|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
October is National Cyber Security awareness month and I’m going to post every day this month on something that will make you think or take some actio
[See the full post at: Patch Lady – 31 days of paranoia – day 1]
Susan Bradley Patch Lady/Prudent patcher
Thanks Susan.
Those things should be pretty obvious by now, but I dare say plenty are ignorant of them or else choose to ignore them.
One additional point, which perhaps I should qualify by limiting it to the UK – and others can say whether it applies elsewhere or not:-
Avoid internet or telephone banking. Use your local bank branch in order both to keep it open (because you will miss it when it’s gone and it will go if people don’t use it) and to avoid the risks associated with remote banking. Whenever possible use human beings in the branch rather than machines – for the same reasons.
No matter that you could gain an extra 0.1% return on online savings/pensions accounts, for example, is it really worth risking what is likely to be for you a life-changing investment on the security of online data? But it’s stored on the Cloud – oh, so that’s alright then! Seriously, think twice before entrusting all your money to the internet!
Again for the UK readers – if you own your own home then seriously consider registering with the HM Land Registry Property Alert Activity Update service – which means that whenever anyone makes an enquiry about the Title to your home you will be notified. If nobody makes an enquiry then you’ll receive 6 monthly notifications to that effect.
Again for the UK readers – if you own your own home then seriously consider registering with the HM Land Registry Property Alert Activity Update service – which means that whenever anyone makes an enquiry about the Title to your home you will be notified. If nobody makes an enquiry then you’ll receive 6 monthly notifications to that effect.
Here in the USA my town has “Property Check” — you register and whenever anyone tries to mess with your property be it checking it or trying to change your ownership — I get an alert. If this is available to you I highly recommend it.
They left off one very important thing: SOCIAL MEDIA!
Here are some tips for protecting your identity on social media:
* BE VERY CAREFUL HOW MUCH PERSONAL INFORMATION YOU POST ON SOCIAL MEDIA! I’ve seen people put their phone numbers in an open post! If you need to give someone your phone number, send it to them in a private message.
* I heard about someone one time putting their CREDIT CARD NUMBER in an open post! If I have to tell you not to do that, then you probably should stay entirely off of social media for your own good.
* Lock down your Facebook settings so that they are more secure than the default; and check them now and then, to make sure that Facebook hasn’t changed anything requiring you to lock down yet another setting.
* Remember: Anything you post to PUBLIC on Facebook can be seen by anyone, not just your friends.
For security questions where a public search could reveal the answers, I will put in fake info, or slightly alter the true info. My bank has questions which would not normally be public, but which don’t apply to the lifestyle I lead. So I am free to make up answers odd enough to be hard to guess, but plausible enough to pass muster, and yet untrue in any event. So not searchable.
I don’t agree in the US that online banking will kill off our local branch offices. I just went in to my local branch office to deposit some quarters (a LOT of quarters!), and that’s also where the ATM is for some of my shopping trips. But if I need to pull out a bunch of transactions for Social Security reporting, the online Ledger and Transactions with Categories (assigned by me) simply can’t be equalled, even with paper bank statements. So online banking for me has some uses not offered by other methods. And if there is a credit card refusal for security reasons, phone banking is the only way to resolve it, either by authorizing the purchase, or by confirming I attempted the purchase but not going through with it.
One way this happens is if an online retailer fails to disclose in advance of checkout that their billing is from a foreign office or warehouse location. It happens more often than you might think, and foreign currency conversion and extra banking fees can result. (One well-known third party antivirus company is notorious for this practice. Even Fastmail bills from Australia, but if you choose Paypal, you can avoid the fees.) Caveat Emptor!
I do use Nextdoor.com for online communications with people from my community, and I am amazed at what personal info people will post, when they think they are posting just to their immediate neighbors. Addresses, phone numbers, you name it, they’ll post away with total abandon. There is a reason that the site provides for Private Messaging, folks!
Password and account recovery should use codes and/or permanent dongles like FIDO2 or Yubikey. Biometrics can be spoofed, so they are not the answer. Google is heading more and more in the dongle direction, and Microsoft recommends the code-based account recovery method. I think Apple also favors code-based, not question-based account recovery. Yahoo is… well, Yahoo. (But let’s face it, using a phone as an intermediary is not secure.) I wonder when Facebook, Instagram and Twitter will start using more secure methods. Maybe after the next data breach… oops, that just happened.
Times change, and so should our methods of securing our accounts and our information. If you want to beat increasingly automated hacking, you have to be able to think and act more like a machine. Start getting cozy with dongles and recovery codes. They are here to stay. And save your DNA for important things like proving your identity if you lose the dongle. Stop tossing it off on genealogy sites and other public databases.
-- rc primak
One of the creepiest things I have seen in a long time is a bank branch which has no actual tellers present; they are all at an undisclosed location (maybe at the main branch?); and all teller-related business is done via two-way TVs (like some drive-up windows). I no longer have an account at that bank; and if I did, I likely would close my account there and find another bank.
Yeah, I know; I am dealing with an actual person, just not someone who is right there with me. My current bank has actual tellers and does not even have bullet-proof glass separating me from the teller. I live in a small town, and it is really nice to deal face to face with a real person.
For the record I also live in a small town and both of these branches are “small town” branches although the bank itself is a large and well known one… I won’t mention the bank’s name but it’s likely most folks in the US are familiar with it.
The worst part of these closings is both of these branches were/are the only bank in town leaving people that don’t do banking online no choice other than traveling at least 10-15 miles to the next closest branch or other bank. Since I’ve been using this particular branch for over 20 years now on a regular basis I know many of the folks I see in there by name, and quite a few of them are seniors that don’t even own a computer and some of them walk to the bank because they don’t have transportation.
What are these seniors with no computers or transportation in this rural area going to do after this branch closes?
Why do your security questions have to be “plausible enough to pass muster”?
Who was my 3rd grade teacher? I honestly can’t remember, but the company that handles my flex-spending account thinks it was nTAblfF85f (not actually that but whatever my password manager came up with as random 10 character string to fill out for 3rd grade teacher).
This is exactly the way to treat passwords, non relative to the question. The more cryptic the better with use of lowercase/ uppercase /numbers /symbols as any password.
” if there is a credit card refusal for security reasons, phone banking is the only way to resolve it”
I agree. That’s how I would resolve any such issue too, but when referring to the desirability of avoiding phone banking I was talking about accounts that are routinely managed only over the phone.
Local bank branches may operate differently in the US compared to the UK, and I believe you have a lot more purely local banks in the US. In the UK the banking sector consists of a handful of national/global banks and they are currently closing local branches and ATMs on a massive scale, hence the need to do everything possible to keep them open if you use them.
Incidentally, I only use ATMs that are sited inside a bank, be it my own or a different one. They can still be compromised if the whole computer system is hacked but cannot have skimmers attached to them unlike unsupervised ATMs outside in the street.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
