Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Carbon dioxide
Oct 9, 2012

Hey OSI bean dip, two questions:

Why is it better to use another DNS? What's wrong with my ISP's DNS?


Would you mind if I took your OP, translated it and published it on a webpage for my friends and family? I might add some extra explanations for the especially stupid readers. If you'd like to be credited in a specific way, shoot me a PM.

Adbot
ADBOT LOVES YOU

Carbon dioxide
Oct 9, 2012

I just installed that EMET thing the OP talks about. Any recommended settings for that? Is there harm in setting it to the maximum security profile?

Carbon dioxide
Oct 9, 2012

What the hell. I can't even load that page on microsoft.com. It keeps trying to reload something forever.

According to Wikipedia it's something from 2011.

E: Hah, that page has a script that redirects https to http. Except microsoft.com has a general thing now that redirects all http requests to https. So that turns it into an infinite loop. Turn off javascript if you wanna see the page.

Carbon dioxide fucked around with this message at 22:07 on Oct 29, 2015

Carbon dioxide
Oct 9, 2012

I'm glad they're putting Windows 10 upgrade to a more important update level. This is their way of preventing the thing that happened with Windows XP, where millions of computers were still running on this old system, even after support completely dropped, leading to security problems everywhere. And they're doing it for free too. While their Windows 10 data-grabbing from computers is concerning, an 'enforced' upgrade will in the long run be helpful for all those people who don't understand computer security at all.

Carbon dioxide
Oct 9, 2012

I really like Foxit Reader myself.

Carbon dioxide
Oct 9, 2012

The answer is quite simple. Yes, Microsoft put a bunch of tracking stuff in there. Whether it's worse than any other big company, I don't know.

What I do know is that you can just turn it all off. You have to dig through two screens of settings, but it isn't even that hard. People are mostly angry because it's opt-out instead of opt-in.

Other than that Windows 10 is a straight update over Windows 8.1, I find it a lot more pleasant to work with.

So do the upgrade (while you still can. After some point this year Win 8 --> Win 10 upgrade won't be free anymore), turn off the spy settings, and enjoy your life.

E: I do suggest you google a guide on how to turn those spy settings off. That way you certainly won't miss one.

Carbon dioxide fucked around with this message at 20:15 on Jan 6, 2016

Carbon dioxide
Oct 9, 2012

Windows 10 works fine on my machine so stop complaining, everyone. :P

Carbon dioxide
Oct 9, 2012

It is possible they accessed logins for things. Anything that you're automatically logged in to when you open the website, they could've accessed, and possibly other things too. I'd suggest changing all your passwords as a precaution (the third post in this thread has some suggestions on safely storing passwords, in case you want that). Don't forget your passwords for your e-mail accounts.

It is of course also possible they looked into your files. I'd also be wary of identity fraud, although that might be paranoia speaking. Do you have ID information on there they could use to impersonate you? Like, if they call your bank, could the scammer make the bank think they are you? If you suspect this might be the case, it can't hurt to contact your bank and the police telling them that you're afraid you might become a victim of identity fraud. Hopefully nothing will happen, but if it does, it's best if people have already been warned.

Carbon dioxide
Oct 9, 2012

fourwood posted:

You might just start out testing it on not-important websites with lax password requirements, like somewhere that'll take a 16 or 20-character alphanumeric, repeats be damned. Learning the intricacies of password generation can come later.

Hell, start with saving your existing passwords, by using one of the Keepass browser plugins that ask you when you login somewhere, and also automatically fill password fields when you go to a site with a saved password. Once you've done that you can start migrating to more secure passwords. And don't forget to clear your browser's password saving feature once you got everything in Keepass, the browser's thing is incredibly insecure.

Carbon dioxide
Oct 9, 2012

Avocados posted:

I've had a hell of a time lately with various accounts of mine getting broken into. Over the span of a month, my spotify account was accessed twice. My Playstation Network account was accessed and the person locked me out of it. I lost my Blizzard account the same way. In the span of an hour, Dropbox emailed me six times for password reset links. Today, Facebook emailed me a password reset link as well.

The best part of all this is that all my passwords are randomized through LastPass. I can understand this being a problem if I used password123 on all my accounts on the internet, but I dont. I've done multiple virus scans which come up clean. I don't know what else to do. I'm more security conscious than my friends who use the same password for everything, yet it seems like im under constant attack with periodic successful breaches.

How do I fix this goons :negative:

Is it possible someone got hold of your LastPass account? There have been a number of security breaches in LastPass itself in the last year. That's why in the OP (well, in the 2nd post), it's recommended to use KeePass or 1Password instead of LastPass.

Carbon dioxide
Oct 9, 2012

I also use the Disconnect plugin. I don't know if using it and Privacy Badger at the same time helps any, but it doesn't hurt. Except that those plus my adblocker means that whenever part of a page doesn't work, I have no clue which plugins are blocking it.

Carbon dioxide
Oct 9, 2012

The 1.0 (first complete) version of a tool called Unchecky has been released.

I've not tested it myself so I cannot vouch for the tool being safe, but it seems to have positive reviews.

It's a little program that runs as a background service on Windows systems, recognizes a crapload of installers that try to bundle malware, annoying browser toolbars, and similar poo poo with their programs, and automatically unchecks the boxes that cause those programs to be installed. That way, the chance of accidentally installing that nonsense is reduced.

I'm sure it's not a 100% solution, those installers get updated as well, so you still need to be careful. And running yet another service on your computer might slow it down. But it sounds like it could be helpful for your digitally challenged neighbour who needs a full computer reset each month because their computer has bonzibuddy and a million browser toolbars yet again. So apparently quite a few of support people install it on any computer they run into to save them work later.

Can someone who knows more about this than me take a look and confirm/deny whether Unchecky is good? https://unchecky.com/

Carbon dioxide
Oct 9, 2012

OSI, according to your OP, 1Password is good. However, it's not open source.

What's your opinion on this?

Carbon dioxide
Oct 9, 2012

Squeegy posted:

Like a decade of hearing it slagged by people who hate Java.

Java and JavaScript are about as similar as car and carpet.

Java browser applets are horribly insecure because they can do way more to your computer than you might like, and Oracle (company that owns the Java language) actively discourages them, partially by making it nearly impossible to run them. Java is one of the most popular languages for businesses because for back-end applications such as webservers it's a perfectly fine language. Of course, in that case they're mostly running code they're familiar with on machines they own or rent, so there's no point in using it to gently caress up a server. And in that case the code itself isn't executed on the end-user's machine so he's safe too.

To be clear, both Java browser applets and Flash run their own code on your computer, which means that with a little bit of trickery they can get into your file system.

JavaScript is basically executed by your web browser. That's one of the reasons why you hear webdevs complain about older version of Internet Explorer so often: it doesn't understand a lot of JavaScript syntax, breaking loads of modern websites. On most sites, JavaScript does tiny stuff like validate if a form is filled in correctly, or dynamically showing parts of the page if you click on "view more". But it is possible to run complete applications in JavaScript.
Because the browser executes it, it's basically up to the browser to not allow a script to do any evil things. But you have to trust browsers anyway because they are programs installed on your computer which means they can access your filesystem no matter what. And browsers have a reputation to keep up. It doesn't run on its own like Java or Flash so the risk isn't as high.

Carbon dioxide
Oct 9, 2012

andrew smash posted:

What's the best way to keep that stuff in this kind of situation? A cloud service? Stacks of DVD-Rs? A usb hard drive? I am inclined to distrust a USB drive that has been plugged into a known malware-ridden machine but I am admittedly an interested layperson at best when it comes to this stuff and would appreciate the input of others.

Windows 10 allows you to reset your system while leaving your documents intact - although it's still recommended to make backups before running it, and I'm not sure if a 'partial' system restore like that cleans up every possible infection.

Carbon dioxide
Oct 9, 2012

Clint Howard posted:

How often do people here change passwords for sensitive sites and data? KeePass has the option of setting an expiry time for a password. Depending on the sensitivity of the data the password is protecting, I set expiry times of varying lengths. For my most sensitive information (e.g., banking sites), I change my passwords every week. For somewhat less sensitive, but still important stuff (email, dropbox), I change passwords every month. Things like forums account passwords and Amazon get changed every 3 months. I change my KeePass master password every month. My WPA2 and router passwords also get changed every month. I use 2FA on everything I can.

Realistically, I know that a properly generated, high entropy password on an otherwise secure system can't be cracked in my lifetime via known methods, so I wonder if I'm being silly by changing my passwords so often. Then, breaches like this Cloudflare situation pop up, and I wonder how many similar breaches occur without ever being noticed or reported; maybe my paranoia is justified?

Changing passwords this often requires maybe 20 minutes per week of my time at most, so I don't think I'm that crazy, but I do sometimes wonder if it's a waste of time and energy.

This is from a study by Google a few years ago:



The reason non-experts change their passwords so often is because, well, if people use bad passwords to start with AND they reuse passwords, and you can't get them to change that behaviour, telling them to change passwords every so often is the only option left.

For experts who don't reuse passwords and have randomly generated passwords of sufficient strength only, changing them is really never necessary unless you find evidence of someone having gotten access to your account.

See, now there's a good reason to change passwords on sites that use Cloudflare, but other than stuff like that? Complete waste of your time. Seriously, 20 minutes EVERY WEEK on something that's hardly ever necessary?

Oh and to any sysadmins at companies - please don't force people to change passwords every so often. It'll just cause them to increment a number at the end of a password, and it'll cause them to choose simpler passwords because they'll have to learn a new one every time. Forcing people to change passwords regularly is a terrible security practice.

Carbon dioxide
Oct 9, 2012

Unbelievably White posted:

I've decided to stop being an irresponsible idiot and get 1password set up. The majority of my passwords are saved in my web browser, the only exceptions being the really sensitive ones like my bank account and my amazon prime.

How big of a project is it to get started? How difficult is it to move everything to another service if someday 1password is compromised? I have a ton of passwords saved, even more on paper, and probably a bunch that I'll have to reset anyway simply because it's a duplicate of another throwaway password. I don't want to run down the free trial just because I didn't have a saturday open to punch everything in and verify that it works.

Basically, what should I have ready before purchase to make the transition as easy as possible?

Well, once you use a password manager, the main actions for password security are:
- Make sure you don't ever use a duplicate password anywhere. If one website (say your-online-banking dot com) gets compromised, and you use the same password on, say, your gmail account, the hackers have access to both your accounts.
- Use actually secure passwords. A password manager removes the need to remember them so you don't need to use "hunter2" anymore. The only things you need to remember are a (very long) passphrase you use to access your password manager, and optionally, something that you can use to reset your 1password passphrase if you forget it. I'm not sure how 1password deals with that exactly.

Next, login to your password manager and go wild on the 'generate random password' function. I suggest 20-30 random characters, at the very least uppercase, lowercase, and digits. If possible, symbols are nice too but way too many websites refuse those in password fields. Go to every site you frequent, hit change password, and put in a randomly generated password and immediately save that to 1password too. And do not reuse the randomly generated passwords.

This takes a little bit longer than just copy-pasting your existing passwords in there but that way you're immediately making use of the security advantages of a password manager.

When I first set up a password manager I started putting in websites I use daily, and left the others sitting around. Those are less important to me if they get compromised, anyway. However, whenever I go to a website, realize I have an account there, which is not yet in my password manager, I immediately change the password and add it. That way the boring part of the work is spread out over several months.

I have no idea if 1password lets you export stuff, I use KeePass myself. I do think it's very unlikely they get compromised, as far as I know they store everything with proper encryption so that nobody without the passphrase can decrypt the passwords. However, if it does happen, the best thing to do is, as quickly as possible, reset all passwords again to new randomly generated passwords and put those in another password manager.

Carbon dioxide
Oct 9, 2012

fartzone_42069 posted:

Speaking of security. Windows 10

My living situation changed and I had lovely wi-fi so I downloaded porn videos straight from the "Download" link on some popular tube sites. Now I have a porn folder. I got a wi-fi extender so I no longer need to download the porn outright.

Anyway, are these porn video files ironically infected with viruses? I've done the "Offline Scan" with Defender. I know that's not the end all be all. Defender actually hasn't found jack poo poo since I've had this computer.

Yesterday my computer got kinda slow. And the desktop icons were flashing a bit. And I went to the "Show hidden icons," and I swear I saw a little red devil's face for a second. But also I have Origin and Steam and Blizzard and all the other poo poo that needs to phone home just to play obsolete games from the 90s. Are my porn videos also phoning home?

Thank You.

The deal with porn sites is that they can have viruses on them, but regular porn videos that you get from the download link don't.

- Was a download a popular video format: mp4, mkv, avi? Did your favorite offline video player play it without hitches? Not a virus.
- Did you get the video from one of the big 'famous' porn sites? Unlikely to be a virus.

- Did you click a "Download video" link that looked almost exactly like the real deal, but is secretly an ad? Possibly a virus. Especially if found on one of the millions of tiny little porn sites that only exist for ad clicks.
- Did you download a .exe or did something pop up to tell you you needed to install a custom "downloader" or custom "video player" or whatever to play this video? Almost definitely a virus.

Basically, pure video files cannot really be viruses because they cannot execute arbitrary code, that is, they cannot start programs outside of the video player.
Executable files (.exe) and executable files masking as other files ( .mp4.exe), and other file types that can have programs hidden in them (see this article for a list of common ones) can be viruses and often are if you downloaded them from an untrusted source, such as, like I said, ads on porn sites.

I don't think it makes any sense for a virus to put an icon right on the desktop, viruses usually try to hide themselves, unless they want your money in which case they are way more in your face. A virus that has a hook on the "show hidden icons" option and deletes stuff as soon as you activate it? That sounds like the most useless functionality ever.

Anyway, the first thing to do when your computer gets real slow is right click on the Windows 10 task bar and choose Task Manager. If you haven't ever run Task Manager before, you'll see a small screen just listing the programs that are running. In that case, click 'more details', and check the leftmost tab, Processes. Look for any programs that are eating up a huge chunk of CPU or Memory. Those are likely to cause the slow down. Are they programs you actively use? Well then you can do something about them by either replacing them or see if you can use them in a less CPU/memory intensive way. Are they background processes or something else? Well, it could be completely benign, or it could be a virus. And sometimes, viruses try to mask themselves as benign processes in this tab. If it looks weird, it can't hurt to Google the name to find out if you need that running on your computer.

There are more advanced tools than than too, for instance ones that show you exactly what programs are phoning home to where. But those get way complex way fast, so if you aren't familiar with those, and after all the above you're not sure yet, it's prob better to have an expert look at your computer.

Carbon dioxide
Oct 9, 2012

Proteus Jones posted:

This is why I'm glad I never opted to use FB

Carbon dioxide
Oct 9, 2012

Frivolous Sam posted:

I use Google Drive which integrates well with Keypass2Android

Yeah, use basically anything. The main thing is to never store the keyfile/master password with the .kdbx file. I suggest keeping one of those offline always. Hell, write the master password on a piece of paper as a backup if you like.

.kdbx security is pretty good (if your master password is good and you did the randomization mouse thing for long enough when creating the database) so it should be safe to even store it on a public server. Just for ease of mind I'd put it behind something that's password protected like google drive or dropbox yeah.

By the way, I just want to say that I really like the synchronization option in Keepass. It lets you put 2 copies of the kdbx file in sync again, even if you made changes to both. They apparently made the algorithm quite safe, making sure you always have the latest version of every entry, and they made sure you don't get inconsistent or lost data. If it doesn't know what to do it just puts the older version in a history folder within the db, and then puts the newer version of an entry in the new folder.

It's very useful when you have one version locally and another version you use remotely and sometimes you need to edit both.



That's great, I'm gonna see if we can do something with that.

Carbon dioxide fucked around with this message at 06:45 on Apr 12, 2018

Carbon dioxide
Oct 9, 2012

Serendipitaet posted:

Ok, that's what I thought re: the first point. Also, yeah, I've considered that worst case, too. Also what if they DO keep logs, despite what they're telling me. Then... are there really any privacy or security benefits? That's what these companies are advertising, but in practice I pretty much use it just to get around geographical blocks for streaming.

Luckily, I don't have to worry about the legality of any of the stuff that I'm browsing. There's things in there that I wouldn't necessarily want my mom or my employer to know about, but nothing that would get me in trouble. Where the paranoia comes in is that - as far as I understand it - sophisticated ad-focused trackers run by e.g. google or facebook can indeed correlate my online identity - i.e. the news I read and the amazon listings I browse (I'm ok with that to the extent that it pays for the content I consume), but also what porn I consume (which I find creepy and would like to avoid, ideally). Also, having said that nothing I do online would get me in trouble, what if the law changes? This is just hypothetical, but it's one of the reasons I hear whenever privacy (not just) online is discussed.

The best thing against agressive ad-serving trackers are browser plugins that block those trackers entirely.
The simplest (but not as effective) way to do this is to enable whatever built-in tracking protection browsers have these days. Firefox has something to that regard.
To be better protected use a plugin such as Disconnect or Privacy Badger (made by the Electronic Frontier Foundation). I use both but that's probably overdoing it because occassionally after an update they block things I want to see like Twitter embeds and then I have to figure out which one is over-eagerly blocking it.

Considering VPNs, there are a couple reasons to use them. If you use the good ones, they are rather effective against government censorship. I would've been unable to read my mail or any western news without my VPN while in holiday in China, for instance. Another thing they allow you to do is make you appear as if you're in another country, letting you access region-locked content on video sites and the like. The legality of doing so isn't really clear and might differ per country/state.

A third thing they do is put a single layer of abstraction between you and people wanting to track you. For instance, when a local organization that attempts to get uploaders of pirated material to court was asked what they did if they found someone they were tracking was using a VPN, they actually said something along the lines of: "It's not worth putting in the extra effort, we're going for the easy targets first". It won't protect you against real law enforcement if they're actually trying or anything, but it does give them extra work.

Anyway, if your usecase is "I don't want my mom finding out what porn I'm looking at", your best bet without going full-paranoid "throwaway phones on public wifi while wearing a mask" mode is a combination of the following three points:
- A vpn to make you slightly harder to track
- A browser in incognito mode when you're looking at stuff you don't want people to find out about (this does two things - it prevents browsing history from being stored on your computer, and in incognito mode, you're logged out from everything, making the likes of Google and Facebook less likely to track you)
- A privacy/tracking-blocker plugin to your browser (which needs to be enabled for incognito mode in the settings)

Ideally you use a different VPN connection/IP for your incognito stuff and your day to day stuff but that's quite a bit of extra effort to set up.

Of course you could also use TOR browser. TOR basically routes your connection through a dozen random computer scattered worldwide so it's like a VPN connection on steroids. And TOR browser has incognito mode built in.
Note that it has been proven that if people try hard enough they can still track you through TOR, and on top of that using it makes your internet slow as hell, so it's up to you if you want to bother with it at all.

Carbon dioxide
Oct 9, 2012

Cup Runneth Over posted:

Got infected by some malware recently, probably from a torrent. It went by SoundMixer.exe and the only reason I found out I had it was because it (presumably accidentally) disabled the Command Prompt. Surprisingly easy to clean out; just deleted it from AppData, cleaned out the few registry entries it made, and force-killed the "Sound Mixing Utility" processes it started, and everything was back to normal. Anyway, if cmd.exe suddenly stops working for you, that's probably why.

Malwares can leave secondary payloads. Make sure to do a very thorough scan of your computer for other malware, and keep at it because if there's something else it might stay dormant for a long time until something (like a timer or whatever) triggers it.

Carbon dioxide
Oct 9, 2012

I have no idea what those soft reset options even do.

Carbon dioxide
Oct 9, 2012

buglord posted:

I keep hearing stuff about Gmail being insecure and that advertisers can skim words off your messages to sell things or whatever. Is any of that remotely true, and is there any case where the average end user should move to something with more privacy, like Tutanota or something?

ProtonMail is another secure one.

Carbon dioxide
Oct 9, 2012

It might be a faulty USB cable or something.

Carbon dioxide
Oct 9, 2012

Guest2553 posted:

I meant I have neither TPM nor bitlocker. I'll just veracrypt it all and hope the PC doesn't die because then :rip: :filez: until I get home.

If you worry about this the best thing to do is set up some cloud storage like Google Drive or whatever and have that sync to/from your laptop. If you're specifically worried about someone getting access during plane trips, you could even upload everything to your cloud storage then wipe your laptop before checking in. Just note that this isn't a replacement for hard disk encryption, because without encryption it's trivial for someone with an undelete tool to get deleted files back.

Carbon dioxide
Oct 9, 2012

I think it's nonsense to assume all VPN providers are unsafe.

A lot of the bigger ones have gotten external audits and yes, it turns out they actually don't log poo poo.

Also, even if they log stuff, does it matter whether it's your ISP logging things or some foreign company? I'd rather have it be the latter, because they at least can't be ordered around by *my* government.

For me, the main reason for using a VPN is so that websites I visit don't know where I'm from, because they have no right to that information. On top of that, it allows me to visit websites that are otherwise unavailable because of location-based blocking.

If you're looking for a VPN I suggest starting here: https://thebestvpn.com/

I'm using ExpressVPN now. They're a bit expensive compared to some others but what's nice is that they have a test kit to see if all your data goes through the VPN and actual humans you can talk to if you can't figure it out. There's a bunch of gotchas, such as that normally DNS traffic (the bit of the internet that when you type in 'somethingawful.com' figures out where the server for somethingawful.com is actually located) and ipv6 (new internet protocol standard) traffic go over a plain connection, skipping your VPN entirely. That means websites still can figure out where you're from. The better VPN providers such as ExpressVPN actively help you prevent that.
Tbf I think Nord is a bit lacking in that regard.

Carbon dioxide
Oct 9, 2012

OSU_Matthew posted:

This, windows defender is adequate endpoint protection. Rather than OS level malware, threat actors are increasingly turning to other activities like fishing and scams, and malware like cryptocurrency mining.

Honestly, best things you can do from my perspective:

1. Patch your poo poo — eternal blue (Wannacry) ransomware was so devastating internationally because institutions didn’t update their servers with a months old patch from Microsoft. Would’ve been much worse if someone didn’t find and disable the C2 server so quickly into the outbreak

2. Use a password manager with unique randomized passwords for everything— all your poo poo is hacked and available online, check haveibeenpwned.com if you don’t believe me.

2.5 — use MFA (Multi-Factor Authentication) for everything! Say yes to getting a text with a code for logins, or even better, an Authenticator app

3. Don’t click on links in your email or texts — phishing is getting crazy sophisticated these days, Nigerian princes are dead

4. Pay attention to urls, especially the domain name, eg google.com instead of gooogle.com. Don’t click ads either, just don’t. Singles in your area do not want to mingle.

4. Encrypt your hard drive, especially if you have a laptop. Turn on bios password (efi firmware password on Mac) so it can’t be easily wiped or login bypassed if it’s stolen

5. Pi hole is easy and effective to set up, and using Quad-9 as your DNS can help protect you from malicious resolutions. I posted a few pages ago about this, and it was just brought up again. Not a panacea, but it helps

6. Don’t install random poo poo from stuff you don’t trust, and be careful what you agree to. This is less prevalent than it was ten years ago, but it’s still a thing

7. Update your network equipment, don’t use default credentials. Old routers have hardwired default credentials and half the world is using automated scripts to crawl the web for vulnerabilities, including your IP if your router’s firewall is open on certain ports or protocols (mmm UPnP). Also make sure your WiFi uses WPA-2 with a passcode over 8 characters, more the better. Hacking WiFi is fun and super duper easy to do.

8. Paid, well reviewed VPN services are imho worth it for stuff like being on public WiFi or untrusted networks. Anyone listening in over the wire will just see an encrypted pcap instead of plain text poo poo. More sites are using HTTP over TLS, so, it’s better than it used to be, but still an issue. Also everything from your IP address is logged, and you’re being tracked by scripts on the websites you visit, third party cookies, window size, single pixel watermarks, all sorts of fun creative ways really. VPN alone is not a panacea, which I assume was the concern a few pages back, but that brings us to:

9. Configure your browser for privacy. This is a new link, but pretty cool:

https://nakedsecurity.sophos.com/2019/03/08/firefox-browser-picks-up-advertiser-dodging-tech-from-tor/

Disable third party cookies, that kind of stuff. The EFF has recommendations based on how far you want to go down the rabbit hole:

https://www.eff.org/

10. All of your information is already for sale, including your credit card, SSN, everything. You getting defrauded is honestly luck of the draw these days. One thing you can do is lock your credit from the three bureaus.


11. Don’t answer phone calls from numbers you don’t know or aren’t expecting. Talking over the phone is dead, phone numbers (and even email addresses) are easily spoofed with VoIP. I don’t know if people are using scripts to confirm personal numbers or what so sets of data are more valuable to resell to scammers, but it’s a problem .

e: This turned out to be more than the top two or three I wanted to quickly mention, and is far from all encompassing, just a few things off the top of my head. But hopefully someone may find this useful. If something else easy and useful occurs to me I’ll post it up.

A Good Post.

Carbon dioxide
Oct 9, 2012

spiny posted:

Just use one of the many programs that can 'wipe free space' and you're set.

This is what you're looking for.

Also maybe go through your programs, such as Word or whatever you used, and check that they didn't store backups of your files in whatever hidden-away folder they store automatic backups.

Carbon dioxide
Oct 9, 2012

Surprise Giraffe posted:

Anyone know if Avira free now automatically installs Opera? Just had the browser appear on my Win10 machine out of nowhere. Mighy be malware but I have no notion where it could have come from. I mean I just connected to the home network for the first time in three months so maybe the parents have malware?

Avira is a virus scanner so it's basically malware. Just use the thing built in to modern Windows, if you're a Windows user. Also see the OP about anti-virus.

Carbon dioxide
Oct 9, 2012

Golden Bee posted:

Sorry to resurrect the thread, but I’m having a problem where other apps will open links in a new instance of Firefox, one without my settings saved. Not a new window, entirely different version.

Check for separate Firefox profiles on your computer. Each one can have a separate set of settings, history and all that. Perhaps for some reason a new one was created and set to default.

https://support.mozilla.org/en-US/k...irefox-profiles

Carbon dioxide
Oct 9, 2012

Plastik posted:

Is KeePass 2.x still the best non-cloud password manager? Also, is it sane to only put it on my phone and manually type my passwords into my desktop, or should I just have it on both?

I just found out that I have to change a bunch of my passwords (again) so if it's smart to switch (or install the desktop KeePass client) then now is the time.

Question about Keepass: what is up with the Keepass Firefox plugin? A while back it changed its name to 'Kee' or something and it started advertising about putting your passwords in the Kee cloud platform instead of in KeePass.

Have they gone evil?

Carbon dioxide
Oct 9, 2012

Tamba posted:

They are very much related, because Kee is a direct successor to the Keefox addon that did the same thing as the two addons you mentioned.
In fact, Kee is still listed on the official Keepass plugin page.

quote:

So everyone who used Keefox got updated to Kee and can still use it with a local database (but they're encouraging you to buy their cloud thing instead)
It's what got me to switch to KeepassXC instead of looking for another addon for the original Keepass

Thanks! I didn't know about KeepassXC and just switched.

Carbon dioxide
Oct 9, 2012

Does the OP's section about antivirus products apply to ClamAV on Linux?

Is it at all useful to install ClamAV on a Linux system?

Carbon dioxide
Oct 9, 2012

sephiRoth IRA posted:

I have a SIM card/phone related security question. My wife dropped her phone in our neighborhood and it got found by a woman who lives nearby. She apparently gave it to her husband who pulled the SIM card and got my wife's information, after which he called verizon who called me. I have the phone back with the SIM card, but my issue is that I'm way too ignorant and polluted with movies to know what he could/couldn't have done with the card while he had it out.

My question is A) could he have duplicated the SIM card or do some other technowizardry to be able to make calls/receive texts using my wife's number despite me having the original phone and SIM in hand? I know it's her SIM because the phone is working properly with her phone number. B) If he could theoretically do some shady poo poo, what are my protection options? New SIM? New phone? New number?

If you were to fully duplicate a SIM I'm pretty sure it wouldn't work because a network won't allow 2 SIMs with exactly the same number to be connected at once (not just the phone number but also the SIM's internal serial number). This would prob trigger some fraud detection on Verizon's end, they'd block both cards, contact you to ask what's up, and after you explain it, they'll just send you a replacement SIM card.

Carbon dioxide fucked around with this message at 07:52 on Feb 28, 2020

Carbon dioxide
Oct 9, 2012

Is anyone familiar with Authy?

I've been using Google Authenticator for my TOTP but Authy advertises with multi-device support and encrypted cloud backups which sounds really useful - it would mean I don't have to reset everything that has 2FA enabled if my phone stops working or something.

But before I switch I'd like to know if Authy is safe, do they have a good track record, do independent experts recommend them, stuff like that.

Carbon dioxide
Oct 9, 2012

The Fool posted:

I like 1Password and use it for work and personal.

BitWarden has been picking up in popularity and has self hosting options, but I’ve never used it myself.

KeePass is the grognard option.

Don't use classic KeePass anymore. If you want KeePass use the KeePassXC fork instead.

Carbon dioxide
Oct 9, 2012

It's been a while since I switched but the main reason is KeepassXC is a open-source community fork of Keepass that sees a *lot* of active development and they're also doing a lot of work to make it useful cross-platform. E.g. for Keepass basic it was always a messy thing to get Firefox integration working because you had to install a 3rd-party plugin called Keefox... that at some point started shoving ads for their *own* password manager solution in your face, and also, to run Keepass on Linux for a long time the main way to do that was to use the KeepassX fork but people stopped working on that so it stopped getting version updates, and running an outdated password manager is generally not a very safe idea.

KeepassXC has native cross-platform support, works on Linux no problem, is still seeing a lot of active development, and has its own KeepassXC-browser plugin that makes filling in web forms Just Work.

So yeah, it's kinda both. Having much better built-in browser integration, and seeing active development for my OS so I'm not stuck with an outdated version.

Carbon dioxide
Oct 9, 2012

Yes, if you've used the same password anywhere else ever basically consider it compromised.

Also the official version of uTorrent has been shipped with malware since 2015, please switch to another torrent client ASAP and remove it from your system.

Adbot
ADBOT LOVES YOU

Carbon dioxide
Oct 9, 2012

RFC2324 posted:

Also helps to be in america where only idiots fiddle with they keymaps, and if its wonky on your production server then you have a bit of a problem

If you work in tech and you don't have at least one idiot coworker who insists in changing everything to dvorak at every available opportunity you haven't lived.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply