by a public/private key combo you created, not the password manager company or anyone else
- your one password does not replace all the username/password combo logins in there, it's just a factor to get to them
- verification by mail is part of that of course, more factors can be leveraged (no need for private users IMO)
- access is done per device (browser, app) fingerprinted (known to be good after going through the process) and not in any way universal
- the infos pulled from the encrypted storage are encrypted on the local PC too
- measures are taken against keylogging, screenshots, script infusion and other local attacks

For private usage the start scenario is on the lean side. Email, password, verification by mail, keeping restore infos (keys) and working with authorized devices is the scope. That's comfortable and fine so far. It enables quick, productive work.

To make the most of it, the user has to do something too. First thing: no password re-usage unless in very limited scenarios (like your 2 offline NAS at home). No dictionary passwords, personal infos, birthdays and all that stuff. Use the password generator and do 12 cryptic chars or more always. Re-work old accounts over time and get everything up to that level. 99% taken out of hackers hands already.

Then there is that kind of info you don't store on an internet password manager, no matter how good and properly designed it is. Like your password and keys to that password manager. Important documents. Infos for locks, alarms, ledgers, house appliances and such. I recommend using KeePass and create a local encrypted file where you can drop anything into (not just usernames/passwords) and know it is securely locked away and a copy of that file can be stored anywhere, just in case.

 

[respice finem]

That is precisely the whole point: a single, complex password that you need to memorize.
For added security, you can—physically!—write it down in a safe place and change it at regular intervals.
Of course, at this stage, you must also exercise common sense: do not back up your password safe via cloud services, nor store a backup copy in the cloud or on network storage.

For now, I'm using this exact method.
.7z file (encrypted with a long and complex password, and with multiple backups).
"Achilles heel" - what if I get a stroke and don't know my master password any more?

 

[Roland68]

Probably the most convenient way would be biometric login.
But it would need to be 100% safe - and nothing really is...

Precisely these types of biometric security measures have been tricked often enough—even at an industrial level.
And how many films with severed thumbs and index fingers and removed eyeballs does one have to see to understand that, from a personal perspective, this is not the best method?