This week we saw our identities and financial accounts flash before our eyes with JC getting scammed (day 36). We scrambled for a full day to get a hold of that situation. As we came up for air the next day, she got tricked into using a shady passport renewal site as well (day 37). That lead to another round of tightening of our digital security. The good news I think is that we came out of this with a hardened security posture. JC, AC, and I walked through the anatomy of a hack to learn what happened and how to spot it in the future.

Later in the week on day 40 you will see my skepticism of orthodontists on display.

FIRE: Day 36 (8/3)

Today started off normal enough. I woke up a little late, but got started with my plan for my new weekday routine. I’m going to do two hours of Spanish in the morning, then go to the gym, then come back and work on tech projects while I do HIIT/core rounds. When I got back from the gym, the day went off the rails.

Getting Hacked

JC and I were in the living room, and she said something like “hmmm, that’s weird, two of my emails just disappeared”. I was immediately alarmed, and she told me she clicked an invitation from a friend of hers to an event. It turns out it was a phishing attack. The invite appeared legitimate but the “view invitation” button went to the attackers site instead of the invitation platform. That site was configured to be identical to a google sign-in screen. JC entered her credentials and then performed a two-factor approval on her phone, giving the attacker full access to her google account.

We triaged this in under ten minutes and began working to retain her access and remove anyone else. We changed her password, sifted through device sessions and logged out any that weren’t her, regenerated her TFA backup codes, checked filters and forwarding to make sure nothing was set up there, etc.

Hack Fallout

The scary part of this is that we keep everything in google docs, including our personal and shared passwords. They of course are in documents named “passwords”, which seems pretty stupid and careless now. We just made the assumption that all of our passwords were compromised. After copying the passwords local and deleting the google docs, we sorted everything into tier 1 and tier 2 password changes. We immediately worked through tier 1 (banks, investments, etc), adding them to a password manager as we went.

That took about eight hours, with more to do tomorrow on the tier 2 password changes.

FIRE: Day 37 (8/4)

To start the day, we picked up where we left off yesterday on account security. The good news is JC’s account is still accessible, and nothing weird is going on right now. She set up a credit freeze at the three bureaus (mine is already frozen), and then we just casually worked on password changes.

I worked on a post mortem presentation for JC and AC to walk them through the hack and how to avoid it in the future. Right as I was finishing that up, JC made security misstep #2. She was trying to renew her passport and got tricked into going to some bullshit dot com site. It charges double the amount of travel.state.gov, and apparently then just sends you papers to file.

Why google would allow that site to buy ads so high in the search results is beyond me. We caught this before she made payment thankfully, but all of her data was already exposed and stored on their servers. This led us to take a couple additional protective measures.

First, JC signed up at ssa.gov to ensure her social security account is in her hands. Then we both went to irs.gov and created a personal protection PIN that is now required to file our taxes. The world is soaked in both of our information. Hers from these incidents, and mine from a DMV data breach many months ago. We have to take all the steps we can at this point to protect our identities.

FIRE: Day 38 (8/5)

As we got back to normal with no further hacks or identity theft, I was able to work on a decent amount of Spanish. Between DuoLingo and Dreaming Spanish I spent over an hour learning.

I also dusted off yesalittle and started working through the next set of changes with Claude. Those changes are to build out more content for native Spanish speakers learning English.

JC and I took a couple walks. I sprayed weeds in our yard which is a big task right now. Later in the evening JC and I got out of the house without the kids and browsed around American Furniture Warehouse and Costco.

FIRE: Day 39 (8/6)

Another decent day of Spanish, about 1.5 hours between DuoLingo and Dreaming.

I started losing my mind today at the amount of friend activity our kids are engaging in. Particularly BC who is back to his old ways of playing from sun up to sun down with neighbors. On one hand the outside play is a good thing compared to the state of many kids in today’s world. It’s better than being addicted to screens and getting no exercise. On the other hand though, too much of any one thing isn’t good.

This is exactly how he got behind academically in the first place – never picking up a real book and not having any academic interests whatsoever. We came up with a plan to make him do a half hour of reading and a half hour of math before he can go outside to play. There’s going to be some sort of hour limit on outside play as well. We need to force him into boredom so he will diversify his interests.

I finished and deployed the changes to yesalittle.

FIRE: Day 40 (8/7)

I took AC to her orthodontist appointment. On the way there I asked her what her goals were, and was surprised to hear she had none. She didn’t even find her teeth crooked enough that she wanted to fix them. The orthodontist on the other hand had extensive goals and treatment. What they proposed would take an initial round of bite correction using a Carrier system. Then they would put braces on, and the whole treatment would be 26-28 months. The cost is about $6K if we pay cash.

My History

My childhood was filled with orthodontia, including multiple rounds of bite correction. I was not a willing participant in any of that, and I never want AC or BC to be forced into treatment.

My parents never had much money when I was a kid, and I always felt like they were preyed upon by the orthodontist office. They manipulate by pitching the treatment as giving the best to your kids, and what a wonderful gift it would be to them. That line of marketing is predatory and I was disappointed to see it still happening at this consultation.

Today’s Appointment

I wasn’t a jerk to them, but I calmly asked questions about the necessity of each part of the treatment. They of course defended it, saying if we didn’t fix the bite that she would be fixing the bite and dealing with tooth wear and stress related issues on top of it. Every argument they presented was anecdotal and they didn’t offer up any studies or real data. I didn’t press them too hard and backed off a bit when I felt like they were on their heels, and just thanked them for the info.

What they said to me was enough to realize the industry is still self-serving and hyperbolic in their claims. I imagine in the end we’ll end up paying the $6K because we can afford it. What irritates me is the thought of people who can’t afford it being guilt-tripped into proceeding.

Amazon Bonanza

Several amazon packages came today for some around the house stuff. A handheld vacuum, a universal remote, a calendar wall board, and a power supply for one of our theater chairs that broke.

The universal remote is a Sofabaton U3 to control the receiver, TV, and fire stick in the basement. The real driver for this is that the remote on the 25 year old receiver is dying, and this U3 has an IR learning function. That allowed me to press the buttons on the old remote and have the new one perform those functions. I can put that old remote away now to preserve it.

Rounding Out The Day

The kids went to JC’s mom’s house for a sleepover. JC and I had happy hour, went to the pool, and then came home and hung out around the house.

FIRE: Day 41 (8/8)

I ran for the first time in a few weeks this morning and it went ok.

The day seemed short to me, and I think it’s because JC’s friend was over and we talked to her for quite a while. My only real accomplishment was posting our July budget.

JC and I watched Project Hail Mary while BC was at a friends house. AC watched a movie with her friend at our house on the other TV.

FIRE: Day 42 (8/9)

I really didn’t do a lot today, and spent a lot of time just lounging around with my thoughts.

In the afternoon the four of us went to Castlewood Canyon state park. We have been there several times before, but we went to a different gate where they have different trails. It was a lot of fun because we got to see an old homestead and an area with caves.