Security Lapses at Vanguard, Schwab

[explanade]

Easy to lose those little RSA keys.

Phone can be tracked or even wiped, locked out when lost.

 

[mpeirce]

...since I can not see you can hack RSA key...

Nothing is fool proof...

State Department Trashed 30,000 Log-in Key Fobs After Hack - Nextgov.com

Never depend on the 100% invincibility of any solution. But do practice reasonable measures to secure your accounts.

 

[NW-Bound]

Nothing is fool proof...

State Department Trashed 30,000 Log-in Key Fobs After Hack - Nextgov.com

Never depend on the 100% invincibility of any solution. But do practice reasonable measures to secure your accounts.

The above article has this:

Whenever a threat actor uses a "rootkit," a worm that allows hackers to mask virtually all their activity, investigations become incredibly difficult, at times impossible, said Dickson, also a principal at cyber consulting firm Denim Group.​

This points to a major flaw of the OS. They made it so complicated that they could not tell what pieces of software belong and what does not. Bad, bad programmers!

 

[MRG]

Nothing is fool proof...

State Department Trashed 30,000 Log-in Key Fobs After Hack - Nextgov.com

Never depend on the 100% invincibility of any solution. But do practice reasonable measures to secure your accounts.

+1
Megacorp had to replace all theirs too. They also had a notion of a master password, don't know if it was device specific or global to their implementation. That always made me a little sceptical.

 

[eta2020]

Nothing is fool proof...

State Department Trashed 30,000 Log-in Key Fobs After Hack - Nextgov.com

Never depend on the 100% invincibility of any solution. But do practice reasonable measures to secure your accounts.

I agree but Two-factor authentication is about as secure as it gets.

You just do your best.

 

[Refresher]

If someone got into an account I would think it would be hard to get the money out and sent to the hacker. Wouldn't the broker require a letter with wire instructions and would the broker send to funds to a name other than the account holder?
May be a good idea to leave instructions that funds should never be wired unless I call and answer certain questions.

 

[KarenC]

For long passwords that are relatively easy to memorize, consider the xkcd Password Generator.


Sent from my iPhone using Early Retirement Forum

 

[Dreaming of Freedom]

Can someone recommend a good password app?

Sent from my EVO using Early Retirement Forum mobile app

 

[GTFan]

Password Safe

I use it for all of our financial stuff. Note that you absolutely MUST keep multiple backup copies of your safe (data file) on different devices because if you lose or trash your safe it's going to be a bad day. Mine creates totally random passwords with mixed case, numbers, special chars etc. so you never care what the PW is for a site, you just copy and paste it from the safe using your master safe password.

So if you lose the safe, you've lost all your passwords.

 

[Cobra9777]

I use Password Safe as well. First installed it over 10 years ago. Since then, I have no idea what any of my user IDs or passwords are, except of course the master password for the safe. I just copy/paste or drag/drop from the database to the browser. Logging on is incredibly fast. As I said before, my user IDs and passwords are randomly generated to conform to the maximum strength allowed by each login site. I also store security questions and answers and other useful data like PINs, contact names, phone numbers, and URLs.

Every time I add or change something, I immediately backup the data file and copy it to a second PC as well as my Android smartphone where I run the mobile version of Password Safe.