Post by: Gary S on March 05, 2017, 03:38:06 PM
I live in WI.
It looked like phishing to me but I thought I'd ask here.
[attachment=3369:gary_adjusted.jpg]
TIA
Edited by kimmer to modify the attachment
Post by: daryl66 on March 05, 2017, 04:01:37 PM
Daryl
Post by: Xairbusdriver on March 05, 2017, 04:03:12 PM
2. What is the actual email address for the "Gary Swiech" in the "To:" area? Hovering over it in Mail should offer a pop-up item showing the actual address. Same for the "Apple" as the sender.
3. What is the actual url connected to the "www.appleid.apple.com" link? Simple hovering the cursor over a link should display the actual url. If they don't match, delete the email after marking it as SPAM in Spamsieve. I generally don't even open emails I question. In this case, I'd just visit the Apple site.
In other words, we can't simply go on what an email looks like. We have to check a few indicators. Then we can simply take a chance on opening the message and having the sender be notified that we opened it. I'd rather check the site using my own, or known url.
Of course, I assume you already have Mail Prefs->Viewing: "Load remote content in messages" UN-checked.
Post by: kimmer on March 05, 2017, 07:36:19 PM
First, when I've logged in with a new machine, the email uses MY REAL NAME, not "Dear customer"; but most important: that link is wrong. You can verify what I'm going to share by googling, but the correct link to verify your apple id is:
https://appleid.apple.com
Notice the HTTPS at the beginning, not WWW—and that shows in the email from apple, I've never needed to hover over it to verify it (although that's a good idea).
Check this at google: https://www.google.com/search?client=safari...-8&oe=UTF-8
Lastly, I edited the attachment in your original post and removed your email address.
QUOTE(Gary S @ Mar 5 2017, 01:38 PM) <{POST_SNAPBACK}>
Does this e-mail from Apple look legitimate?
I live in WI.
It looked like phishing to me but I thought I'd ask here.
I live in WI.
It looked like phishing to me but I thought I'd ask here.
Post by: kimmer on March 05, 2017, 09:19:44 PM
[attachment=3370:apple_email.jpg]
Post by: Xairbusdriver on March 05, 2017, 09:40:51 PM
1. NEVER EVER CLICK ANY LINK until you've verified it.
2. See rule #1.
Standard operations:
1. Don't try to remember what a "legit" email looks like. Every company/site can have a different style. Just apply the above rules.
2. Keep remote content hidden. Even an "invisible", one pixel image can be inside any email. When your email app downloads it, you're sending a message to the sender that you are not only real, but that you will open all emails. The next one you get may be really bad.
3. Don't do business with anyone who calls you "Customer".
4. Question everything (except your spouse). Especially emails, even if it claims to be from your spouse!
5. Consider disabling HTML email, if you can.
6. Always apply the rules about emails.
Post by: Gary S on March 06, 2017, 11:12:04 AM
kimmer,
When I go to (https://appleid.apple.com), and log-in with my email address and password and the screen changes to the 6 box code, what do I do? Do I make up my own 6 letter/number code? Because I was never assigned one by Apple.
Post by: Paddy on March 06, 2017, 01:10:17 PM
QUOTE(Gary S @ Mar 6 2017, 01:12 PM) <{POST_SNAPBACK}>
First of all thanks to all. I did delete it.
kimmer,
When I go to (https://appleid.apple.com), and log-in with my email address and password and the screen changes to the 6 box code, what do I do? Do I make up my own 6 letter/number code? Because I was never assigned one by Apple.
kimmer,
When I go to (https://appleid.apple.com), and log-in with my email address and password and the screen changes to the 6 box code, what do I do? Do I make up my own 6 letter/number code? Because I was never assigned one by Apple.
Gary, that's two-factor authentication - you should have received a 6 digit code on your cell phone to use to login. It's not a permanent code - it changes and you have to have access to your cell phone to see what the code is when you sign in. You must have enabled two factor-authentication at some point.
Post by: Paddy on March 06, 2017, 01:17:17 PM
Read on:
https://thenextweb.com/apple/2014/12/08/los...W#.tnw_bnsPGzJE
Post by: kimmer on March 06, 2017, 02:43:58 PM
I don't recall being given a recovery key, and I sure don't have a copy. I've gone through 1Password (which is where I would store this information); plus I've searched my hard drive and checked the folder I have with printed paper of a few things (nothing major or I wouldn't have printed it out). I have no recovery key. None. Nada. Zip. Zilch. 
Since my acct hasn't been hacked, is it possible to follow that link and get a new recovery key? I'm unclear on this. If it is, I'll do it asap. Otherwise, I'll wait until (may it never happen) someone tries to hack my acct, and then start over. What a mess.
QUOTE(Paddy @ Mar 6 2017, 11:17 AM) <{POST_SNAPBACK}>
And not to terrify anyone or anything...but if you do select two-factor authentication with Apple, make SURE that you keep your Recovery Key in a very safe place (1Password would be a good start).
Read on:
https://thenextweb.com/apple/2014/12/08/los...W#.tnw_bnsPGzJE
Read on:
https://thenextweb.com/apple/2014/12/08/los...W#.tnw_bnsPGzJE
Post by: Xairbusdriver on March 06, 2017, 03:03:41 PM
I turned the system off after getting tired of the delays caused by it. It is difficult to confirm a code when the device you get it on is not with you. DOH! There were too many times when I did not have my iPhone with me. So I through the baby out...
I prefer the way 1Password uses authentication when the app updates. But that is rare, easy and 'just works'. What a concept!
Post by: Paddy on March 06, 2017, 06:03:00 PM
Here's how to do it:
http://osxdaily.com/2016/08/17/disable-two...ation-apple-id/
This unfortunately doesn't help Gary if he has to enter the authentication code to disable the darn thing; although if the authentication code IS sent to a cell phone, then it should be available.
Post by: kimmer on March 06, 2017, 07:13:48 PM
QUOTE(Paddy @ Mar 6 2017, 04:03 PM) <{POST_SNAPBACK}>
Kimmer, I'd recommend turning it OFF if you have it on and have no idea where the recovery key is. I never turned it on - too much hassle, as Jim notes.
It is a hassle, and it's now off. Thanks.
Post by: Xairbusdriver on March 06, 2017, 09:31:08 PM
A couple of weeks ago, I miss placed my iPhone. Unfortunately, I had not yet turned the speaker back on after awaking that morning. Also a bit unfortunate, Find my iDevice is only accurate to a house-sized area and I was pretty sure I had not left the house yet...
Fortunately, decided to see if there was any hope with that service. As a matter of fact, if your ears are good enough, you can even find your phone when it's outside and you are not!
it was even easier for me since I knew it was in the house somewhere! It just so happens that Find my iDevice can make it deliver a rather loud and shril sound, even with the sound switch off!!! I didn't know that!Just one important reason to have that Apple ID and password!
I've been out of town all day and using the iPhone with a search engine is not fun. I will attempt to a certain what problems will ensue if one gets a new Apple ID. I assume all purchases with the old one will be considered null & void?! Would emailed receipts help? Can I find the few I might still have?!
Post by: Gary S on March 07, 2017, 11:28:24 AM
Paddy, I found my 6 number code.
I also found this in my drafts folder in Mail: please pay attention to the last paragraph.
[attachment=3371:Apple_2_...ion_code.jpg]
And my 1Password says I have the 2 step also.
[attachment=3373:Apple_iPassword02.jpg]
I would like to go back to just one step code, my email address.
Do you think I should go to the link to deactivate the 2 step, given the fact that
the 6 number code is from November, 2011?
Post by: Gary S on March 07, 2017, 02:13:50 PM
Post by: Paddy on March 08, 2017, 11:57:13 AM
QUOTE(Gary S @ Mar 7 2017, 04:13 PM) <{POST_SNAPBACK}>
It was too much of a hassle to change to a one step code so I'm sticking with the 2-step code.
Well, don't lose that 6 digit verification code!
I'm glad I never turned it on.
Post by: Gary S on March 08, 2017, 02:48:55 PM
to you too smarty pants. I couldn't even sign into the cloud on my new iPad last night.
To switch over to the one step code, I need another email address and I don't want to get another e-mail address from Charter or Yahoo. Have any suggestions?
Post by: Xairbusdriver on March 08, 2017, 03:01:37 PM
Of course, here's always gMail which rank right up there with Hotmail.
Personally, Google collects enough on me without having a "free" account with them.
Post by: Gary S on March 09, 2017, 08:00:39 AM
QUOTE
Personally, Google collects enough on me without having a "free" account with them.
I hear you Jim.
Post by: Paddy on March 10, 2017, 03:12:38 PM
Zoho is another freebie alternative: http://zoho.com - lots of options
And then there is Outlook - https://www.microsoft.com/en-us/outlook-com/?cb=v8ho - formerly known as Hotmail, (but without the automatic association with throwaway/spam) - you can get an email addy there and then use it in Apple Mail.
https://computers.tutsplus.com/tutorials/ho...look--mac-54038 - not sure if this is still correct as it's from 2013 and it's possible the default is now IMAP. You'd have to try it to see.
Other than Gmail, those are the most reliable ones I'm aware of.
Post by: Xairbusdriver on March 11, 2017, 09:49:26 AM
The "related" part is in the comment at the end of the linked article:
QUOTE
Matthew Ravden, a vice president at security systems specialist Balabit, told IT Pro that: “Assuming these revelations are true..., it’s probably fairly shocking to the general public to see the lengths [an] ... organization will go to find ways of ‘listening in,’ through TVs, smart-phones or other ‘connected’ devices.”
“For those of us in the security industry, however, none of this is particularly surprising,” Ravdin continued. “The resources available to the CIA, (British) MI5, or the (Russian) FSB are such that they can do pretty much anything; they live by a different set of rules from the rest of us.”
“For those of us in the security industry, however, none of this is particularly surprising,” Ravdin continued. “The resources available to the CIA, (British) MI5, or the (Russian) FSB are such that they can do pretty much anything; they live by a different set of rules from the rest of us.”
My real point is not that our data is 'vulnerable' but that we provide much of it by using the enterweb so casually, and even naively. We are often lulled into a totally incorrect notion that we are only conversing without any 'middleman'. Would we be as casual if we communicated via a physical bulletin board on the corner of some street?
While "government" listening should be a concern, we should constantly be aware that what we say, show or do on the web is likely very public. Resist the urge to think nobody else will see what you do or say. Just behave like your mother (hopefully!) told you!
Post by: gunug on March 13, 2017, 10:02:43 AM
Post by: Xairbusdriver on April 01, 2017, 06:46:58 PM
I turned Apple's "two-factor" (the name has changed a couple of times) a year ago or so. I don't remember having any problems. I also don't remember needing the 16 digit "Recovery Code" I have stored in 1Password. I could be rong, houevur.
First: I found a <couple> of <articles> from suspiciously on the same date in 2015 that indicate that "Recovery code" may not actually be needed or even used since El Capitan (OS X 10.11?).
Second: The six-digit code mentioned above is not the same as the "Recovery code". It's simply a unique code that is sent to all your trusted and registered Apple devices. They have to be unlocked, however, to be received. If you forgot to unlock any of your devices, you can go do that and then use the "Resend a code" link on the AppleId web site. You could also have selected text messaging to a non-Apple device for that code, but I think that is a security risk in itself. "Texts" are in no way secure.