Bogleheads.org

JoMoney wrote: ↑Sat Mar 25, 2023 10:27 am The article you linked doesn't say it bypassed 2FA, it speculates that "today’s breaches could be from a combination of passwords and two-factor authentication being compromised"

I speculate that the hack relies on copying and reusing an existing session cookie to bypass 2fa. It’s like when you login and you check the option to bypass 2fa.

I notice that Linus media was hacked recently using a malware attack. The hacker sent a really good fake sponsor letter that appear to come from a valid source with a pdf attachment. When they click on the pdf, it copy browser browser data. Using the session cookie they were able to bypass 2fa since Google was thinks you are already logged. To make things worse, Google allowed the hacker to change the password without entering the old password. There isn’t a lot of detail on prevention. My thought was to not use Google for password management. There are site that let you trust google login. I always use an entirely separate login. Try not to login on a public computer and if you must, do it on incognito mode so no cookies are retained. It m...

tibbitts wrote: ↑Thu Mar 23, 2023 4:35 pm I've done conversions at Fidelity but never chose to take taxes out so I wasn't aware of having to call them, sorry.

I have never done this either and wasn't aware that it was an option. Serves me right for reading the fine print .

enad wrote: ↑Fri Mar 17, 2023 12:43 am In our phone there was no ability to use WIFI for calling (as it's an app that we have to download) and we were able to turn off VoLTE calling. We upgrade our phones every 4-5 years and we're coming up on 4 years so we may upgrade a little sooner, especially with the service connection issues we've been having ever since Verizon took over Tracfone. Thanks for the heads up

I am surprised you are able to do this. I was under the impression that carriers like AT&T and Tmobile and probably other carrier cutoff their non-VOLTE phones so that if you turn off VOLTE you just have nothing. Of course, I could be misreading things. I had to upgrade my mom's phone because it was too old to support VOLTE.

I saw this recently. https://www.ghacks.net/2023/03/21/bitwardens-unlock-with-pin-feature-is-convenient-but-also-a-security-risk/ Just to summarize, you can setup bitwarden to use a pin for login. When you do so, you will have a checkbox asking if you want to enter master password on restart. If you say yes to master password on restart, you have to enter the master passworrd whenever Bitwarden starts up, so when you reboot your computer or restart your browser, you have to enter the master password at the program start and then you can use the PIN to unlock. If you however say no to enter master password on restart, you can use the PIN to unlock the vault on startup. However, this increases your vulnerability because if someone gets a hold...

I usually get the Non-OEM version. I think it might not last as long but is reasonably close and seems to last about as long. My wife's laptop is on its 3th battery. Make sure you check to make sure you get the right model and capacity. Sometimes the battery capacity is not the same.

tibbitts wrote: ↑Thu Mar 23, 2023 3:35 pm Wouldn't this be a software error, since when you use "transfer", it should only issue the warning if you ask to withhold taxes?

Not really. Reading it carefully, it's warning the user that if they chose to pay taxes from the Roth conversion, they will incurred a 10% penalty. It then does not offer an option to do this from the GUI. To do this, you must call Fidelity and do it over the phone where someone who hopefully know what they are doing (not always) will double-check to make sure you really want to do this. I feel that this is actually a good way to do it since it prevents users from accidently withholding funds for Roth conversion tax.

Recently, when I am trying to do a backdoor roth, I notice that fidelity list that I might incurred a 10% penalty. I have done roth conversion before and have never inccurred a penalty. I did some poking around

https://www.irahelp.com/slottreport/rot ... nalty-trap

My guess is that the 10% occurred if you withdraw part of it to pay for taxes as opposed to just transferring the entire amount? If you withdraw part of that for taxes, then I assume the IRS will treat it as a distribution under 59-1/2. Does this sound right?

I am just hoping that I haven't screwed up the taxes on the last couple of conversion (which I did not withdraw ira for taxes).

Secondly, I assume recharacterize Roth IRA is not treated as a withdraw?

anon_investor wrote: ↑Thu Mar 16, 2023 11:55 pm Interesting. A lot of the Samsung phones sold in the US use Snapdragon processors. Like the S22.

Yes, vulnerability is limited to phones that uses Exynos. Most Samsung phones model in the US tend to use snapdragon, while its non-US counterpart uses Exynos. The A series for the past year have been Exynos. While the S series get all of the publicity, the A series is sold to more people. I remember seeing a figure that the S series might be like 50m units, the A series may be more like 250m units. The Samsung A53 I mention is really popular.

I have turned off her Wifi calling, but Samsung seemed to have removed the option for VOLTE, which means it's always on. If there is a way to do this?

i just read this article. https://www.theverge.com/2023/3/16/2364 ... oject-zero. It appears that there is a vulnerability with Samsung Exynos modem. Unfortunately, it appears that my mom's phone is vulnerable. I ironically got the phone for her because she was using a really old outdated phone and I wanted to upgrade her for security reasons.

Thanks, I just recharacterized my 2023 Roth contribution though it took a lot of steps. I used the Fidelity website, which should have taken like 5 minutes, but instead the site gave me an error. Fidelity suggested that I print out the PDF, sign it, scan it in as a PDF and send it to them using secure mail.

Silk McCue wrote: ↑Wed Mar 15, 2023 10:05 am Not certain why you would think that. These are individual retirement accounts.

Cheers

I thought that was the case, but wanted to make sure. A lot of the tax code doesn't make sense.

LadyGeek wrote: ↑Wed Mar 15, 2023 10:14 am gavinsiu - In order to provide appropriate advice, it's best to keep all the information in one spot. I merged your update back into the original thread. If you have any questions, ask them here.

(Thanks to the member who reported the post and provided a link to this thread.)

Thank you

retiredjg wrote: ↑Wed Mar 15, 2023 10:05 am Did they just "fix it" because it was a mistake? Or did they actually re-characterize it? That will determine how you document this on your taxes. Was the contribution for 2022 or 2023?

It was supposed to be a 2023 contribution. They said I had to recharacterized it. I was wondering once I recharacterize it can I actually just Roth convert it.

[Thread merged into here --admin LadyGeek]

Suppose you want to roth convert your entire IRA. Is your spouse's ira basis included in the roth conversion? I was expecting it to be separate.

Thanks, I did call them and this is what they suggest. The next question is will I have to wait until next year to reconvert the recharacterized asset?

There is no fraud issue. You are essentially helping your parents. For example if you sit next to them and walk them through logging in and then helping them with transaction, you are essentially doing the same thing but faster. The only time you would run into an issue is if your parent file a complaint that you are defrauding them or doing something against their will. I do that with my mom's account since she haven't figure out how to transfer money. She only knows how to use an ATM. You would also shop for them using their account. Reinburstment seems cumbersome. AS for POA, I have them for all of my mom's account. You should set one up for each institution because most won't accept a generic POA form. The other issue you will encounter...

I messed up my backdoor roth. I transfer money directly into my Roth instead of my non-traditiional IRA. What can I do to fix thi without incurring some sort of penalty.

One feature missing is a decent outline mode. If you use a lot of outline you should stick with word.

I wonder if more people these day use google docs more.

Others have pointed out the various scenarios that may get in the way of ever inheriting it so I will skip that. That being said, I would look at it as a safety net that will likely be there if you need it, but plan to not need it. Some generation down the line (assuming you have kids and they have kids, etc.) will likely truly need it so passing on the favor would be my goal. How much gets passed on depends on a lot of unknown variables, but it would be nice to "regift" if possible. I think there have been studies that generational wealth rarely lasts more than a few generations, so it will be helping out someone in need down the line at some point...maybe even you and your spouse if something unforeseen should happen. A friend ...

I have been thinking of trying out cryptomater, too. Veracrypt won't work because it's basically a file that serves as a container. If yiou make one change, the entire container gets change over the cloud. I don't see too many other options than cryptomater.

At the rate that my mom use her money, I will probably end up inheriting a sizable chunk, but I do not factor that into my equation. A lot could happen in a a few years. Her health expense could balloon and use up all of the money. While unlikely, she could disown me or re-marry. I could also die and my mom might decide she doesn't want my wife to inherit the money.

I am wondering for users who have a mail forwarding services, does the brokerage like Fidelity, Schwab or Vanguard have issues with these virtual mailboxes?

onourway wrote: ↑Fri Mar 10, 2023 7:18 am This sounds like the case of a journalist making a story where there is none. Yes this is certainly possible if you use no discretion and take not efforts to further secure your device. I suppose the general populace should be made aware of that. Many people use their phones on crowded subways/buses/etc. every day. However the logical leap that you should therefore give up on iCloud Keychain does not follow.

Don't give Apple ideas! They might sell this as a solution rather than fixing teh issue.

There are a lot of cases where you have to enter the pass code. 1. Your phone restarted. 2. Your face id failed to work because you are wearing a mask or the fingerprint reader fails (which happens often for me). 3. you hit a setting that requires a passcode. You can probably mitigate some of that by being mindfui of your surrounding. It's a good practice to block the view of your phone while you enter you pin just like you should do that when entering your atm card pin. Part of the issue is that these incident happen when the victim is in a crowded space and is probably Inebriated, which probably impair their judgement. Some pickpockets are pretty good and can steal a phone from your pocket in crowed places. When I was vacationing in Rome,...

Boston Terrier Fan wrote: ↑Thu Mar 09, 2023 7:51 am I use Enpass and it stores all data on my phone. It works well for me and is a bit obscure. It seems like the more well known password managers are more vulnerable to online attacks.

I used enpass as well. I find the firm is pretty security concious based on my conversation with them as a paid customer. I set mines to always authenticate to autofill so you can't get to the vault or autofill without either reauthenticating with biometric or entering the master password.

Looks like the ebill is not reliable. Will set autopay to pull from the small checking account then with no auto overdraft.

You can set up Yubikey 2FA on your AppleID account. Having possession of your phone and phone passcode already compromises your password safe even without resetting your AppleID password, or locking you out of your AppleID. Try to use 2FA not linked to your phone for financial accounts whenever possible. Failing that, email or Google Voice SMS can be disabled from the phone by resetting the email/google password. TOTP running on the phone requires logging into or calling each account provider to disable. Don't store passwords for accounts mapped to the phone for 2FA in the phone password safe. You will want to use them to reset the passwords efficiently. Emerging password-less authentication protocols also treat one's phone as a trusted de...

jebmke wrote: ↑Wed Mar 08, 2023 2:21 pm In the US I'd say the difference is negligible. The best security is to keep very little money in the account.

Yes, that is pretty much my approach. I have a single bank account that I use as a conduit. Paychecks go in and get transfer to other bank accounts leaving a minimal amount to pay the bills.

However, replicating this with my mom is going to be difficult. She likes to have everyting in one giant account because it's easier to keep track of and she can't figure out how to transfer money between accounts. She does know how to transfer money via ATM, so I have to figure out if I can just setup a separate checking account for bills and see if she can transfer money using the ATM machine.

Thanks for the clarification, I thought I was just missing something crucial.

1. This seems risky since it might break the terms of service. In additional, I wonder what would happen with state tax. I suppose one could use a mail forwarding service from a state with no income tax like Florida or Texas.
2 - 3. I wonder which option would be less hassle. Frankly, I have not use futures at all.

I supposed if they remove the KIID requirements, one part of the catch-22 will go away.

Thanks, so there is no additional security for doing a push rather than pull?

Say this recently about how hackers get into your account by stealing your phone. https://www.youtube.com/results?search_query=wsj+iphone+theft To summiarize the attack. 1. Attacker observes you enter your pin by looking over your shoulder. 2. Attacker steals your phone. 3. Attacker unlocks your phone using your pin. 4. Attacker changes your password. 5. Attacker signs you out of your devices to lock you out and removes find my device. 6. Attacker sets up recovery key to prevent you from recovering. 7. Attacker use icloud to access your financial accounts. I think the big issue is that Apple allows you to change your password with just a pin instead of requiring the user to re-enter the old password. I was thinking of ways of mitigating thi...

This is in context of a dual US/UK citizen living in the UK using a taxable account. I am reading this boglehead blog https://www.bogleheads.org/wiki/US_domi ... ting_funds, so by buying HMRC reporting ETF, you can avoid getting the dreaded PFIC. According to the following article https://www.bogleheads.org/wiki/Investi ... _residents, you can't buy US ETF because it doesn't publish a KIID. What the two article is saying is that you should buy HMRC reporting ETF, but you can't buy it because no funds has KIID. What is the catch here, do you need to become "elective professional client" to actually get around this catch-22?

I think the question is more of a push pull scenario. You can setup pull from your bank account, but that exposes your routing information from your pulling vendor. An alternative is to use a push where you use bill pay to do it, but since the bill is variable, it makes automation difficult. The idea is for ebill is that it will figure out the amount to schedule, at least this is to my understanding.

If a US citizen is living in the UK, can treasury bonds be purchased without issues. what would be the cost involved? I don't think you can sign up for a treasury direct account without a US address. Are there any issue with holding US treasury Bonds like TIPS in a UK brokerage account? Would there be an issue with PFIC for example since it probably wouldn't be a PFIC?

I cut mines up and throw them in separate trash bin, I then discourage scavenging by human by mixing in kitty litter, diapers or decaying food.

I ended up using a Firefox container and a junk mail account to sign on.

I decided to take this as an opportunity to negotiate with her to set up autopay. She suffers from anxiety where she worries that she won't make an appointment or pay a bill on time. It's actually a useful ailment since that means she never missed a payment or an appointment. It's not so great when she starts pestering me by phone and text or sending pictures of the bill to remind me that her bill is due next week. I am trying out using ebill because I am trying to avoid exposing her routing information. My plan is to schedule it so it auto pays each month using ebill. I send the initial payment and my mom calls me 30 minutes later to indicate someone had withdrew money from her account, so at least I know she is paying attention. After thi...

I was wondering if discord will install a boat load of trackers and be invasive like Facebook.

So the typical way of autopay is to setup your bank account. So you might setup a bank account routing at your credit card and then have it withdraw money each month. However, I feel uncomfortable having all that info scattered around to a bunch of vendors. What if the vendor sucks at security and get hacked?

I notice that many banks have online pay option. I was wondering if that would be safer since you are not giving out your bank account routing info. The only downside is that the amount might change monthly so I can't schedule an autopay. Are there ways around this?

I notice that more and more product support are showing up in Discord. I have generally avoided social media. Are there any security issues with using Discord, not running a discord server, but just using Discord channels. I have heard that there might be privacy issues.

Yes, I managed to get her to autopay her rent because it's the same amount each month. I hesitate on setting up autopay because my wife did that once and she didn't notice that there was a recurring charge on her credit card because she stop looking at it once autopay was in place. However, since my mom monitor her accounts regularly, this might not be an issue. Her filing system is atrocious, she just seems to dump everything into a box, so having no paper might be a good idea in the long term. She does not like the idea of auto-pay, but now that I have gotten her started, I can convince her to autopay the rest. As for taking over her bills, I am trying not to do that. Mostly because I already handle her finance (though I outsource a lot o...

Stop using a credit card, that banks online system or both. I know it’s harsh, and I have a 75 y/o mom who still lives in the 1990s so I know the struggle. My mom and I had this conversation recently. She was upset over not understanding something, I basically said if you can’t manage a banks online banking you can use that bank. Banks don’t want to print piles of paper, send you snail mail each month, for you to send a paper check back to them via snail mail. Worse, when you have a question, or don’t understand something, they don’t want you walking into a physical building with some nice person just waiting behind the counter to spend 35 minutes with you. They don’t care how long you’ve used their bank, and unless you have disgusting amo...

mas wrote: ↑Mon Mar 06, 2023 9:42 pm A lot of those nag screens are designed in a way that pop-up blockers wouldn't impact.

Probably true, but she can't remember clicking on it and I can't duplicate the problem. I will see if this works.

twh wrote: ↑Mon Mar 06, 2023 9:35 pm
She may be logging in and they incessantly pop up "go paperless now" screens. It would be easy to click ok if you aren't paying attention or sure what you are clicking.

Yes, this might be what is happening. I have asked her in the past to stop clicking on popups without reading. I can't see what she is doing. I might just turn on popup blocker for the bank to see if that allevates the issues.

Bogle7 wrote: ↑Mon Mar 06, 2023 9:16 pm I am 74.
Use electronic checks.
Or, go online and pay with credit card or direct withdrawal.

She's 80 and has trouble turning on the computer because she can't remember where the on switch is. I have tried for over 2 decades to get her more online, but have given up. I am just trying to work around her lack of tech.

I have been using Libre Office since it used to be Open office before it forked off as a separate product. I use it at home because my document needs are minimal and does not justify paying for Office. I do use Office at work.

It works pretty well and is an improvement over google docs and Office online. As a plus, it runs on the different platform. However one issue is that sometimes formatting change when you collaborate with someone using Office.

No, I considered e-filing because every other year, my state sends me a notice that i have failed to pay my income tax because my W-2 goes missing. I figure that instead of filing paper, I will just elecronic file only to be rejected because some out of state investment prevents me from e-fiing.

In any case, states charges for e-filing even e-filing probably saves them money.

My mom's credit card and bank accounts keeps switching to paperless. The problem is when that happens, she can't figure out how to pay the bills because there is no envelope to mail the check. My thought is that the banks and credit card display a popup asking the user to change to paperless. I was wondering if there is a good solution other than autopay, which she doesn't want to do.

They're both right - if a US based ETF published a KID/KIID, UK investors would be able to buy it. However, no US ETFs actually do publish a KID/KIID, therefore UK investors cannot buy any US ETFs due to UK regulations (technically, no brokerage is allowed to sell them to UK investors - the prohibition is on the broker, not the investor, but that doesn't really help). This is where you wind up in the list of workarounds/loopholes in the wiki: https://www.bogleheads.org/wiki/Investing_from_the_UK_for_US_citizens_and_US_permanent_residents#Intersection_of_US_and_UK_rules I have read though that several times, but it's hard to go through if you don't have enough knowledge for example, the first line said "US PFIC tax rules make ownership...