An Amazon scam

[garys]

Never keep your passwords on your computer or on any other device. If the hackers can get into your computer, they can get into your password manager and get all your passwords, and using a manager, you left them with a treasure box to get everything they need. NOTHING is safe on a computer, and leaving your passwords on it with a password manager is just giving them the key to the store.

[RFGuy]

Heads up, everyone!!! Got an email from Amazon telling me that, at my request, my email id had been changed in their system and they provided me with the new address. I had not requested any changes and the "new address" was totally unfamiliar. I immediately called Amazon. They had to cancel my account and my Amazon Prime Rewards CC. They said that if the scammer was able to get into my Amazon account to change my email, that they had my CC info, also. 

Be watchful, guys.

Gene,

Sorry this happened to you. I am surprised that Amazon had you cancel your Prime account. I would think they could authenticate that you are who you say you are, they could then reset your account password with them and they could delete your CC info until you could enter a new uncompromised CC to put on your account. Anyway, wishing you the best on getting this sorted out.

For anyone interested, I have found the website below to be useful in checking whether any of my account passwords are possibly compromised. There have been multiple companies with data breaches the past few years unfortunately. This website lets you check if they have any record of your account details (including password) being divulged through one of these breaches.

https://haveibeenpwned.com/

[Gene Howe]

Amazon suggested cancellation of the card due to the possibility that it could be used elsewhere. Visa put a block on it immediately as they detected suspicious activity.
I will reactivate the Amazon account today and a new Prime Rewards card will be here mid week next. Still have a few p/ws to change. But, got all the ones done that we have financial dealings with. By the end of next week, we should be back in business.

[RFGuy]

Amazon suggested cancellation of the card due to the possibility that it could be used elsewhere. Visa put a block on it immediately as they detected suspicious activity.
I will reactivate the Amazon account today and a new Prime Rewards card will be here mid week next. Still have a few p/ws to change. But, got all the ones done that we have financial dealings with. By the end of next week, we should be back in business.

Thanks. Maybe I misunderstood before. Yeah, I just didn't see why your Prime account had to be cancelled. I understand you would have to cancel CC's and change PW's which is enough of a pain in the butt. Hopefully once this is done, you won't have any more problems with this. I have had a few CC's get compromised in the past, but never had identity theft myself. Some of my friends have had identity theft and have had nightmare experiences with it.

[john_001]

Never keep your passwords on your computer or on any other device. If the hackers can get into your computer, they can get into your password manager and get all your passwords

How? With a few weeks on a supercomputer? The PWs are encrypted. I'm not sure about other PW managers, but Roboform encrypts your PWs with AES-256 bit encryption with PBKDF2 and SHA256 on your own machine, and uses your own master PW as the encryption key for the file. The decryption is done on your local machine on the fly when the PW is submitted. Unless someone has your master PW, which is never transmitted online or leaves your local machine (unless someone has installed a keystroke logger, which is a whole 'nother security issue), even Roboform can't recover your passwords, since they never see your master PW. They warn you that if you ever lose your master PW, they can't help you.

BTW, you can set up separate profiles with separate master PWs if you have kids and only want to give them access to selected PWs.

[JPG]

I 'think' that using a program(I hate the "AP" 'word') to 'manage' thy passwords on the computer with which they are used is sorta like placing your locks in one basket along with the keys to open them.

For sure the program can be created so as to make 'discovery' of unencrypted passwords extremely difficult(especially if thee forgets thy 'master' password).

Does not the use of a master password amount to almost the same thing as only having one password(ya I realize it depends upon the point of view).

In my humble view it is far more relevant to simply not put stuff where it can be accessed by nefarious entities. Yes that is getting more difficult these days. Problem is all that stuff while convenient to thee is also a target of opportunity for them.

[john_001]

For sure the program can be created so as to make 'discovery' of unencrypted passwords extremely difficult(especially if thee forgets thy 'master' password).

In Roboform, if you forget the master password, you've lost everything and have to rebuild your password file. Roboform can't help you, since the master password itself is merely a decryption key and isn't stored anywhere. It can't be stolen by breaking into your computer, because it isn't on your computer. The chance of decrypting the PW file with a reasonable strong master key is virtually zero without knowing the key. Even the NSA uses AES-256.

[JPG]

I assume that the 'key' is used both to encrypt them to begin with and must be provided by 'user' to decrypt them as well. Key is only stored by the user either 'internally'(personal memory) or elsewhere.

So instead of a 'basket' the passwords are in a lock box with the master key being necessary to access them.

[jsburger]

Never keep your passwords on your computer or on any other device. If the hackers can get into your computer, they can get into your password manager and get all your passwords

How? With a few weeks on a supercomputer? The PWs are encrypted. I'm not sure about other PW managers, but Roboform encrypts your PWs with AES-256 bit encryption with PBKDF2 and SHA256 on your own machine, and uses your own master PW as the encryption key for the file. The decryption is done on your local machine on the fly when the PW is submitted. Unless someone has your master PW, which is never transmitted online or leaves your local machine (unless someone has installed a keystroke logger, which is a whole 'nother security issue), even Roboform can't recover your passwords, since they never see your master PW. They warn you that if you ever lose your master PW, they can't help you.

BTW, you can set up separate profiles with separate master PWs if you have kids and only want to give them access to selected PWs.

I have been using the licensed version of Roboform since Jan 2011. It has always worked flawlessly. It is also constantly being updated and improved. I have a 3 computer license.