qcs2_6_ -- Other (Please Specify) : Who do you rely on most for cybersecurity help or advice?
Myself, I work in Information Technology
security apps, articles, online information
My self as I know how devices encription and programming works
Advanced cynicism and an assumption that everything is a scam. Even this survey. Some of my answers are probably inaccurate just so the scammers don't get my real details.
Company IT personnel and my own online searches on how to be secure
My own research from several knowledgeable sources on the internet mostly cybersecurity specialist
Software that is offered to maintain computer security
Not possible. I am most at risk from actions of my government.
PROFESSIONAL COLLEAGUES, RESEARCH, CLIENTS, MY WORK
Private sector firms who sell cybersecurity aps and monitoring services
Bunch of combined sources like YouTube videos, which I take with a grain of salt and apple because apple is super secured and I just switched to that route and now I care about security.
I am a retired grey-hat, cybersecurity is mostly a non-issue for me, but certainly not obsolete.
Private websites and blogs, but not vendors of security software.
Informations sur les divers attaques et la protection contre ces attaques
Partenaire specialiste en sécurité informatique
Internet sources such as news sites and specific computer sites like PC mag, zdnet
The specific software or hardware companies of what I use.
Cyber security and IT podcasts and articles
Youtube, understanding 2FA, reddit, online forums
Security Researchers and Open Source Community
Youtubeur spécialisé dans la sécurité en ligne ect.
Trusted online resources, IT at work, and consulting family who work in IT
I bounce stuff off an old work colleague.
Appel est un bon système compte sa pour m’aider
I worked in IT for many years so rely on myself and the research I do online.
Security blogs, security software adds, web based research, andcompany security specialists
Le service des ressources informatiques à mon travail ; également les articles de journaux qui parlent de gens qui ont été victimes de cybercriminels.
Me, using available software and common sense
Try to keep up to date on threat intelligence and online community research
Personal investigation with Google searching
YouTube or websites to answer my questions.
Not sure who is the best for this and still confused and concerned about cyber security.
Information from reliable Internet personalities (eg. tech YouTubers)
My company while I’m on my work device. You haven’t defined cyber security so I’m unclear what all you refer to
Mostly my own research at this point. Reddit helps a lot.
Programming forums and information available online
Je n'ai pas de famille pas de conjoint et je me suis fait fraudé de 5 ,000 en 2023 .
I'm a software engineer and keep my skills up to date from constant learning online.
Informed groups on this thing called The Internet
Expert en ligne. Émissions Télé, Organismes, etc.
My self my husband knows nothing about the internet and how to be safe
Professional sources (I work in a cyber security related field)
Myself and fuck the government they cause spying and are the biggest online crooked cunts alive.
Through online research via reddit or other forum sites.
Online resources (articles, informative/educational YouTube videos, open-source security apps/programs, etc.)
I don’t rely on anyone. I don’t put any information about banking or anything else on line.
I seek out multiple sources of information usually online from reliable sources
Les conseils reçus au travail me sont utiles à la maison.
Moi même et les informations que je trouve sur internet, ou les forums et YouTube
Myself. Being informed on what is possible and being vigilant as a result to prevent data theft or hacking/malware. Obviously can’t personally do a thing about large companies selling my personal information.
Specialized internet security forums, discussions groups, and news websites
Educational websites and people who are up to date on child and family online security
Des YouTubers spécialiste en cybercrime, et parfois mes amis ou collègues (plus rare)
Our IT employee as well as a third party consultant
Cies telles Devolution, Sophos, Fortinet, Vonahi, GoSecure
Cyber security news from online journals and experts.
YouTube content creators for their unbiased opinions.
Security experts on social media and blog posts.
Radio/TV shows and reading informative articles in print and internet
Open source security advocates online. I do not trust corporations or governments for information regarding cybersecurity. There are too many competing interests and neither of those categories of organizations have typically had my best interests at heart as a queer woman.
Online resources like technology blogs, review sites, and news sites
Online discussion groups, forums, social media
Online Communities of people who know what they're talking about
Myself and personal research, predominantly
My own common sense of keeping personal information secure
Mon employeur mais aussi les informations sur la web
Mon employeur fait des formations régulièrement
Mes années de connaissances dans le domaine et mon propre jugement en ligne
Me, and the knowledge that was taught to me in school.
Internet searches how to protect better.
Independent privacy experts (no affiliation to government and are not selling a product)
I use whatever I can to stay informed. Press media workshops in the community and I purchased Norton
I try to read regular articles from legitimate cyber security companies and trade related updates. I also regularly research new technology and security features.
I rely on myself, and on my work's IT department
Google - searching the internet for other's experiences
General tech websites, not related to products or services
Current Research and systems analysts. There are a lot of paranoid opinions, but the theme from consummate professionals seems to be that the prevalence of online threats change shape so often it’s hard to mitigate effectively. As a result, one often feels compelled to adopt either a position of apathy, or a kind of constant ill-informed wary trepidation. Ironically, the other consensus professionals often speak to, is that programs like the one this survey is probably looking at enacting (unless it’s a prolonged campaign of exposure to education) tend to pose the greatest threats to users online. Whether it be via infringement of personal freedoms and privacy, or departmental overreach and the products of speculative dehumanization of perceived ‘groups’. Hackers are a threat to federal infrastructure to be sure, but as individuals, laws that currently do not exist pose a greater threat to our collective well being than the fallout from a bank account being cleaned out. I apologize for the long winded answer.
arch wiki ( free non government expert written resources )

qbeh8_7_ -- Other (please specify) : What is the main reason you don't use (or stopped using) multi-factor authentication (MFA)?
Other services have used it for my account with them, but I haven't used if myself.
No point. Government will fuck me one way or the other.
It isn’t efficient, is kind of annoying. I do most security stuff but this one I take risk by not using on non-important sites.
A combination of not always having my phone with me for verification, and the extra layer of security really only being necessary for work-related authentication.
Trop compliquer il faut se souvenir de mon mot pas en plus ce souvenir des réponse que j’ai donner et avec la bonne orthographe
It is way too time consuming and too strict in its parameters. I end up having to sign in on too many levels and sometimes the site does not warrant Fort Knox type security.
I do not have a smart phone. Neither do I believe giving out my phone number makes me more secure.
They make hard to make it work. I make good passwords plus I have best company to look after me.
It feels like they’re requesting too much of personal information
It doesnt prevent the cunts in government and spy agencies from doing what they want aNyhow—
I don't trust companies to keep my private information safe whether it's personal phone numbers or my face or fingerprint, I also find fairly unreliable
It is annoying, especially if you change your phone number, and they don't give a second option for using MFA to log in.
Some sites it is wise to have, others don't need it. I have stopped for sites that don't really need it
In my workplace setting in particular it is a hinderance to my role. To best complete my duties it must be turned off in most instances. If settings were to allow for more than one user this circumstance may change.
I don’t want my phone to stop working one day and I am screwed. It has happened before.

qbeh12_7_ -- Other, please specify : What steps do you take to verify that a WEBSITE is legitimate?
I open the link only if it is from a trusted source and if in doubt check with them.
I don't think I have done this often enough to reply with a valid response.
Checking website address etc for fakers and url extension
I don't feel like specifying. I just know.
Analyzing the data collected by other users as well as the urls of the site to verify legitimacy its a pretty simple and basic thing ....
I look at the full name of the web address if it sounds fishy like starbaby.com or something.net I dont click
I start before getting to the website. Where did this sketchy link come from? If it came to me unsolicited then I probably won't click it.
I check that the li k to the website matches the expected website name
Check the address, type the address myself, etc
In addition to https, I verify the address, the company and the security certificate.
I check the issuer of the SSL certificate.
I only worry about a websites legitimacy when downloading or entering personal information.
I do not visit websites that are not legitimate.
I assume all media is government propaganda and do not believe it.
I use ublocker which notifies me if there is malware on the site
Je m'assure que l'URL n'est pas rediriger après avoir accéder au site web.
Je n'entre aucune donnée personnelles sur un site que je ne connais pas peu importe si il a une apparence professionnelle
I have norten i feel it protects my computer
I assume it’s a scam and I only access websites I know legitimate. So if I get a message saying your payment is due I check the original website and I don’t click there link even if I am confident it’s not a scam.
I sometimes access the websites code if I’m still suspicious and unsure, and check for hidden links or falsely labelled buttons.
checking the URL in the preview hover, previewing shortened URLs, googling the address, pretty much everything standard.
For known sites, check URL. Enter URL myself rather than clicking links in emails etc.
Check for frequent spelling/grammar errors
I get message alert when a website is suspect before going to the site
I check the URL to ensure it's relevant to the website and registered as a trusted prefix such as .gc.ca
I don’t rely on links and instead find the site independently
Check for spelling and grammatical mistakes
Access the website from a known source (google search) and compare to the one provided by the link. If possible, doing the same thing required from the website sourced from the search engine rather than one sent through a hyperlink.
I am very stingy with any online information, so that even if a website is not legitimate I won’t be taken advantage of.
I also check the domain to see if it’s as expected. If unfamiliar with domain/brand I look for reviews
From checking slides security certs and other normally hidden information
Check the url to ensure I am aware of the location of the web site among other things
I actually read and check certificate issuer.
Look at the specific url in the link properties (not the name) and see if it matches my required site but mostly go directly to a known address I’ve used before.
I check the address is legitimate ie.gv.bc and run site through security app
I check the url and any underlying url in click through links, but more importantly, I use autofill passwords - because sometimes the url will use 'lookalike' lettering - but the autofill password will not be invoked.
I check to see how long the site has been up as scam sites don't stay up very long
Check spelling, check source of website (ie. was this sent to you in an unexpected email), hover over link and make sure the link is as expected
If a password is saved and doesn't come up, I know I'm in the wrong place.
Ensure the domain isnt typo squatted (0 instead of O) and registered to the actual org it claims to be from.
I do not open sites I do not recognize or are not familiar with.
I check to see if the French translation is good
I check that the URL matches the name of the organization.
Je regarde la composition de l'adresse du site
Handtype/bookmark any any domains that security matters for me
I read the url to ensure it isn’t a phishing site emulating a real site
Don't go to sites I didn't search for, dodge all links from unfamiliar sources, BASIC COMMON SENSE!
I carefully look at the email address and check for small spelling mistakes. If I am unsure of a web link I look it up on line (which is what I did for your link)
My Norton Security prompts me if the site is or is not legitimate.
I try not to wander too far, and usually try to assess a site. (part of the reason you had to ask me here 3 or 4 times).
It depends on the site and what I intend to use it for. I have used all of the above in different circumstances.
I read reviews and check with the Better Business Bureau
https, check whois records, personal knowledge, all of the above, look for bimi verification
I check the URL. Untrustworthy sites often have weird URLs.
I generally stick to tried and true websites
I don’t. Good list you have here though. Would be helpful to know this list.
I use a mix of multiple answers here. But I also do not go randomly onto unfamiliar webpages, and I never click links from unknown senders, and check hyperlinks before clicking them.
Reject when told site could be malicious.
Je ne sais pas comment vérifier et je suis trop naïve je crois tout le monde
I use a DNS blocker to prevent unicode substitutes to well know sites. For emails, I check the URL of the links to ensure it's legit (e.g. not www.gooogle.com with too many o's)
Partner has paid for a computer protector and denies access to potential viruses
AV Norton usually advises and common sense
I buy a monthly or annual subscription online and it checks n verifys if website is safe or Not safe
McAfee m'indique quand un site web est non recommandé
I have setup a network wide protection device that also automatically scans for malicious URLs and packet requests
Who gives a fuck— cant read news on social platforms because if the cunt trudeau and the other nazis
I bookmark a site and then always use that link. I know about https but forget to check.
Sometimes I see a not secure notification
Logiciel qui bloque le site installer sur mon système
I don't use websites I don't know on my main devices.
I just don’t go to sketchy websites just reputable ones
This question is stupid. I only go to websites I want
Without opening it, I check for spelling and grammar errors in address, title, and for missing or incomplete logos. I hover over the sender address to see if it matches the address I have on file. I search for the website and compare. I contact my family member for advice.
Usually a phishing or malware site I will search it online
Use firewall protection to confirm it's safe.
Use browser software to warn of dangerous websites
Something I will ask my IT dept to investigate.
Security app alerts me to suspicious websites
Run software that warns me if a site is trustworthy. Weboftrust
Often don’t click a link but type in the address manually so I know it’s the site I intend
Not confident that what I’m using is enough
Macafe let's me know if the website is safe
Je vérifie l'orthographe du site Web et la structure HTML de son contenu, à la recherche d'incohérences
Je ne vérifie pas mais vous venez de me donner les trucs merci
Je ne vais pas sur des sites web reçus par courriel ou texto
Je ne le fais pas assez souvent malheureusement
Je n’ouvre aucun site et ne clique sur AUCUN lien que je n’ai pas sollicité.
Je me fie sur mon logiciel de protection en ligne
J’utilise internet pour faire de la recherche, je connais les bases de données et j’ai rarement besoin de dévier de celles-ci.
J’utilise des protections avancées qui sur pare-feu et un futeteur moderne qui valide la légitimité de tous les accès web.
J'écris moi-même l'adresse du site et je le garde en favoris
It depends on what person or company etc. is sending me to the website
If it looks too good to be true it probably is.
If I am not familar with the web site, I don't open it.
I'm not usually browsing for random websites...?
I verify that the URL is accurate to what I'd expect
I use secure browsers and search engines
I use Kaspersky software, it tells me if a site is untrustworthy.
I use F-Secure to monitor all my internet browsing and interactions.
I take no steps. I am old school and all this is over my head, so I chance it
I search for the company that the website is supposed to represent and see if the website matches or if there are comments that this is a scam
I rely on my iPhone to tell me if a website isn’t safe.
I often get warnings about a website’s insecurity
I never open websites where data is requested or obtained and where email not able to be verified
I make sure the website URL is legitimate
I make sure the ssl certificate is signed by a known root authority.
I look at the url, this is where identify if it's fake or not 99 per cent of the time
I let my anti-virus software analyze the website to see if it is black listed.
I have anti virus software that scans sites for me
I figure I don't need to click on a lot of stuff that pops up. I'd rather search for what I want
I don't. Norton tells me if it is an unsafe site.
I don't typically browse across random websites. If I was to be in the position where I was in need of a foreign website checking reviews along with the regular precautions provided through browsers like chrome is typically enough.
I don't go to something I don't know. Senior with no computer. Just phone.
I check with a friend in IT if I still don’t know. Or I err on the side of paranoid.
I check the domain, common domains (.com, .ca and .net) tend to be more trustworthy then uncommon or foreign domains (.ru .party .tv
I check the company itself for legitimacy
I assume it is but look for security if giving credit card
Compare to other websites if there are duplicates
Check the URL for accuracy or proof address
Check other references to site, check certificate authority, verify secure connection

qbeh13_8_ -- Other (please specify) : As far as you know, what are signs of phishing?
Comes from a not-official seeming email address or phone number
Often comes from the same email address that I know isn't legitimate.
Le message est envoyé par courriel ou texto alors que le fournisseur de service possède déjà un système de communication interne (exemple, un avis de suspension de compte sur un réseau social reçu par courriel alors que le réseau social en question possède déjà une procédure de notification interne sur sa propre plate-forme
Unless I know the sender or can think of why they're contacting me, they're scammers.
Analizing The link and url of the data on the main page and verifying the ownership of the company that created the website as well as data based on other users u can tell right away as well by commons errors on the build of the site like differences on the letters wrong design and suspicious alerts from externals sofwares ???
Unsolicited email, out of character communication from friends family coworkers.
Incorrect use of idioms and colloquial language
Indicates in need to download something or do something on an account I have or for work for software we use whixh is managed by our IT dept.
Typical cra scams and trusted site counterfeits (IE Netflix, any bank etc)
Le message utilise un format courant généré par des IA comme Chat-GPT.
any type of push (that is, I did not seek it out. deliberately) for information which requires me to enter account information
phishers contacting you on an account they've stolen from a friend or family member is the biggest one not on this list
Misspelling words, using alternate symbols in place of letters
Sometimes the graphics, etc., can be very convincing.
Has email address that is incompatible with supposed sender.
Appear to come from boss or coworkers, but the email doesn't make sense when I hover over the email to see the email address of the sender
Makes requests uncharacteristic of my colleagues
All of the above plus previously mentioned
Unsolicited offers that look normal, except that I don’t expect them
Pretends to be a follow-up message to get a response.
The website doesn't actually exist if you click on anything other than whatever needed to input your information. They scared the HTML/CSS for the payment pages but not the about us or the contact us page on the fake not https link
Tempts with ""big opportunity"" or ""interesting information""
They send a text stating that there is a missed payment but when you go to the account to which you pay it shows in their account as paid
Attempts to contact me from someone I don’t know
Text messages not from 5 digit numbers are also suspicious, most companies pay for access to these numbers
Supposed to be personal but check to see if others got same email
Unsolicited direct messages sent from people that share one point of contact, such as a community chat room or forum. Same for zero points of contact, and messages received from accounts impersonating staff
Contains a link to your account rather than asking you to go to the website through your own link and view the offer/detail directly.
Loyer en retard, héritage reçu, frais de transport à payer, etc.
Request to update your credit cards when you know everything is updated
Bad spelling and Grammer, anything close to correct but not 100%% correct
Says I have ordered from some where n my package is waiting to be delivered or pickup and I never ordered anything on line or if I do survey online I ll get 500 prepaid gift card
Site web d'apparence professionnelle sans un cadenas dans la barre d'adresse
Certain text phishers follow a pre recorded script or ai chat bot buts its easy to distinguish.
Contains exciting or enticing language and offers (monetary gain, unrealistic products/medical solutions, pornographic material/dating site notifications, etc.)
Je reçois des demandes/requêtes/informations en ligne qui auraient dû être envoyées par la poste.
Qui simule un compte d'amis ou d'un de mes contacts qui n'est pas coutume de le recevoir dans ce format
Ne me donne pas d’informations sur moi. La banque connaît mon nom mon âge, Amazon connaît mon adresse mon nom. L’hameçonneur ne fourni aucune information m’identifiant.
When hovering over a link, the displayed address doesn’t match what’s in the message
Uses my email as my full name, ex. “Hello johndoe84!”
The well done ones are near identical to real companies such as Apple and the best method is to always know where you stand on hardware and software so the email can be deleted directly without even risking opening it.
sender's email address doesn't correspond to who the email is pretendng to be, often from another country
Provide a link for you to click instead of telling you to go to the site yourself, to give you a fake site link
Often uses names to attempt to familiarize themselves with you
Not sure if this has to do with your study but on instagram and Snapchat there’s a lot of people that will trick people into sending nudes to them blackmail them into money
Message en anglais seulement, sans possibilité de version en français
Message d’apparence très professionnelle et qui semble crédible
links for a password reset that was never requested
Le message n'est pas signé. Le message ne comprend aucune coordonnées pour contacter quelqu'un pour poser des questions.
L'addresse web est différente du site autentique ou le site web m'urge d'appeler un certain numéro de téléphone
Includes a button to click to go elsewhere
If the language isn’t threatening, it’s overly friendly
I never open email or that is not from a known contact
Email has attachment but no message in the body
Demande d'agir dans un délai court, immédiatement, avec des conséquences graves en cas de refus.
Claims to want money or will destroy your files. Freezes your computer
Attempts to be overly friendly (friend invites on apps like Facebook, discord, Slack, etc.).
Appears to be from contacts I have but slight difference in email address
Any interaction with companies that I didn't initiate gets ignored. If it's from someone I know I talk about it in person
Addresses Dear sir or madam or client. Not my actual name.

qbeh15_10_ -- Other (please specify) : When it comes to your passwords, which of the following actions do you take?
Permettre à un site externe de gérer mes mots de passes mais ce site demande en tout temps un contrôle par capteur biométrique avant de livrer les mots de passe au moment de les utiliser.
Use a strong password for extra sensitive sites like baking info.
Vary the password complexity, formula etc depending on the importance of the site. Use mfa whenever available.
My password is 20 characters long with special characters, capitals, lowercase, uppercase, numbers, etc.
I use same password for non important sites (gaming accounts etc) that are different from important sites (my account, tax software, sites that store my cc). Important sites have different and robust passwords for each site
Utilisation de groupes de mots de passe. Les comptes important ie banque et courriel on des mots de passe uniques. Les comptes moins important partagent d'autres mots de passe et un mot de passe unique est utilisé pour les sites dont la sécurité est louche (spécialement les sites chinois)
A combination of all of these but the important things I have a specific super confidential password of over 20 character's
all of my passwords are alternating 24 character, caps/lowercase, numeric, symbols.
Try to use mnemonics to make complex passwords that are easy to remember.
Find a device in your office and use the model or serial number. It isn’t written down but you have it handy
have a personal secret log book of important information
Depends on the sensitivity of the data involved ie payment info or other personal info I use unique several character passwords - if it’s a loyalty program and no personal data I recycle one of a handful of pws
Have all the passwords need security questions.
Use words and numbers that have meaning to me but would not to others
I have been in the internet since it’s inception and therefore have hundreds of passwords so I have no choice to store them but they are stored on an encrypted usb device that is only plugged when needed. Also have a backup and file also password protected.
I have accounts with common passwords, and others where I have overly complex, unique passwords - older accounts tend to have simpler, less secure solutions, and over the years I've become more sophisticated about them, but admit to being lackadaisical about going back and updating the old stuff.
Keep hints (that only I can decipher) for passwords and user account info in a spreadsheet in an encrypted zip file
Slight changes to my password, multiple combinations for 100s of sites. Password managers can't be 100%%%% trusted. Check haveibeenpwned. I do not always make a unique password for each account.
I keep a notebook with my paswords in a locked area because of the sheer number and so my kids have them, if need be, when I pass away.
Password manager for most passwords, memorized passphrases for important accounts
Keep the password handy in my phone notes
Using a similar, but different password for different accounts in order to make it easier to remember but not very easy to exploit
I have a personal system for recording passwords
Browser stores passwords for sites with bo online shopping
I use a password formula that is different for each account
Never save any of my passwords on any device or website and use 2 step verification when able too
I have other tricks, but not gonna give them away.
adapt password to the required security level of the website. If it involves money or other secure data, I make more complex passwords or two factor ID
Password protected word document with all other passwords
I use unique 8 digit passwords for important accounts but use easy passwords for other sites.
Use similar passwords with characters that have similar variants for multiple accounts
Utilisation de mots de passe distincts pour les comptes plus importants, et similaires pour les moins importants.
Use the same password but with single word/portion changes, or symbol/number changes, cap changes, until I end up putting 50 diff variations trying to log into dominos
use multiple variations of same password theme
Use a password generator to create complex passwords
Unique, complex passwords, 3rd party password manager that is password protected
This varies on account relevance. Newsletter VS bank for example
Require re-entry of password manager's master password before gaining access to personal financial website's individual passwords.
Passwords are changed monthly and old passwords are not reused
password book store in save, all sites have different passwords
J’utilise le même mot de passe pour des comptes sans importance.
It highly depends on the account and the information on it, social media that is all the same info anyways and I keep clear of private information would share a password for ease of use, but banking/government/work related or other sensitive accounts have separate passwords that are more complex
I have some passwords that I use for several accounts, as well as many passwords that are used for only one account each
I do use unique passwords for things like banking. I also change my passwords periodically.
Google passwords and use their passwords.
Get fed up with passwords Should be biometrics
For accounts that warrant a higher level of security, I will create unique high-security passwords. For other accounts I may use same or similar passwords
Écrire certains mots de passe - pour les comptes ayant peu de risque. Écrire des indices pour me rappeler des mots de passe pour les comptes ayant plus de risques. Utiliser des orthographes incorrectes pour les mots dans les mots de passe.
each category have their own password - social media got a pattern - finances got a pattern - government got their own pattern - sometimes they're repeated but never across different ""categories""
Double mots de passes mots passes système plus le mot du site
Correct horse battery staple (if you get it, you get it)
Code personnel gardé sans identification sur un autre support
Aucun stockage de mot de passe numérique. Vérification du mot de passe sur un testeur virtuel en effectuant des changements de caractères lors du test pour éviter une fraude à ce moment.

qbeh18_6_ -- Other, please specify : You mentioned that you rarely, if at all, use unique passwords for your online accounts. What is the main reason you don't do this?
Je met en place un procédé d’identification à double facteur ou par le biais d’un capteur biométrique pour accéder aux sites.
I’m autistic and can only remember 1 password, although it’s extremely long and convoluted in itself.
Not wanting to be dependent on a password manager, and yet frustrated with the idea of walking around with a record of which password for what site.
When using passwords often, forgetting and getting access again is time consuming and sometimes takes a couple days. Not ideal for urgent matters
When the computer doesn't retain the password, I cannot access the account. I gave up on it
Started that way and haven’t bothered to change
Not completely different but characters, upper case lower case, numbers and symbols. Different combinations.
It is too difficult to remember them, and password managers seem redundant or easy to lose access too (either a memorable yet easily penetrable master password, or a complex yet easily forgettable master password, respectively)
I have two good ones that are hard to crack and is easily tailored to different sites. I make alterations to both.
I have my own system re: strong passwords
I gave too many accounts to dedicate a unique password to each
I don’t need a pass word, because I don’t trust internet.
Have Face ID authentication in place and/or MFA
Far too many accounts to manage, and only rarely using some accounts

qcce1_5_ -- Other, please specify : These next questions are about cyber crimes. Have you ever personally been a victim of online scams where you have lost money or data?
J’ai fait parti de la fuite des informations chez Desjardins. On m’a également fraudé via une fuite de donnée sur PlayStation Network
I purchased an item from a site advertised on Facebook which stole my credit card, but it was flagged and fixed within a week
Purchased software that did not do anything.
Item sold on website but never shipped. Was a fake website
I had someone login to my Netflix account however I think that was a problem on Netflix part . Either way I think it’s smart to change passwords once in while
My RBC credit card got hacked on my Facebook Ad Manager. They ran $3500 in bogus ads redirected to their affiliate sites. It happened at Christmas when people are general not working and viewing accounts.
Large-scale data breach attacks where company's data was stolen from the company through their negligence. Government data breaches by its negligence (student loans).
Google play cards but stopped short of giving codes so not out money just have stupid cards!!
Oui vol de carte de crédit plus de 5 milles dollars
Stolen credit card information after purchasing from an online retailer
small credit card charges with vague names hoping they go unnoticed
I have a check for 1900 dollars on my fridge. It's fax. I was sure it was and bank confirmed it.
Once I was scammed on a kijiji purchase where the seller took my money and failed to deliver - the police were useless even though I had the person's information.
When I was a minor I fell for the microsoft virus scam parents lost a lot. Never again.
Had money stolen from by bank account wheel someone managed Troy hack my PayPal account
Placer pour pour l’argent sur le net et c’était une firme de frondeur
I lost money on a site that had Elon Musk advertise his AI trading Platform. Once the company had the money they closed the web site. I lost $300.00
Fake web site, purchased an item - never received.
Password breach led to unauthorized access to an account.
J’ai acheté un produit inexistant suite à une publicité alléchante sur les médias sociaux
Video game account was stolen in 2008. (World of Warcraft)
Vente en se servant de l’identité d’une personne mediatique
Une commande dans Facebook qui ne reflétait pas la définition décrite
Un arnaque de 3 milles dollars on m a suggérer un emploi dont je devais faire des achats en magasin. J'ai reçu un chèque pas de fonds. J ai dû rembourser la caisse.
Trop long à expliquer fraudé de 2,000 en Argent et 3,000 sur ma carte de crédit visa de la caisse Desjardins j'ai 72 ans et je dois rembourser pendant 5 année 4,000 dollars pas de pitié pour les aînés vulnérables j'ai pleuré m'a vie je commençais juste à être bien et heureuse dans ma vie je pourrais écrire un livre.
Tricked to open my bank acc.. money was moved out
tricked into building investment trading platform at no cost however $$ were required to withdraw potential money that grew in account. But, money was never going to be withdrawn and sent to me even though I paid $$ to withdraw it.
transferred money from a personal bank account to an account in another bank in which I have an account
Transaction suspect récurrente sur ma carte de crédit. J'ai dû changer de carte
They tried to hack my bank account but were not able to
The Instagram app on my phone is requesting access to my other devices on my network. This is incredibly scary to even allow companies to do this as it puts security risks in companies, government officials, and normal people at home.
The CRA once allowed someone to file my taxes and corrupt my information. They claim it may have been a case of identify theft. I'm not sure.
Tentative d’hameçonnage par internet. L’objectif était d’avoir acces à mes comptes de banque.
Telechargement de mon dossier Doc suite a l'installation d'un trojan. installé par mégarde
Someone got access to my computer, threatened to send my (porn) photos to everyone on my contacts list (even though I didn't have any) in exchange for Bicoins - I ignored it unplugged my cable, they eventually stopped.
SIM card jacking where phone number was ported away.
Received an email receipt for something I didn't order.
Purchased from fake pandora site after doing due dilligence to check it out. I still got duped
Purchased a clothing item from a scam site
Posts selling things on Facebook and the person asking for deposit
pleaseanswer.com comes up with you search Microsoft and they charge you
PayPal had something at their end that allowed someone to charge my credit card my account hundreds of times over the course of a day. I was able to have my credit card insurance pay the charges and I immediately removed my credit card information from my PayPal account.
Payer pour tchatter avec des personnes intéressantes qui proposent une relation amicale ou sentimentale.
Paid extra money for an application that I didn’t need to have.
Package delivery delays updated information needed
Ordered items from a site and never received the item. Then found charges on my credit card that I did not authorize.
One time a very very long time ago when internet just came out. Still using dial up
On avait piraté mon compte yahoo… dernièrement aussi, on avait failli m’avoir encore, je recevais les messages de l’autoroute 25 me demandant de payer des factures par SMS
My shared work computer was hacked a few weeks ago by a keystroke malware. The whole computer had to be wiped clean, as did our external hard drive as they corrupted it too. They hacked my work email and sent out a phishing scam pretending to be me. They deleted all of my contacts and past emails too. I’m still in the process of changing all my work accounts with our wholesalers as we needed to get an entire new email account and close down the old one.
My Instagram account was hacked by a Ukrainian, but I was able to get it back pretty quickly
J’ai acheté en ligne un produit peu cher et le site a continuer à prendre des versements. J’ai du changer de carte de credit
It was a phone scam. They said they were from the fire department in my bank. They had all 16 digits for my bank card number so I believe them about the 16 digits of my bank card off my Apple wallet they broke into.
Investment scam about quantum trading 340.00
I thought I was using a trusted Bomgar site but realized I had somehow been switched to a scam site. I immediately took my laptop to a computer repair guy who cleaned it
I suspected the transaction and halted it before the sale
I have entered my visa on a site that wasn't secure n had money taken out of my bank account
I fell for an Instagram ad selling a product that didn’t exist.
I believe my online activity is completely available to masses all the time
I accessed a malware site by accident that froze and crashed my computer and cost quite a bit to recover from. There was no payment to the criminals though.
Had money taken from my account without permission
Had a weak password. Someone logged into my paypal and used my credit card to make purchases online.
Googled a company but clicked on misleading link
Forgot to cancel the continuing until canceled.
fell for fake vendor website and input credit card info
False advertising for on line promotion- difficult to get out of
Fake sales website, bought a non-existing product
Fake retail website that never sent the items I had purchased.
Fake e-transfer, and they hacked my bank account
Facebook selling product I paid for but never received
Diffusion de mes données personnelles avec Desjardins.
Deal too good to be true. $60 Balsam Hill Christmas Tree
Credit card numbers used but I had alert coming in so was able to contact cc and they were able to stop the transaction
Compromised credit card. Also, bought an item that was entirely different from the one they sent me. No refund available.
Charged $250. after ordering a $1. Sample of moisturizer. Fortunately VISA reversed the charge & I unsubsidized. I didn't know I was subscribed- don't remember signing up.
called airline after missing connection (googled phone number). paid fee for rebooking. unsure how they got their phone number to be the first hit on google... but it worked
Bought product and did not receive AND being charged twice for 1 product.
Bought one item but was charged a monthly fee for products I did not want or order
Bed bath and beyond bankruptcy clear out sale which was a hoax.
An old account I had not used in a long time was compromised and some rewards points were stolen
An attempt on a dating app, but I knew so I toyed with him.
Achats faits avec ma carte Visa Desjardins suite au vol de données avec mon ancienne adresse mais Desjardins m'a tout remboursé et a fait les démarches.
Achat sur un faux site (boutique en ligne)
Accidentally downloaded an anti-virus program I thought was legitimate, but it was fraudulent; laptop had to be fixed
A government system was hacked. They took my email and faked several purchases online.
A facebook marketplace data farmer was able to get my address from me when he genuinely seemed like he wanted to purchase something off me.
A email from a friend (fake) asking for an Amazon card for a niece of hers. She is not tech savvy so I believed it.

qcce3_4_ -- Other, please describe : What is the main reason you reported a phishing scam? If you have lost money/data more than once, please think about the most recent time this happened.
Self-control. I wanted to find them & deal with the situation myself. Decided to do it the legal way. Didn’t help any, of course.
I was tricked into providing my credit card info but my bank caught it and cancelled the transactions and issued me a new card.
It was a steam account with thousands of dollars worth of games on it

qcce4_9_ -- Other, please specify : What is the main reason you didn't report the phishing scam?
Je n'ai pas mordu, et je n'ouvre pas ses courriels
C’est du vole dans un jeu vidéo donc peux importante même si la valeurs des équipement est de plus de 300$

qct2_10_ -- Other (please specify) : Why don't you think it is likely that you will be affected by a cyber threat?
J'ai énormément d'expérience à identifier les arnaques sans tomber dedans
Full Norton Security purchased after I got hacked.
I use a VPN, of an age I grew up with Internet “street smarts”, my friend in IT thinks I’m a bit “overkill”
Hope for the best, but can't control everything
We have a very robust cyber security policy at work
Have completed regular security training through work
very careful cynical and suspicious and I catch attempts almost daily
Important files are backed up so I can wipe my PC anytime. Also, Blood from a stone. I have nothing they want
Both apple and Linux are susceptible to viruses but I try to keep my Linux install as up to date as possible
Offline backups of data kept every few months. A compromised device can be wiped without as much loss.
Thorough backups kept separately; they can't hold data I care about hostage if I have airgapped copies
For sensitive information like banking or government there are multiple layers of MFA. The chances are only if one password gets hacked and someone spends their time cross refering me. I'm not a bountiful target too.
don't have any high value data or a significant amount of money
Scan untrusted files with malwarebytes and/or run them in a sandboxed environment for testing
I’m generally safe. Things can happen for sure, but I’d say I’m less likely than the average person
Il me semble n'avoir rien d’intéressant pour ces gens
I keep my privacy very seriously and keep my personal information and pictures off the internet. I wish the government would do the same.
Do not use critical info computer on internet

qct3_9_ -- Other (please specify) : What kinds of cyber threats are you most concerned about?
They're all the same to me. If you don't send nudes, no one can blackmail you with them lol. A scam is a scam. If they get my banking info, then I did the best I could. I would sort it out no matter how many years it takes.
3rd party hack for ransom like at British library
Infrastructure failure that impacts quality of life
Aware of all, take precautions as best I can to not live in fear
Anything AI. It is almost exclusively a tool of harm.
Threats to large organizations and governments.
Government intelligence agencies stealing from me via ransomeware or extortion or character assassination.
Piratage des bases de données de grande compagnies ie Desjardins
All the above APT nuts all them who break the will be reported period
My parents’ cybersecurity and vulnerability.
Informations protégées par des institutions (caisse populaire, equifax)
really clever messages masquerading as real messages from normal trusted sources
The government restricting our speech, spying on us and censoring what we can access in the future.
Most companies are trusting third parties with their information so I am concerned these cloud services are big targets to be compromised. Happened with my Sony account a few years back. Also the more we are forced to use online banking the more likely it will happen. I am holding out on online banking as long as I can.
Government 3 letter agencies with zero day exploits at their disposal
I’m more worried about loss via government agencies or institutions which store personal data. I want ALL MY DATA decentralized.
Government intervention, interference, or just plain seizing of finance or data
The government of Canada stealing my money and my bank accounts
Mailicious terms of service updates, corporate aquisitions
Je n'est aucune confiance en l'indemnité numérique instaurer par le gouvernement Legault
I’m worried more about 3rd party breaches (I.e. my financial institution getting hacked and my personal info stolen)
I have my company computer and it’s managed by them. So security is managed by IT department
Government or business entity failing to adequately secure my information.
An attack on an institution that has my personal information.
Accounts breached at the service provider level. Already happened a number of times.
A virus that mines cryptocurrency for a third party using my machine without consent or compensation

qct5_10_ -- Other (please specify) : Why do you feel not prepared to face cyber threats?
Advice I have received seems too complicated, unrealistic to accomplish
Because the hostile intelligence agencies are too well funded and are above the law.
Il est impossible de se protéger complétement d'un prédateur.
There are new scams that we may not have heard about
It’s a moving landscape and I feel like with the breakthrough in AI, there will be more and more crime
If the Toronto library can be down for weeks because of an attack not sure what a single person can do
I give private information to banks, Google, Mastercard, PayPal, Amazon, retail stores, Revenue Canada,etc and these places can get hacked, thus, my electronic information can be used by “bad entities”. I can’t control how secure my information on sites are kept.
I don't know how I would fix it if it happened.
I don't have the skills to protect myself, and trusting others isn't always ideal
I am not savvy technically I'm a senior and I'm not comfortable with the language used on computer
Extra expense I don’t want/can’t pay for.
AI has changed the face of cyber threats and it is progressively getting stronger at breaking security barriers

qct7_12_ -- Other (please specify) : If you knew or suspected that you'd been a victim of a cyber attack, what steps would you take to protect yourself?
Track attackers with same sofwares and methods they use ? Reverse ingering ? Kali Linux? Maltego ?
Reinstall all affected operating systems from scratch.
Factory reset my device and restore to an uncompromised backup
No point. You cannot defend yourself from a hostile intelligence agency. They are too well funded and are above the law.
Depending on the breach, reach out to site where attack occurred to let them know it happened. Others may be affected too and unaware. And the site may need to investigate/beef up security on their end.
There are various types of scams that have contacted and targeted me trying to get me to release sensitive information and I refused
i generally never fall for scams or phishes, but there was one time i was dumb enough to trust a classmate's program. should have known it was sketchy based on the node.js icon lol
Depends on nature of the attack. Appropriate measures to respond to threat.
Run malware removal software, contact customer support for affected accounts
Email the RCMP link to advise. I’ve done this twice
La correction d’une attaque est différente selon le type
Notify my company's IT department immediately.
Nemo me impune lacessit, I will find the scoundrel.
Some of the above. First thing, I would log out of all of my accounts, bank, social, membership and change my passwords. Second, I'd inform my bank. Third, inform relevant government agency.
my daughter and I would carefully audit our system and devices one at a time in safe mode off line
Depends on the type of threat but generally would involve all of these depending on what I'm dealing with
Potentially any of the above, depending on specifics
If it was necessary I would contact the police
I’d contact my son who is an IT specialist
warn others about the threat so they can protect themselves.
Steps would be taken dependant on nature of cyber attack
So many options are entirely dependent on scope of attack. For example... Random virus? No point involving police. Targeted yes.
research what to do based on the specifics of the attack
Reinstall my operating system after wiping my drives
Once of prevention....Don't connect everything together, dodge ""conveniences"" like 'tap' on cards, NFC on devices
J'appellerais le centre Anti-Fraude Canada
it really depends on how serious the breech is
If computer taken over I would re-image it and start over
Identify what was compromised and who would need to be contacted about that.
I would not know who really to turn to if scammed.
I had a computer that had a bug put in it. I shut it down and it does not get commented to the Internet any more. (Fortunately, it was only on temporary use at the time). Some day I will get my IT guy to do something.
Forensically assess im0acted devices using DFIR techniques
Fermeture d’un compte en ligne ça m’est déjà arrivé
Do a manual inspection of the contents of my hard drive to remove all traces of a particular strain of malware before then letting antivirus software comb through the rest of it.
Disconnect my network from the internet.
Destroy hard drive then buy new drive, or BIOS wipe computer.
Depends on the type of attack but i might have to go to my backups
Depends on the type and severity of the threat
Débrancher ma connexion Internet, faire une analyse de virus et autres
Contact support team for site I lost access to.
Contact or download cyber security software services
Ça dépend de la situation… je ne prendrai pas les mêmes mesures dans toutes les situations
Block all emails, and soft reset my Device
All my accounts have multifactor and notify me of logins, if I suspect I am a victims I would monitor account activity and run virus scans

qct9_11_ -- Other (please specify) : If you were a victim of a ransomware attack, what would you do?
Do not pay. Accept the loss, salvage components from my PC.
I'd call their bluff. If they have my info., they wouldn't be asking for money for it back. They'd just take my money.
Nothing. I have nothing online worthy of paying ransom for.
I might wipe my hard drive and restore a backup (if the backup is recent enough)
Dependent on type I may format computer, especially if especially pesky malware/virus.
I don't keep any important or personnal information on any devices. Go ahead, lock the device, I'll just have it wiped out anyways and start fresh.
If my banking information was compromised I'd contact my bank, other than that I don't think I have data valuable enough to ransom
I do whatever is right in the eyes of law and goverence! I am not much talker but actionable person as long nuts ATP and hackers are in prision
Either restore from backup or pay ransom
Ask my husband who works in IT what to do
I will not follow scammers instructions to get infected.
Document the message (e.g. screenshot), disconnect and change passwords, contact relevant government agency, i.e. police
my daughter and I would complete an audit of our system and devices one at a time in safe mode off line
I don’t keep information on my computer, so I would just reinstall my computer. Probably.
Wipe my computer and reinstall from my backup
Wipe hard drive and restore from back-up
When the attack is directed towards my personal information but is also outside my control, there is nothing I can or wish to do.
Warn friends and encourage them you upgrade their protection
Turn off the affected device and try recovering data from backups or other tools.
there's isn't much that can be done other tha having your data backup somewhere else as a precaution
The exact same thing as the last question I answered….
Tell them to go fuck themselves they are not getting my money.
Shit computer down and format and reinstall windows. My critical data is stored on my raid 5 nas which also has a backup.
Restore from backup with Timeshift, a Linux program.
Reload backup for the compromised device
Reimage my computer and accept that my files are lost
Reformatter mon disque dure et récupérer ma copie de sécurité.
reformat, reinstall and restore my last backup
Nothing. I don’t have data that’s worth anything
Might as well pay the ransom if my information would be valuable enough to me
Just format my whole computer and reinstall everything
Irrelevant, nothing important enough to care about is saved locally.
If the ransomware affects a local device, factory reset it.
I work in it security so call in one of my security friends to scan my machine
I was avictim of this before it became more sophisticated. Back then, I just removed the user on the PC that they targeted and reported them to the company they were trying to get money through. So I'm vulnerable but it's already happened and they already failed.
I don't know all the answers, so possibly some of the other stuff after research and asking my IT expert
Erase hard drive and reset from automatic back-up drive
Ensure the ransom group has not compromised online accounts or other devices, and wipe snd recover the affected devices.
Effacer tout mes disques dure et réinstaller mon ordinateur à partir de copies hors ligne de mes données personnelles.
disconnect the hard drive to access it externally. The problem would be to find the key used for encrypting the information.
detruite le stockage où le logiciel s'est installé
Contact the police and my bank immediately
Contact the company that was responsible for protecting my data. I don’t store valuable data on my own servers.
Call an IT specialist who’s focus is ransomware attack
Buy a new computer and reload my data from the cloud

qbus1_2_ -- Another employee (specify role in company): Who is responsible for your company's IT?
Husband, works in security, biometrics etc.

qbus1_6_ -- Other (please specify): Who is responsible for your company's IT?
Division of responsibility/ authority etc.
Utilize staff that are IT proficient before going to outsourced IT company
Mon frere est technicien en informatique à son compte. Je l'engage comme TI à distance

qbus3_15_ -- Other (please specify): Which of the following types of information do you think your company would benefit from having in order to protect itself against cyber threats?
All are valid, generally already in place at my firm
have my banks and governments stop using microsoft windows
turn off all devices when finished and at night
Stricter penalties for the people who benefit from stealing from others. Better ways to get compensation for the victims.
Not a big user of putting my business online.
I am the only employee, so I do not need any of these things that focus on managing other people's interactions with cyber threats.

qbus6_10_ -- Other (please specify): What, if anything, has your company done to protect itself from ransomware attacks?
Nothing about my company relates to this.

qinfo2_11_ -- Other (please specify) : How do you prefer to get information to protect yourself from cyber threats?
Websites would need to be trustworthy such as generated by a government department.
Webinars on the topic, info from family members, contact IT security specialist
Uni. I just don't give out info. If they somehow retrieve it from me and take my money, that's the bank's problem for lack of security and I will.get it back no matter how long it takes.
Trying to understand the basics and advance of how the soware programing and all bases works to know how to trouble fix anything by my self instead of relying on some software or someone else ? Dah
Through a non online source. The radio would be trustworthy and effective.
This should not all be my responsibility; there needs to be better legal protection and law enforcement
There are great books on the subject, some podcasts from cyber specialists. I totally avoid social media misinformation since the source is anonymous. I'm paranoid of social media, never use them.
Talk with my more tech savvy friends and ask them to check over my devices for anything I might have missed
Séminaire et formations fournis par mes employeurs/le milieu académique
practical information sent by email from a trusted or government source
Personal knowledge of the way technology works.
Official information from device manufacturers and software companies.
None of these sources of information deal with the real threat of state sponsored actors engaged in information war. The government of Canada is the most hostile nation to my privacy and security.
Newspaper and magazine articles, books, essays, long form prose, poems
News. Websites with history of trustworthy info that are not blogs or social media (lol)
news and updates from my malware/anti-virus/security companies
My workplace drills cybersecurity into our skulls. Constantly test us.
My work regularly mandates cyber security courses
My son works in internet security. I rely on his expertise to keep safe
MY COMPANY SPECIALIZES IN RISK MANAGEMENT
La base de la sécurité informatique est les habitudes de navigation prudentes. Informer les gens sur les bonnes habitudes de navigation est plus important que de parler des menaces individuelles
Je demande à un ami en qui j'ai entièrement confiance
J’apprends mieux en testant directement. Notre entreprise envoie souvent des courriels tests d’hameçonnage et aux 2 semaines nous avons des formations en ligne sur la cybersecurité, qui sont suivies de tests et d’évaluation.
I use a vpn, i vary my passwords frequently, i dont click on weird emails and i report weird emails and phone calls. I update my os and apps regularly. If we all did this there would be no problem.
I receive lots of info from work because of my job
I prefer your own internet provider and your phone company
I have tech support and I recently spent one full week researching all I could do to increase my internet security.
I have family members who do cybersecurity as a career and are willing to help me with any cybersecurity questions and protocols.
I have a few friends more interested in tech fields I could ask
I don’t want to be responsible for this, at home and certainly not at work!
i don't really ""get information"". i work in the field so i just kind of know.
how I get information to protect myself never comes from social media never!! podcasts very little under 1%% I research the information and most of information comes directly for crediable goverence law activities example government of canada governments cisa many various levels
Have a technology genius friend to turn to
Group chats with security professionals.
From our very competent IT professional at work; word of mouth outside work.
From my kids, when they get current info they help me
Friends working in IT/cyber security fields
Exposure at a Young age to a Cyber attack
émission comme ``les Décrypteurs`de Radio-Canada
Document officiel du gouvernement en format papier
Did cyber security training at past jobs
Consult the elder gods/stare into the sun.
Checklists, could be via email + examples on how ppl were caught unaware. The latter helps to take appropriate steps. Free, trustworthy security scan software wouldn't hurt. Better legislation. For instance, social media don't protect their users...
Call my son with computer science degree
Bulletin de nouvelles à la télévision (informations régionales)
Being private and not putting sensitive information online

qgcs2 -- What is the name of the campaign?
SafeSurf Canada: Your Passport to Secure Internet Navigation
NIST (US) Little black book of scams GCA
I don’t remember the name of it, but I’ve seen a PSA/ad on TikTok in regards to online security. I believe it was geared towards teens posting/sending explicit images of themselves/others
The Canadian Cyber Information Protection Organization (C.C.I.P.O)
Cybersecurity and public protection campaign?
Get cyber safe or keep Canada cyber safe
La securite au dela du bureau . Sensibilisation a la securite 2024.

qgcs4_7_ -- Other (please specify) : Where did you see, hear, or read this?
There was an ad that would play before videos but I haven't seen one in a long time