all 8 comments

sorted by: hot top controversial new old
[–] 7 points 9 months ago (3 children)
  • [–] 3 points 9 months ago (2 children)

    This coverage was written and reviewed manually, based on verified reporting and primary security research rather than automated breach aggregation.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 9 months ago* (2 children)

    If you have a hardware security passkey like Yubikey as the only way to access the account and NO recovery phone or email, ONLY just backup codes secured locally, I feel like this wouldn’t be an issue anyways. I recently had someone try to use my old but still lightly active gmail to order Chipotle. I knew they couldn’t have access to my email though because only I have the Yubikey passkeys to get in.

  • source
  • hideshow 2 child comments
  • [–] 2 points 9 months ago (1 child)

    Be honest, how many people own a hardware key, let alone use it properly. Meaning it be the only 2FA method on your account.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 9 months ago

    All the bullshit they do to get our personal information for commercial reasons under the pretext of keeping our accounts safe, and they let this stuff get stolen left and right.

    Most places in the country they don't have to tell you if your information was stolen either. Only california last I checked, so they usually tell everyone if they have to tell californians or else they would look worse. But without that law they wouldn't tell us if they thought we wouldn't find out.

    I got a new email that doesn't force me to link phone or other email and verify now. Fuck google, fuck aol, yahoo, and the rest. Big tech is past the growth phase and into maximizing revenue, only the growth companies treat you well, find one of them.

  • source
  • 35 comments in c/world@lemmy.world view that post
    [–] 35 points 9 months ago (9 children)
  • [–] 21 points 9 months ago (8 children)

    Hey want to play a game? Your bank is gonna text you a number, and I'm going to guess it. Tell me if my guesses need to be higher or lower.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 12 points 9 months ago (7 children)

    This is why you never enable SMS based MFA. TOTP is well established and just works. If you need even more security FIDO2 devices like YubiKey are a thing.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 22 points 9 months ago (4 children)

    For the love of God, someone inform Citibank and Chase of this. My dinky little local credit union allows me to use TOTP, but Citi and Chase still only seem to support SMS.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 10 points 9 months ago (3 children)

    Chase supports push notifications via their app now, so at least they're moving forward toward something a bit more secure. But yes, I'm so pissed that so many banks use SMS when it's known to be easily spoofed.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 9 months ago (2 children)

    Requiring the use of their own app is only marginally better than not supporting it at all. I try to minimize the number of apps pn my phone, and banking apps are prime examples of a use case that can be completely fulfilled in a browser. Even if I used the app, I would prefer to be prompted for non-biomotric MFA each time I sign in anyway.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 9 months ago

    Yeah I can respect that, I have one bank where the only account I have there is a credit card now that I paid off my loan. Their app is terrible and half the time it doesn't load on my home network because of all my ad and tracking blocking on my DNS server. I just want to check balances, you assholes. So yeah that one is strictly browser only for me.

  • source
  • parent
  • [–] 0 points 9 months ago

    Check the permissions on their app:

    Google allows any app with the "Contacts" permission to upload all your text-conversations to their server, according to the ToS thing I read on Google.com sometime ago..

    Apparently that page no-longer exists? or isn't findable..

    https://www.howtogeek.com/why-some-apps-ask-for-contacts-and-what-they-actually-do-with-them/

    I want machiavellianism KILLED from our economy, not allowed-to-rule-it.

    Not going to happen in my lifetime, obviously..

    _ /\ _

  • source
  • parent
  • [–] 25 points 9 months ago (1 child)

    It would be nice if that was a choice but SMS is unavoidable.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 9 months ago*

    It is avoidable. On this side of the world the only companies and sites that use sms mfa are american companies that are clearly not european based or focused.

    Last and only site i would only do sms mfa was gofundme, and they banned me because of fake information so go figure

  • source
  • parent
  • [–] 27 points 9 months ago (7 children)

    hellnuh, that your own website you keep posting?

  • source
  • hideshow 7 child comments
  • [–] 17 points 9 months ago (5 children)
  • [–] 13 points 9 months ago (4 children)

    Check Op's username and the community it mods, and you'll know what I mean.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 6 points 9 months ago (3 children)

    I seem to be missing some context. Now, after seeing another post with a link there, I know this probably is not some one-time scam site. But then, if you had the info that domain matches the name of their community, WDYM?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 9 months ago (2 children)
  • [–] 2 points 9 months ago* (1 child)

    hellnuh, that your own website you keep posting?

    Check Op’s username and the community it mods, and you’ll know what I mean.

    I checked and I don't get it

    Your point is only asking if that's their page?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 9 months ago*

    Your point is only asking if that's their page?

    Yes, that was my question to him. I was hoping he reacted. But then you did react me saying

    Yeah, address looks sus af.

    So I thought you got it. So I said: check the username ..

    So yes it IS their own webpage. According to rule 1 , posts need to be news articles, not this. He's been posting daily. Self promotion is also a no go.

    So I'm not sure you are missing something.

  • source
  • parent
  • [–] 10 points 9 months ago

    It is, but it doesn’t seem nefarious. Just somebody trying to carve out a little corner to help individuals find some tools to get away from Google and such. Maybe they make money via some affiliate links, but is that a bad thing?

  • source
  • parent
  • [–] 69 points 9 months ago (5 children)

    Are we sure someone just didn't ask Gemini for 48 million Gmail credentials and immediately get them?

    I'm holding a grudge because I was arranging a Craiglist sale and when I sent the buyer my phone number to text my account was suddenly disabled for "unusual activity" signing me out of everything. I was able to re-enable it right away, but I'm pretty sure whatever AI-trash system is in place to monitor accounts did it.

  • source
  • hideshow 5 child comments
  • [–] 25 points 9 months ago (4 children)

    Are we sure someone just didn’t ask Gemini for 48 million Gmail credentials and immediately get them?

    It looks like they come from infostealers:

  • source
  • parent
  • hideshow 4 child comments
  • [–] 12 points 9 months ago (1 child)
  • [–] 12 points 9 months ago

    Analysis indicates the data was aggregated over time from multiple sources, including malware infections, phishing campaigns, and older third-party breaches. There is no indication of a direct compromise of Google’s internal infrastructure.

    Everything is vulnerable to that, including proton.

  • source
  • parent
  • [–] 8 points 9 months ago (1 child)

    That ai banner does not inspire trust at all :( The actual content reads well & they link other articles though. Weird.

  • source
  • hideshow 1 child comment
  • [–] 5 points 9 months ago (1 child)

    I got almost that many Gmail addresses from trying to game Reddit's permabans. They really got it in for me over there, just because I took their commitment to free speech seriously. Turns out they were just kidding.

  • source
  • hideshow 1 child comment
  • [–] 3 points 9 months ago (1 child)

    google stores passwords unhashed ???

  • source
  • hideshow 1 child comment
  • [–] 1 point 9 months ago (2 children)

    Start setting up passkeys where available, that is the safest and easiest way, I store mine on my selfhosted vaultwarden but you could use other ways. As long as the devices you use are secure, no passwd leaks, spoofing attempts or phishing can threaten you.

  • source
  • hideshow 2 child comments