11–20 of 62 posts
Installed a PiHole to clear all their devices from malicious ads / malicious url's.
Seriously, since I installed PiHole my maintanance visits / calls have dropped by 90%.
They don't use a CC. Maybe once a year for flight tickets but I tell them to check the URL / https.
And I've told them 100 times: companies do not call you. They don't. Ignore calls!
What really irks me is getting an email like this: Shipping account suspended Dear XXXX, FedEx shipping privileges for account number ending in NNNN have been suspended. To access and update your credit card data, log in to FedEx® Billing Online. Log in today (Button) This just screams "scam", especially since I haven't used the FedEx account in months. When I log into FedEx (not using the link in the email), my acco…
It is very easy to spoof an email address[1], so it could be that it is someone from outside of FedEx. https://superuser.com/questions/505503/how-can-you-fake-an-e...
1. Check PTR for IP and verify that the A or AAAA record for that name points back to the same IP.
2. Compare with IP address of server that sent previous mail to you.
3. Check SPF records for the domain.
4. Check MX records for the domain. Keep in mind that they might be using different servers for sending than for receiving though and that MX is for receiving.
If you use the LogDog app, your online accounts are continously monitored for suspicious access. It sends an alert to your phone and prompts you to review the issue and change your password if necessary. We're trying to make it as understandable and as easy to operate as possible, so even technically-unsavvy people could benefit. That being said, there's no getting around education. It's key to prevent a person from…
Are there other web-based services people here can recommend? Haveibeenpwned is great of course, but the horse has left the stable by that point, something that sniffs out suspicious activity before trouble occurs would be great.
The only way is really to educate them. I’ve dealt with this quite a bit with my family, and telling them what to be wary of has helped a bunch.
If you use the LogDog app, your online accounts are continously monitored for suspicious access. It sends an alert to your phone and prompts you to review the issue and change your password if necessary. We're trying to make it as understandable and as easy to operate as possible, so even technically-unsavvy people could benefit. That being said, there's no getting around education. It's key to prevent a person from…
Never heard of LogDog, looks very interesting, thanks. Are you planning a web-only service, or must it be a native app? Some relatives of mine don't have smartphones but do use plenty of online services. Are there other web-based services people here can recommend? Haveibeenpwned is great of course, but the horse has left the stable by that point, something that sniffs out suspicious activity before trouble occurs wo…
HIBP is indeed great and you can actually subscribe via email to get real time alerts. It's limited to credentials exposed via dumps.
Earlier quoted context omitted.
It is very easy to spoof an email address[1], so it could be that it is someone from outside of FedEx. https://superuser.com/questions/505503/how-can-you-fake-an-e...
Sure but if the link leads to the actual FedEx website then what would be the point?
What really irks me is getting an email like this: Shipping account suspended Dear XXXX, FedEx shipping privileges for account number ending in NNNN have been suspended. To access and update your credit card data, log in to FedEx® Billing Online. Log in today (Button) This just screams "scam", especially since I haven't used the FedEx account in months. When I log into FedEx (not using the link in the email), my acco…
So why is this comment on top?
It seems HN got mainstream and with it the usefulness is declining - low quality comments staying on top that can be answered by common sense.
What really irks me is getting an email like this: Shipping account suspended Dear XXXX, FedEx shipping privileges for account number ending in NNNN have been suspended. To access and update your credit card data, log in to FedEx® Billing Online. Log in today (Button) This just screams "scam", especially since I haven't used the FedEx account in months. When I log into FedEx (not using the link in the email), my acco…
Everyone knows that such spam mails are NOT sent by the company, but by scammers. Look at the raw email header. So why is this comment on top? It seems HN got mainstream and with it the usefulness is declining - low quality comments staying on top that can be answered by common sense.
He also says that the email contains a link to the real website, not to a scam website.
So, if it was sent by a scammer what's the purpose? How does it work?
And if it was sent by the company, why are they sending email that looks like a scam?
I designed a series of rules + practices which are stated as absolutes (i.e. no margin for interpretation) and they have worked well:
1. All emails with claims are false, even if I send them. Not only spam but also "snopes-like" scams from her friends. This rule always has precedence over anything else. 100% Never trust an email content. If it looks like there could be really bad consequences from ignoring an email, forward it to me and I'll decide.
I told her "imagine a stranger calls you on the phone and reads you the content of an email. Would you trust it?". She understood the metaphor.
2. She doesn't know her passwords. They are stored in the browser's keyring. Thus, she can't provide credentials to phishing websites.
3. She can click on links from emails, unless it is from a bank, because she knows her bank credentials. The combination of (2) and (3) makes the internet very usable for her as she can browse with confidence.
4. She only logs in to the bank website from her browser bookmark. She uses Safari's "Top sites" heavily, and she has learned to Google basic stuff.
5. If there is a weird message on a website, treat it as an email (i.e. it is false, etc)
6. Adblock is installed
7. She is beginning to recognize OS prompts, like icloud messages (storage, passwords). She knows she can never click on one before sending me a picture by IM. For these prompts password managers don't auto-input them and that's a problem. I must confirm its validity and then she has permission to open a notepad where her passwords are written and transcribe it to the prompt. But she always needs to send me a pic before opening the password notebook.
8. I have enabled Gatekeeper on the mac, thus she can't open binaries from the internet, only documents. Word macros are disabled.
9. If something doesn't look right, call/IM me on your cellphone
She is a very simple user and her needs are limited to websites, mail, office and a few games, so this works well. YMMV.
Maybe there are more rules that I can't remember right now, but the combination of not knowing her passwords + password manager + not trusting email + unable to run unknown binaries + adblock has worked wonderfully.
Let me know if you have more suggestions