This is a most excellent place for technology news and articles.
Solving the "being human" part of security will probably never happen, which is why you're encouraged to do stuff like use 2FA, different passwords, service isolation and stuff like that.
Anyone and everyone can be fooled at some point, best to try and limit the damage.
Why is there a comma in the, title?
It indicates a pause, and a separation of the two objects in the sentence. It is a subtly different sentence than "Have I been Pwned owner Pwned", and is clearer with greater emphasis on what happened.
The original article: https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/
Don't password managers verify the domain name before offering credentials?
Does that mean he doesn't use a password manager?
Edit: RIP, now that's a proper phishing. I understand where he's coming from
This was mentioned in the write-up, the password manager didn't autofill, but he was too out of it to notice at first
Depends... if you use an offline password manager ( like keepass), you can ask it to autotype your credentials into anything... if that's what you ask it to do (ie it's not a fault)
Main point though: don't reuse the same credentials across different sites.
They'll get 1 site, but not all the rest of them...
He mentioned that he does and the password manager didn't prompt to autocomplete the password automatically, so he had to force it.
The thing that should have saved my bacon was the credentials not auto-filling from 1Password, so why didn't I stop there? Because that's not unusual. There are so many services where you've registered on one domain (and that address is stored in 1Password), then you legitimately log on to a different domain.
Then add multiple URLs for that entry. You can even have it match on the base domain, so it works on any subdomain, or restrict it to a subdomain.
I assume that works on 1Password, it works on Bitwarden at least.
That said, I could see myself making this mistake. I've had to manually find entries before for one reason or another (e.g. usually use the app, but access the website this one time).
It does work there. The unfortunate thing is that so many sites change their login structure often enough that it no unusual to discover that a site just changed again and you need to update the list.
Yeah,.there are plenty of instances where I'm adding a new URL for a password because the app and the website are too different from each other, or the app changes its login paths...
Or heck, sometimes it's close enough, and with my password manager on my phone, I don't have it auto fill -- I have it auto-suggest. So "Probably a match" and "Exact match" have the same path to entry.
Not everyone uses a browser extension for their password manager.
TIL: Nobody is perfect
glares in the general direction of the White House
...did you think there were perfect people in the White House before this? Or at any point in your life? Haha
(Maybe as a child would that make sense...)
Teddy Roosevelt was pretty chill. He's surely not perfect, but he's pretty okay in my book.
I'm a Jimmy Carter man, myself.
AT this point it is safe to assume you will fall for scams like this in your life. They are too like the real thing. We need the laws and police to catch up to investigating this thus making crime not pay (most of this is from countries that don't work with police - so probably some major international efforts required as well).
police excelling at anything other than enforcing a state monopoly on violence
I, too, would love to live in a fantasy world
I almost fell for a bank scam a couple years back. Basically, I had just gotten a new phone w/ GrapheneOS, which doesn't have Google's scam number protection (I was well aware, that's not the issue) and I hadn't yet transferred my contacts, and I received a call about a fraud alert on a card. This has happened a few times, and usually it's a pretty straightforward call where they verify my identity before asking me about certain transactions. As a bit of background, I was on vacation at the time and I got the call while waiting in the parking lot while my SO ordered something at a food truck.
Anyway, the call progressed like this:
I immediately called my bank and sorted things out, and we figured out nothing was stolen because I didn't provide the second code (that was to link an external account to suck my money out). Because I was in an unfamiliar setting and honestly pretty tired (we drove all day the day before), I just skimmed the text in step 2 w/o reading that it was a user-initiated code (i.e. for a password reset) instead of a bank initiated code (i.e. verify identity).
I consider myself a pretty security-conscious person. I use a password manager, MFA everywhere I can (preferring TOTP), I'm a lead backend SW engineer who has caught multiple security issues, etc. However, I fell for the scam and missed the safeguard that should have protected me. Fortunately it all worked out, but I did have to change all of my account numbers and login, which wasn't particularly fun while on vacation. That bank is fortunately one of the few that supports TOTP in my country, though I had avoided setting it up because it required a special app (Symantec VIP) and calling in (no self-service). I now have it set up and feel much better about my account security.
I'm just glad I got my parents trained enough to immediately contact me for anything that seems "off". The result is that they panic needlessly almost daily, but I still prefer that over getting the dreaded "they emptied all our accounts" call.
If anyone hasn't seen the videos Jim Browning did a while back about gaining access to a india scam call centers network and subsequently, thier cameras, its a fascinating watch but also pretty concerning.
https://youtube.com/playlist?list=PLBNmQJqxpaMaxqghShRiOnHUjO00ZCsor
One of the worst parts is that sometimes the police are on the scammers payroll, making it hard to take action. It would likely take an international effort to even make a dent against these kinds of places. They make a ton of money off these scams so its going to keep happening.
That's exactly the issue, how do you prosecute hackers from countries that either a) don't care because they're collapsing/at war/etc or b) actively encourage hackers like DPRK, Russia, China.
There's no way to realistically police it without some One World Government type shit. All we can do is practice good security.
Perhaps Jason Statham can be part of the solution, a la The Beekeeper
