Change your passwords

Got the following mail yesterday, here goes....

hacker wrote:

Hey [my email adress]

Your computer was infected with my malware!

Your password for this mail: [my email password]

I am a programmer and hacked your computer 3 months ago. I kept saving information all the time, such as: browsing history, screen recordings, contacts, messages and much more.

I already wanted to forget you, but recently I saw something interesting on your desktop. I'm talking about the day you visited a porn site. I decided to record video from the webcam and desktop. Now I have a video of you masturbating yourself. You know what I mean😉

I connected to the webcam remotely, and turned off the indicator so that you would not notice anything.

I have already written down all your contacts from the address book. All contacts from friends, acquaintances, relatives. All this will be with me.

I am ready to forget about all this and completely stop accessing your computer and email. I guarantee I will not send these videos and delete all archives with them. After that I will leave and no longer bother you, but for that I want to have $500 worth of bitcoins in my wallet. You have 48 hours after reading this email. I still control your email and computer - and I know when you open them and read them.

Don't try to change your email password, everything is under control. Do not try to contact me and answer this letter. I sent it to you from your email address. Take a look at the sender, you will see that I have complete control over your email and your computer.

Bitcoin wallet address:
31rTNCD6zCXHDSiYFUrb5mV2bn1HAQ1cWR

If you do not know how to buy bitcoins, you can find information on how to buy bitcoins online. If you need help, you can read several articles about it.

https://localbitcoins.com/guides/how-to-buy-bitcoins
https://www.coinbase.com/buy-bitcoin?locale=en
https://paxful.com/how-to-buy-bitcoin

I look forward to your actions. If you don't need this data online and with all your friends, send $500 to my wallet ASAP. After that I will erase all data and disappear from your life.

Do not be offended by me. If you pay, nothing happens.

Next time update your browser before browsing the web!

Well, first of all I don't have a webcam and secondly I don't visit porn sites. So he is a liar. Did some research and found

https://haveibeenpwned.com/

By entering your email you can see if you are in the list of hacked websites and if you are the advice is to change the passwords you are using because sooner or later it's your turn. I was mentioned 4 times.

I thought it was just an innocent scam but even before the dead line of 48 hours he hacked my Facebook account and my email, both became inaccessible. He lied again. You really can't trust these guys now can you? Meanwhile both my Facebook and email are working again by changing passwords.

With apologies to Ed, the older you are, the more likely you are to use the same credentials for a lot of different purposes.

A couple of suggestions:

1. use the Chrome browser, and let it generate and save passwords for new sites you visit. The passwords it generates are highly secure in comparison to what you'd probably generate for yourself

2. Think of a memorable expression and use its initial letters (e.g. I Love The ProDeo Web Forum would become iltpdwf), then add letters for the particular website (e.g. FB for Facebook making iltpdwfFB)

No. 2 used to work really well, but now too many websites have password complexity requirements  like uppercase, lowercase, numbers and special characters. This makes using plan 2 to easily remember a large number of passwords a lot more difficult than it used to be.

I use KeePassXC to generate passwords now. Super long with Extended ASCII.  I also use different passwords for each website, and if I have the option, I use 2 Factor Authentication via Google / Microsoft Authenticator or YubiKey. Also stopped storing passwords in the web browser. Lastly I use a VPN to encrypt my traffic when going online.

My web browser of choice is Vivaldi (Chrome Based), followed by TOR for the extended or "Dark Web". What can I say I like reading the Dread .Onion website.

Oh, and I am using Kaspersky Total Security on my systems, while always keeping in mind that "Nothing Is Secure", it just best practices to make them look for easier targets.

Hell, I don't even trust my ISP. I took a spear Pi and setup a recursive DNS server using PiHole, routing all my DNS queries to it.