What a beautiful fall we have been having - the weather and the colors have been spectacular! Apart from the shorter days, this is really the best time of year!

The SOTM for November details a sneaky way scammers can take control of your phone number. Next, I believe it's finally time to stop using any AOL/Yahoo/Verizon email addresses. And lastly, my thoughts about Apple's new MacOS, Ventura.

I hope you all have a wonderful Thanksgiving!

Regards,

Julie Marto

508-359-8176
508-333-8176 (cell)

P.S. A balky system can mean a failing hard drive. Don't lose your data - drop it off with me for diagnosis and repair!
SOTM: Google Voice Verification Code
I see so many scam and hack attempts that I have added a feature to my newsletter called Scam of the Month. In these articles, I hope to explain common scams, how to avoid them, and what to do if you fall for one.

A new scam has become commonplace on selling platforms like Facebook Marketplace and Craig's List - an attempt to steal your phone number by tricking you into sharing a Google Voice verification code.
What is it - Google offers a very popular VOIP service called Google Voice, which lets its users forward phone calls and texts to multiple devices. This service is free for US phone numbers, and it can be configured to work with existing lines. Because of that, scammers are attempting to co-opt legitimate phone numbers and connect them to Google Voice accounts that they control.

How it works - You place an ad to sell an item on Facebook Marketplace or Craig's List. A potential buyer says they are interested in your item, but they want to communicate via text, rather than through Facebook Messenger or email. If you agree, and move the conversation to your phone, they now know your name and your cell phone number. Then they will create a pretext for you to repeat a code to them, telling you that it is to prove you are not a scammer. Sure enough, a code comes through via text on your phone, and they ask you to repeat that code to them. Regardless of what they have told you, the code is actually a Google Voice verification code, to confirm ownership of your phone number. If you give them the code, they can now prove to Google that they own your number, attach your phone number to their Google Voice account, and use it to make calls or receive texts.

What can they do with your phone number - Once they have access to your phone number, they can use it to change passwords on any accounts that rely on your phone for two factor authentication. They can also use your number to call banks or other financial institutions, pretending to be you, and try to initiate wire transfers of funds. They can even use it to commit crimes that will then be linked to your phone number, and can be traced back to you!

How to avoid this scam - Be VERY wary if someone wants to move a conversation off the platform where it starts and onto your cell phone. And, even if you decide the person is trustworthy, never repeat a texted security code to anybody!

What to do if you have fallen for this scam - Google actually has a system in place to reclaim stolen Google Voice numbers, and you should initiate that process as soon as possible. Once you have control of your phone number back, you should change the password on any accounts that send texts to your phone for verification.

Special note - In the course of setting up or repairing your system, I will sometimes make a telephone appointment to log into accounts with you, and ask you to tell me texted security codes. Please remember that is a major exception to what should be a hard and fast rule. Except in that sort of special instance, if you get a texted security code and it says not to give that code out to anybody - DON'T give that code out to anybody!
Time to Move On From AOL (and Yahoo, and Verizon)
There are many of you who are still using AOL and Yahoo for email, either through longstanding AOL or Yahoo email accounts, or because Verizon migrated your email to the AOL servers. I'm often asked if it's "ok" to continue using AOL, and I have generally answered yes. Well, now my answer has changed - I think it's time to move on from using AOL, Yahoo, and Verizon email accounts.
A bit of history - as we all know, AOL was one of the original internet pioneers, branded in 1989, before most people even knew the internet existed. For millions of people in the US, AOL was their entryway to the internet, and they were by far the biggest player in the days of dial-up.

In 2001, at the height of their popularity, AOL merged with Time Warner. That merger turned out to be a disaster, and a much diminished AOL was spun off from Time Warner in 2009. AOL was acquired by Verizon in 2015, followed by Verizon's purchase of Yahoo in 2017, and together they were rebranded into a division of Verizon called Oath. At that time, Verizon got out of the email business, and migrated all existing verizon.net email addresses to AOL (some were already serviced by Yahoo for a different reason). All AOL/Yahoo users were required to agree to Oath's rather onerous terms and conditions, which clearly stated that all emails could be scanned to collect marketing data.

In May of 2021, Verizon announced the sale of Oath, rebranded Verizon Media, to Apollo Global Management, a private equity firm. So far, Apollo seems to have kept things pretty much intact, unified under the Yahoo brand. But, truthfully, I am not sure I would want a private equity firm to have access to my most important digital communications. However, that is not the biggest issue with AOL and Verizon. There are actually two other reasons why I am recommending you move on:

I see more hacked AOL and Yahoo email accounts than any other type - most people with AOL and Yahoo accounts get multiple phishing emails daily, some more convincing than others, telling them that they need to "click here" and sign into their account in order to keep their mailbox from being shut down. Because AOL and Yahoo often actually DO make changes to the way their email is accessed, and because very few AOL and Yahoo accounts are protected by two-factor authentication, there is a very good chance that the average user will fall for one of those phishing emails, and once they do, their account gets taken over by scammers.

I can usually fix the hacked email, and regain control over the stolen account, but not before your contact list is stolen, a fake "you" is made up with a lookalike email address, and your friends are approached to buy Amazon gift cards - and some of them lose money to the fraudsters.

AOL and Yahoo have broken the ability to collect email through multiple popular applications - AOL and Yahoo use a special sign in feature called Oath2 to connect your email to apps like Apple Mail and the email applications on phones. Rather than just typing your password into the application, Oauth2 opens a web browser for you to sign in. Google and Microsoft also use Oauth2, and it does help to make sign-ins more secure.

Unfortunately, the AOL and Yahoo version of Oauth2 doesn't work with many common email programs, like Microsoft Outlook, Samsung Mail, Windows Mail, or Mozilla Thunderbird. The workaround has been to use an alternative (and less secure) authentication method called an "application specific password". Starting last June, the process to generate an application specific password at AOL and Yahoo became flakey, and it stopped working altogether about 2 weeks ago. So, If you want to read your AOL, Verizon, or Yahoo mail in one of those applications, and it's not already set up, there is now no way to do it - and no ETA for if, or when, it will be fixed again.

It's actually a bit ironic - AOL and Yahoo's security is so bad that it allows hackers to gain access to accounts so easily that I see it every week, yet it doesn't allow legitimate users to pick up their email on their application of choice!

Between the privacy issues, the security issues, and the technical issues, it's just no longer a good idea to use those old email addresses as your main email. If you don't already have another email account to migrate to, I recommend creating a Gmail, Outlook, or iCloud email address. I also recommend migrating everything important to your new email address, and abandoning the old address to spam, if you are not ready to shut it down altogether. I know this is a big project, but truly, it's time to move on. Of course, if you need any help switching to a better email system, please give me a call.
MacOS Ventura
Every fall the trees change color and shed their leaves, the days grow shorter, and Apple releases a new version of MacOS. On October 24th, MacOS 13, called Ventura, was released right on schedule.

Apple has been pretty aggressive about pushing eligible systems upgrade to Ventura, so here's what you need to know:
Should you upgrade: I generally recommend people wait at least a month after the release of a new version of MacOS prior to upgrading, and Ventura is no exception. There have been a few issues with Ventura, most notably that it breaks third party security applications. I don't generally recommend the use of third party security apps for Macs, with the exception of Malwarebytes, but the fact that Ventura breaks them all is concerning, and certain to be fixed in the next release. I have also had a few calls from early upgraders with some system issues since upgrading, so I would advise holding off for a while if you can.

Can you upgrade: Timing of the upgrade aside, it's important for the security of your Mac to use a supported operating system, as Apple only issues critical security updates for the most recent three versions of MacOS. With each new version of MacOS, some older systems are no longer eligible to upgrade, and some are no longer updated at all. To check if your system can run Ventura, click on the Apple menu in the top left hand corner, and choose "About this Mac". Systems listed below can run MacOS Ventura:

  • MacBook models from 2017 or later
  • MacBook Air models from 2018 or later
  • MacBook Pro models from 2017 or later
  • Mac mini models from 2018 or later
  • iMac models from 2017 or later
  • iMac Pro (all models)
  • Mac Pro models from 2019 or later
  • Mac Studio (all models)

If your system is not on the list, its usable life is officially limited. The "newest of the old" systems that can run Monterey have about 3 more years of Apple security updates left - older systems will be out of support sooner.

What's new in Ventura: The most controversial change is the redesigned system preferences, renamed system settings, which now looks and feels much more like the settings app on IOS devices. I've had my hands on it, and it's definitely very different, and will take some getting used to. The coolest new feature is called Continuity Camera, and lets you use your iPhone as a webcam. There are plenty of other new features as well, like the ability to "unsend" an email or a text message, and to seamlessly move a Facetime call from your Mac to your phone. There are also multiple security enhancements, and a lot more sharing options for photos.

How to upgrade: When you decide you are ready to upgrade to Ventura, you will need at least 25GB of available storage on your Mac - you can check free space by clicking the "storage" tab in "About this Mac". If you don't have enough storage available, give me a call and we can determine the best way to work around that issue. I cannot stress enough how important it is to make a Time Machine backup prior to upgrading your system - although most upgrades go smoothly, I sometimes have to restore systems that crashed during a MacOS upgrade, and the success of the restore is only as good as the backup.

Depending on the speed of your system, you should expect the upgrade to take between 1 and 3 hours, so keep that in mind before you set the upgrade in motion. And, of course, I'm happy to safely do the upgrade for you as a drop off service.