How to reduce criminals spying on you
2018-10-03 — 2026-07-24
Wherein the Reader Is Cautioned Against Password Recycling and Phishing Schemes, With a Notable Aside Upon Evilginx2, a Tool by Which Two-Factor Authentication Is Rendered Insufficient.
Being aware of how people try to get our confidential data and how to avoid it.
This is all very much worse now thanks to AI hacking
1 Passwords
People who recycle passwords are a danger to themselves, their loved ones, and their colleagues. Someone probably has their password, can impersonate them, and can use that to trick their friends. Password recycling wilfully spreads crime, mayhem, and confusion. Fix this problem using a password manager, which is simple and free for most normal humans.
2 General hardening of computers
Minimizing exposure to viruses, malware, and foolishness is a starting point. See various guides to that. macOS by drduh, various UK NCSC guides, e.g. ubuntu.
3 Phishing
How do people get our info? The easiest way for them is to ask us, in a clever way. This is phishing and being aware of how it works is essential because our systems are broken and this nonsense is much easier for the baddies than it should be.
What kind of idiot gets phished? Spoiler: Everyone is vulnerable to this nonsense. Being a nerd only inoculates against low-effort attacks.
Level up: see how the pros handle phishing preparedness:
Gophish is a phishing framework that makes the simulation of real-world phishing attacks dead-simple. The idea behind gophish is simple — make industry-grade phishing training available to everyone.
Evilginx is an attack framework for setting up phishing pages. Instead of serving templates of sign-in page lookalikes, Evilginx becomes a relay between the real website and the phished user. The phished user interacts with the real website, while Evilginx captures all the data being transmitted between the two parties.
Evilginx, being the man-in-the-middle, captures not only usernames and passwords, but also captures authentication tokens sent as cookies.[…]
Even if the phished user has 2FA enabled, the attacker, outfitted with just a domain and a VPS server, is able to remotely take over his/her account. It doesn’t matter if 2FA is using SMS codes, a mobile authenticator app, or recovery keys.