<html><head></head><body><div class="ydp7121e176yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div></div>
<div dir="ltr" data-setdir="false">Better was a story on this morning's television. One of the rich people on Shark Tank got taken for $400,000.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Apparently somebody spoofed an email address that looked like a legitimate business connection and asked for payment. The clerk thought it was legit, exchanged a couple of emails about the reason for the payment, etc, then sent it. <br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Only later did someone catch the breach. The bogus email address had substituted a "0" for an "O".<br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div><br></div>
</div><div id="ydp75a2a08fyahoo_quoted_3477676419" class="ydp75a2a08fyahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Thursday, February 27, 2020, 3:08:33 PM PST, Rick Moen <rick@linuxmafia.com> wrote:
</div>
<div><br></div>
<div><br></div>
<div>Regular readers can anticipate approximately what I'm going to say next:<br><br>This notion that I've been 'pwned' by Internet disclosure of a marketing<br>database listing (some subset of) name, e-mail address, telephone<br>number, street address, and 'gender' [sic -- they mean my sex]<br>presupposes that all of those things are a deep, dark secret. The<br>literature at <a href="https://haveibeenpwned.com/PwnedWebsites#Straffic " rel="nofollow" target="_blank">https://haveibeenpwned.com/PwnedWebsites#Straffic </a>implies<br>that the most alarming part of that disclosure was '49M unique email<br>addresses'.<br><br>Now, seriously, how secret do you imagine my e-mail address, street<br>address, name, etc. are? Especially given that they're plastered all<br>over what I do, and that my personal Web page has all of that plus my<br>'ICBM address' (latitude, longitude, and altitude of my living room<br>chair, stated precisely to within a metre)?<br><br>More important, most people would imagine an 'account compromise' or<br>being 'pwned' would mean 'bad guys have my account usernames and<br>plaintext passwords for one or more of important thing', but that is not<br>the case in HaveIBeenPwned.com's usage by a country mile.<br><br>Moral of the story: Read all security claims critically, especially the<br>melodramatic ones. The underlying substance is often _extremely_<br>underwhelming compared to the headline.<br><br><br>----- Forwarded message from Have I Been Pwned <<a href="mailto:noreply@haveibeenpwned.com" rel="nofollow" target="_blank">noreply@haveibeenpwned.com</a>> -----<br><br>Date: Thu, 27 Feb 2020 19:53:48 +0000 (UTC)<br>From: Have I Been Pwned <<a href="mailto:noreply@haveibeenpwned.com" rel="nofollow" target="_blank">noreply@haveibeenpwned.com</a>><br>To: <a href="mailto:rick@linuxmafia.com" rel="nofollow" target="_blank">rick@linuxmafia.com</a><br>Subject: You're one of 48,580,249 people pwned in the Straffic data breach<br><br>You signed up for notifications when your account was pwned in a data breach and unfortunately, it's happened.<br><br>You're one of 48,580,249 people who've had an account compromised in the Straffic hack of Feb 2020, the details of which you can read about here: <a href="https://haveibeenpwned.com/PwnedWebsites#Straffic" rel="nofollow" target="_blank">https://haveibeenpwned.com/PwnedWebsites#Straffic</a><br><br>The data disclosed in the breach includes: Email addresses, Genders, Names, Phone numbers, Physical addresses<br><br>Monitoring Have I Been Pwned for data breaches is a great start, now try these next 2 steps to protect all your accounts:<br><br>Step 1: Protect yourself with strong, unique passwords for each website with the 1Password password manager: <a href="https://1password.com/" rel="nofollow" target="_blank">https://1password.com/</a><br>Step 2: Enable 2 factor authentication and store the codes inside your 1Password account<br><br>You can also run a search for breaches of your email address again at any time to get a complete list of sites where your account has been compromised: <a href="https://haveibeenpwned.com/Verify/" rel="nofollow" target="_blank">https://haveibeenpwned.com/Verify/</a>[hash redacted]<br><br>Please note that it is not possible to retrieve the passwords themselves from HIBP: <a href="https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make-passwords-available-via-have-i-been-pwned/" rel="nofollow" target="_blank">https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make-passwords-available-via-have-i-been-pwned/</a><br><br>If you don't want to receive any future breach notifications, just click here to unsubscribe: <a href="https://haveibeenpwned.com/Unsubscribe/" rel="nofollow" target="_blank">https://haveibeenpwned.com/Unsubscribe/</a>[hash redacted]<br><br><br>----- End forwarded message -----<br><br>_______________________________________________<br>conspire mailing list<br><a href="mailto:conspire@linuxmafia.com" rel="nofollow" target="_blank">conspire@linuxmafia.com</a><br><a href="http://linuxmafia.com/mailman/listinfo/conspire" rel="nofollow" target="_blank">http://linuxmafia.com/mailman/listinfo/conspire</a><br></div>
</div>
</div></body></html>