SECURITY: SMS is not a good 2FA (Second Factor Authentication)

Saturday, May 10, 2025

https://www.makeuseof.com/security-apps-protect-your-data/?utm_medium=newsletter&utm_campaign=MUO-202505090800&utm_source=MUO-NL&user=cmVpbmtlZmpAZ21haWwuY29t&lctg=7e6c3cd411d6a815afa18582d54bd455914c43c5f69df1448b8ec20ee4959f71

Install These 5 Security Apps Now to Protect Your Data
Jowi Morales

<< EDITOR ADDED DATE 2025-05-07>>

*** begin quote ***

Authenticator

Usernames and passwords are no longer as secure as you might think; that’s why you should switch to two-factor authentication (2FA)to help secure your online access. You can easily set this up on most accounts, including your accounts on Google, Meta, and more, ensuring that any potential hacker who has compromised your username and password combination still needs a one-time password to gain access.

However, we don’t recommend using SMS for your 2FA code because of its many disadvantages. For example, if you’ve been specifically targeted by personal identity thieves, they can trick your mobile provider into transferring your number to a SIM card that they have (called SIM swap), meaning they will receive your OTP codes on their device. Furthermore, SMS messages can be intercepted, meaning someone targeting you can easily steal your OTPs even if you did not lose access to your SIM card. And if you lose your phone signal (or your service provider runs into problems), you won’t get your codes and will be unable to access your accounts.

*** end quote ***

Personally, I use Google Authenticator. But I have AUTHY, LASTPASS, and BITWARDEN. Can’t say I prefer one over another, but given how stuff gets “deprecated” (i.e., abandoned), I’m ready to switch.

I have a running debate with my bank about their use of SMS.  So far, I’m losing but I’m still nagging.

Argh!

—30—

Leave a Comment » | SECURITY | Tagged: , , | Permalink
Posted by reinkefj

SECURITY: Don’t just take your power from any source?

Wednesday, April 30, 2025

https://arstechnica.com/security/2025/04/ios-and-android-juice-jacking-defenses-have-been-trivial-to-bypass-for-years/

SON OF JUICE JACKING ARISES

  • iOS and Android juice jacking defenses have been trivial to bypass for years
  • New ChoiceJacking attack allows malicious chargers to steal data from phones.

Dan Goodin – Apr 28, 2025 7:00 AM 

*** begin quote ***

Word that juice-jacking-style attacks are once again possible on some Android devices and out-of-date iPhones is likely to breathe new life into the constant warnings from federal authorities, tech pundits, news outlets, and local and state government agencies that phone users should steer clear of public charging stations.

As I reported in 2023, these warnings are mostly scaremongering, and the advent of ChoiceJacking does little to change that, given that there are no documented cases of such attacks in the wild. That said, people using Android devices that don’t support Google’s new authentication requirement may want to refrain from public charging.

*** end quote ***

This reinforces my personal preference for having an external battery for recharge.  All my cars and my EDC pack have an ANKER power block, my own power plug, and 3 short USB-A cables.  My SOP is to not use “public ports” unless I have no other choice.  Suggest that anyone who values their security should do the same.

—30—

Leave a Comment » | SECURITY | Tagged: , , , | Permalink
Posted by reinkefj

SECURITY: may verify “authentic” accounts

Friday, April 25, 2025

https://bsky.social/about/blog/04-21-2025-verification

A New Form of Verification on Bluesky
April 21, 2025 by The Bluesky Team

*** begin quote ***

In 2023, we launched our first layer of verification: letting individuals and organizations set their domain as their username. Since then, over 270,000 accounts have linked their Bluesky username to their website. Domain handles continue to be an important part of verification on Bluesky. At the same time, we’ve heard from users that a larger visual signal would be useful in knowing which accounts are authentic.

*** and ***

During this initial phase, Bluesky is not accepting direct applications for verification. As this feature stabilizes, we’ll launch a request form for notable and authentic accounts interested in becoming verified or becoming trusted verifiers.

*** end quote ***

Interesting that they MAY verify real people. 

With or without a “subscription”?

Often thought that ISPs if they wanted could tie a User’s identity to the credit card they pay with.  Also, they COULD, but don’t allow such an identity to create sub accounts for children and young adults.  

Wouldn’t this cut down on the number and kind of bots that spam the inet with trash?

Seems so simple to me.

Argh!

—30—

Leave a Comment » | SECURITY | Tagged: , | Permalink
Posted by reinkefj

SECURITY: Time to end credit card number and social security numbers

Tuesday, February 18, 2025

https:///174085/cyber-crime/google-tag-manager-gtm-e-skimmer-software-in-magento.html

https://securityaffairs.com/

Crooks use Google Tag Manager skimmer to steal credit card data from a Magento-based e-stores

Pierluigi Paganini

February 11, 2025 

*** begin quote ***

Crooks use Google Tag Manager skimmer to steal credit card data from a Magento-based e-stores

Threat actors are using Google Tag Manager (GTM) to install credit card skimmer malware on Magento-based e-stores, according to Sucuri researchers. The malware hides in a website’s database and steals credit card information entered during the checkout process, sending it to the attackers’ server. This sophisticated attack demonstrates how criminals are using legitimate platforms like GTM to deploy malicious code that is difficult to detect. 

*** end quote ***

Isn’t it about time to retire the concept and strategy of using numbers for identification?

Social Security Numbers, credit card numbers, account numbers, or any kind of numbers are just not secure enough any more.  I even have my doubts about crypto keys used for “wallets”.

The Gooferment and Visa are the primary actors that we need to lead the change. 

Medicare transitioned from a number to an alphameric string to stop the frauds.  Why can’t social security?  

I’m not sure what should take its place but how about a secure hash of your name?

“John Q Public” could easily become “9YWJSN0BSVR3IKNV11A2HZM 8X70I24JXUA6REACFTXYD7WC436”!

Go ahead hackers guess that!

—30—

Leave a Comment » | SECURITY | Tagged: , , , | Permalink
Posted by reinkefj

SECURITY: Why doesn’t the Gooferment mandate not using SMS for 2FA?

Saturday, January 25, 2025

https://www.makeuseof.com/why-sms-2fa-insecure/?user=cmVpbmtlZmpAZ21haWwuY29t&lctg=7e6c3cd411d6a815afa18582d54bd455914c43c5f69df1448b8ec20ee4959f71

Why I Don’t Use SMS for 2FA (and What I Use Instead)
By John Awa-abuon
Published Dec 14, 2024

  •     SIM Swaps Allow Hackers to Steal Your Phone Number
  •     SMS Messages Can Be Intercepted
  •     SMS Is Tied to Your Phone Number
  •     What I Use Instead: Authenticator Apps

Two-factor authentication (2FA) adds a vital layer of security to your online accounts, but unfortunately, not all methods are created equal. Many people rely on SMS-based 2FA, assuming it’s a safe choice. Unfortunately, SMS is far from foolproof. Here’s why I’ve stopped using SMS for 2FA and what I use instead…

*** begin quote ***

What I Use Instead: Authenticator Apps

Rather than relying on SMS for 2FA, I’ve switched to 2FA authenticator apps. Apps like Google Authenticator, Microsoft Authenticator, and Authy generate time-based one-time passwords (TOTP) directly on your device, offering a much safer and more reliable alternative to SMS.

The first major advantage of authenticator apps is security. Unlike SMS, these apps generate codes locally on your phone, meaning they’re not transmitted over networks that could be intercepted or exploited. They’re also protected by additional layers of security—many apps require a passcode, fingerprint, or face scan to access the codes.

Another reason I prefer authenticator apps is their offline functionality. Since the codes are generated directly on the device, you don’t need a cellular connection to use them. Whether you’re in a remote area with no service or simply indoors with poor reception, you can still access your codes as long as you have your device.

I prefer Authy over other authenticator apps because it offers cloud backups, making it easy to recover my accounts if I lose my phone. At the same time, it secures these backups with encryption, ensuring that only I can access them. Google Authenticator is another popular choice. Both options are free, widely supported, and easy to set up.

Using an authenticator app is straightforward. Once you’ve set it up, usually by scanning a QR code provided by the website during the 2FA setup process, you simply open the app to access a code whenever you log in. The codes refresh every 30 seconds, so even if someone manages to steal one, it becomes useless almost immediately.

Two-factor authentication is essential for keeping your accounts secure, but the method you use matters. While SMS-based 2FA might seem convenient, it’s riddled with vulnerabilities—from SIM swaps to interception methods and even practical issues like poor cellular reception. These risks make SMS an unreliable safeguard for your online security.

*** end quote ***

The Gooferment politicians and bureaucrats have warned that the phone networks have been hacked.

So why not MANDATE better security.   

Seems simple to me?

—30—

Leave a Comment » | SECURITY | Tagged: , | Permalink
Posted by reinkefj

SECURITY: Got a pin for an Affirm account I don’t have?

Thursday, January 9, 2025

You have to be kidding me!  They “are aware of the issue”?  I went into full “identify theft” mode.  

“BATTLE STATIONS.  All hands report.  Stand by to fire at any available target.  Notify CIC of any intruders.  You are authorized to fire at any unidentified objects.  THIS IS NOT A DRILL.”

I was ready to trigger password reset on all financial and email accounts.

Argh!

But they “are aware of the issue”!

*** begin quote ***

Dear Fedinand,

Thank you for contacting Affirm!

I’m Alejandra from the Customer Care team, and I hope you are doing well.

If you don’t have an Affirm account, please ignore the text message that you received. We are aware of this issue and working on a fix. Be sure to not give your pin out to anyone. Do not click on any links sent referring to OTP (one-time passwords) if you did not request it.

*** end quote ***

YMMV

—30—

Leave a Comment » | SECURITY | Tagged: , , | Permalink
Posted by reinkefj

SECURITY: Do NOT use the “Go to Apple ID.” link

Wednesday, November 27, 2024

https://www.tomsguide.com/computing/online-security/new-scam-says-your-apple-id-is-suspended-watch-out-for-this-attack?lrh=20fd2805ce1d1131c95034f150bb97a3971479cbf1c94537a55e6a39cfe362aa

New scam says your Apple ID is suspended — watch out for this attack
News
By Amber Bouman
last updated 16 hours ago

  • Don’t let hackers get their hands on your Apple ID with these tips

*** begin quote ***

Another day, another attempt to steal your log in credentials – this time courtesy of a phishing email that claims to be from Apple Support. Don’t be fooled however, this isn’t from Cupertino. It’s actually an attempt to get you to click on a link so hackers can steal your login credentials and other sensitive information.

This email, like many other phishing attempts, uses look-a-like formatting and other details to make you think it’s coming from a legitimate source. This latest threat says that your Apple ID has been suspended due to unusual activity or missing or invalid information. The email looks remarkably similar to actual emails from Apple Support and contains a blue button that says “Go to Apple ID.”

*** end quote ***

It is really amazing that this <synonym for excrement> still works.

Browsers should not automatically make emails clickable.

Argh!

—30—

Leave a Comment » | SECURITY | Tagged: , , , | Permalink
Posted by reinkefj

SECURITY: Once again, a warning to “firewall” and “air gap” personal technology from your employer

Thursday, October 17, 2024

https://www.macrumors.com/2024/10/09/do-not-use-iphone-mirroring-corporate-mac/

Here’s Why You Shouldn’t Use iPhone Mirroring on a Corporate Mac

Wednesday October 9, 2024 4:31 am PDT by Tim Hardwick

*** begin quote ***

Apple’s new iPhone Mirroring feature in macOS Sequoia might seem like a convenient way to access your phone from your work computer, but security firm Sevco has uncovered a significant privacy risk that should make employees think twice before enabling this feature on company-owned Macs, at least for now.

*** and ***

When executed in a Terminal window that has been granted full disk access without setting up iPhone Mirroring, the command returns a normal list of macOS applications. But when executed in that same Terminal window after setting up iPhone Mirroring, it also returns personal iOS applications and metadata.

For employees, this means that apps they use privately could become visible to their employer’s IT department without their knowledge or consent. This could potentially reveal sensitive personal information, such as dating apps, health-related apps, or VPNs used in countries with restricted internet access.

*** end quote ***

Your employer, their network, and their tools should NEVER be used for your private purposes.  

The easiest way to ensure that separation is to maintain a strict “air gap” (i.e., strictly never connecting anything by wire, bluetooth, or network wifi to something “corporate”).  

If for no other reason than when your employer gets hit with a virus, ransomware, or some corporate security “tool”, then it would get your hardware in its grasp.

Argh!

Don’t forget that the employer can claim your hardware is suspect of having their data on it!

—30—

Leave a Comment » | SECURITY | Tagged: , , , , | Permalink
Posted by reinkefj

SECURITY: A static social security number is the flaw in EVERY financial security scheme

Saturday, October 12, 2024

https://www.theregister.com/2024/10/04/comcast_fcbs_ransomware_theft/

Cybersecurity Month
About a quarter million Comcast subscribers had their data stolen from debt collector

  • Cable giant says ransomware involved, FBCS keeps schtum

Connor Jones
Fri 4 Oct 2024 // 20:13 UTC

*** begin quote ***

Among the data types stolen were names, addresses, Social Security numbers, dates of birth, and the Comcast account numbers and ID numbers used internally at FBCS. The data pertains to those registered as customers at “around 2021.” Comcast stopped using FBCS for debt collection services in 2020.

*** end quote ***

As with ALL problems, digging down for who’s at fault, eventually end at the Gooferment.

I remember n=my original Social Security card as saying in big red font all caps “NOT FOR IDENTIFICATION PURPOSES”.

I’m sure that the tin foil hats of that era would have opposed it for either “THE MARK OF THE DEVIL” or “where is your papers please” or just the enumeration of privacy concerns.  And they, like almost all Conspiracy Theorists, would have been correct.  Look what a mess SSN has created.

At the root of the problem is the SSN.  

Fundamentally insecure!  Medicare abandoned the SSN on its own medicare cards.  Never explained but probably due to fraud.  Which still is a huge problem.

I suggest that the SSN be abandoned.  Credit cards use a 16 digit number with error correction in it and the “secret” card code on the back.  Why can’t the same be done to replace SSN.

Sure “credit reporting agencies”, banks, brokers, and all would have to retool.  

So what.

No one ever voted to approve this Universal Identifier.  

So let’s unvote it out.

Surely SCIENCE can come up with a better one.  Maybe based on our DNA, or biometric, or maybe nothing is best.

Google and Apple now have passkeys based on their device’s “biometric”.  

Even that would be better than SSN!

# – # – # – # – # 

FOOTNOTE: The word schtum means to remain silent. Specifically, it means not sharing any information, or telling anyone what you know. Schtum is most often used when referring to information that is harmful or sensitive in nature.

—30—

Leave a Comment » | SECURITY | Tagged: , , , , , , | Permalink
Posted by reinkefj

SECURITY:  YubiKeys are vulnerable to cloning attacks

Wednesday, September 4, 2024

https://tldr.tech/infosec/2024-09-04

TLDR Information Security 2024-09-04

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

YubiKeys are vulnerable to cloning attacks thanks to newly discovered side channel (3 minute read)

The YubiKey 5 hardware token for two-factor authentication has a cryptographic flaw that makes it vulnerable to cloning attacks when physically accessed by an attacker. Yubico has confirmed that all YubiKey 5 models are susceptible to cloning due to a side channel vulnerability in the Infineon microcontroller used in various authentication devices. Updating firmware on affected YubiKeys is not possible, leaving them permanently vulnerable to potential attacks.

# – # – # – # – # 

Guess that you can toss these in the trash can or trash bin!

Still think that the authenticator app of a phone is the best two factor authentication technique.

—30—

Leave a Comment » | SECURITY | Tagged: , , , , | Permalink
Posted by reinkefj

« Previous Entries
Next Entries »