Not all everyday communications require strict privacy. Most of us prefer privacy, of course—few people want their dinner plans published for the world to see—but there are typically no consequences of exposure greater than mild embarrassment (McDonald’s again?). But even ordinary people regularly need to share information that could damage their relationships, finances, or careers if it fell into the wrong hands.

Passwords are the most obvious example because their entire point is secrecy. But other sensitive data includes credit card details, bank account numbers, tax documents, retirement planning materials, and health-related information. When you need to share such data, how do you do it securely?

Data at Rest and in Transit

Before exploring specific solutions, you need to think about how information is protected when it’s in transit between systems and when it’s stored somewhere:

In transit: To prevent eavesdropping, focus on communication channels that are encrypted between you and the destination:

• Between your app and a server: Nearly all Internet-enabled apps, including all Web browsers, use SSL/TLS to protect their connections to servers. A lock icon in a Web browser’s address bar indicates HTTPS encryption, or you can look for https at the start of a website’s URL.
• End-to-end encryption: Even better is end-to-end encryption, which ensures that not even the service provider can decrypt your traffic. iMessage (blue-bubble conversations), WhatsApp, and Signal provide end-to-end encryption protection (though WhatsApp archives are readable by other Meta apps). SMS messages are not encrypted at all, and RCS conversations only support encryption with the latest Apple and Google updates, plus carrier support. Both SMS and RCS appear as green-bubble conversations.

At rest: Stored data—whether on your computer, at remote email servers, or in the cloud—needs protection too. Two approaches help:

• Per-file encryption: Encrypt data before sending so even if an attacker figures out how to access the file, it can’t be decrypted without a password. Send the password through a completely different communication channel (called “out-of-band”)—for example, share an encrypted file via email but send the password via Messages.
• Time- or access-expiring links: Send a link to the information that expires after a short period or after a limited number of views, thereby shrinking the window during which a breach could occur.

Choosing the Right Solution

The best approach for any given communication depends on four factors:

• Audience: What are your recipients’ technical capabilities? Messages is easy and secure, but only Apple users can access it. Email reaches everyone but offers less protection. A password-protected PDF is probably easier for less-technical users than an encrypted disk image.
• Content type: Sharing a password differs from sharing a document, which in turn is different from sharing a collection of files.
• Importance: How problematic would it be if the sensitive information you’re sharing fell into the wrong hands? There’s a world of difference between the password for a club discussion forum and the credentials to your retirement account.
• Persistence: Does your recipient need to glance at something only once, or do they need to retain a copy permanently?

Eight Secure Sharing Methods

With all that in mind, here are eight secure methods of sharing information that you can employ in different situations:

1. Use a secure portal when available: Doctors, lawyers, accountants, and other professionals who regularly receive sensitive information often use secure customer portals or services like DocuSign for sending messages, documents, and files. Use whatever system they provide unless you have good reason to doubt their IT competence.
2. iMessage, Signal, or WhatsApp: For quick sharing of sensitive information, these end-to-end encrypted messaging services work well. They’re particularly useful for sending information that isn’t useful on its own—for instance, send a login URL and username via email but the password separately via Messages.
3. Self-destructing links: Services like 1ty.me and One-Time Secret generate encrypted links that contain text. Once the recipient views the link, the server deletes the data, and the link self-destructs. If the recipient reports the link was already used, you know it was compromised. Be aware that some email systems automatically scan links, which could trigger premature self-destruction.
   
4. Password manager sharing: 1Password, Bitwarden, and some other password managers (but not Apple’s Passwords) offer secure sharing features that make it easy to share credentials with someone who needs to access a particular account. You can create links with expiration dates, limit access to specific email addresses, and cause links to self-destruct after being viewed once.
   
5. Password-protected PDF: For documents that could be printed, create a password-protected PDF. From nearly any app, choose File > Print, click the PDF menu at the bottom, and choose Save As PDF. In the Save dialog that appears, click Security Options, select “Require password to open document,” and enter a strong password (online services can remove weak passwords). Share the file however you like, but send the password through a different channel, preferably via an expiring link.
   
6. Password-protected disk image: For Mac users sharing files that can’t easily become PDFs, or for sharing collections of files, create a password-protected disk image. In Disk Utility, create a new compressed disk image (File > New Image > Image from Folder), choose an encryption option (256-bit for more sensitive information), and enter a strong password. Again, share the password separately, ideally via an expiring link.
   
7. Password-protected Zip archive: A password-protected Zip archive serves the same purpose and may be easier for Windows users to extract. Apps like Keka and BetterZip can create these. For the fastest approach, open Terminal, type zip -er ~/Desktop/filename.zip (with a space at the end), drag in the files you want to compress, press Return, and enter your desired password when prompted.
8. Time-expiring cloud storage links: Some cloud storage services offer links that expire after a specified time. Dropbox Professional supports this feature, enabling you to share files while ensuring that links become useless in the event of a breach.
   

There’s no one-size-fits-all solution for securely sharing sensitive information. Match your approach to the sensitivity of the data, your recipient’s capabilities, and how long they need access.

(Featured image by iStock.com/metamorworks)

Social Media: Need to share passwords, financial details, or sensitive documents securely? Email alone isn’t safe enough. Learn eight practical methods—from self-destructing links to encrypted disk images—that protect your data in transit and at rest.

The chat interface that today’s AI systems still rely on has become more of a control panel than the system itself. What happens after you press Return may involve Web searches, file analysis, code execution, connected accounts, and even digital-world actions—all orchestrated behind the scenes. You need to understand what’s happening behind the chat box to evaluate the accuracy, quality, and utility of the answers that appear there.

Under the Hood of an AI System

The capabilities of a modern AI system include:

• Models generate text, analyze images, and work through problems. This is the traditional “AI” part, but it has improved hugely through better training techniques, longer conversations and documents, and extended reasoning time. Cutoff dates for training models remain an issue—some AIs think macOS 26 is still in beta.
• Retrieval pulls information from the Web, uploaded documents, or connected data sources. When an AI cites a source, it’s usually because retrieval happened. However, it’s still essential to check cited sources carefully because the URLs may be broken, and even when pages exist, they may not support the claims.
• Tools handle tasks the model can’t do on its own, such as analyzing numeric data, running code, creating visualizations, or searching databases. For many types of requests, the AI will write a script or call a tool to handle the work, dramatically increasing the likelihood that the results will be correct and making it easier to refine them.
• Connectors link AI systems to external platforms such as email, calendars, file storage, and Internet-hosted applications. They’re necessary so a system can work on personalized data (“Give me a timeline of the deliverables on the MacDavis project from our email conversations.”) and to connect with business data.
• Actions let AI systems do things in the digital world: send messages, create events, modify files, and interact with other software. Here is where AI stops merely advising and starts affecting real systems, so the safeguards need to be much stronger.

These capabilities don’t always appear together. A simple chatbot exchange may rely only on the model’s training. A research request may add retrieval and tools so the AI can search current sources, summarize what it finds, and run calculations or create charts. A workplace copilot may add connectors to email, calendars, cloud storage, customer records, or internal databases. A full-fledged agent adds actions, enabling the system to operate on your behalf.

It’s important to understand all the possibilities because each layer changes both what the AI can do and how much you should trust it. A model-only answer calls for skepticism (and perhaps a search). A search-based answer needs source checking. A tool-generated answer requires checking the inputs, method, and results. A connector-based answer warrants attention to the source of the data (and whether the permissions are too broad). And an action deserves a preview, an approval process, and ideally a way to undo mistakes.

What This Means for Trust, Privacy, and Control

This evolution from chatbot to assistant generally yields better results, but it also comes with new risks:

• Privacy isn’t just about what you type. It’s about what files you upload, what accounts you connect, and what the AI system can access. Putting confidential data into an AI could be problematic in numerous ways, not least regulatory compliance.
• Accuracy varies by task. Responses drawn purely from training data may be outdated or flat-out wrong, while search-informed answers reflect current sources. Asking an AI to “Confirm with a search” is a good way to get it to reassess what it has written with current information.
• Actions have consequences. When AI can send email, modify files, change settings, or interact with business systems, mistakes can have outsized impacts. This is why we strongly recommend caution about OpenClaw-style agents: giving any AI broad access to email, messaging, calendars, files, and applications creates security and reliability risks. Always preview any action—or AI-generated script you’re running externally—whose results could be difficult or impossible to reverse.
• Confidence isn’t correctness. AI outputs can sound polished and authoritative even when they contain errors, outdated information, or subtle misunderstandings of your intent. Any AI-generated work that informs decisions or will be seen by others deserves human review. Just as you wouldn’t base anything important on the work of a summer intern without checking first, you don’t want AI-generated work to go out if you can’t stand behind it.

For individuals, how you react to these risks mostly comes down to verification and restraint: check important sources, review important outputs, and don’t let AI take irreversible actions without approval. For organizations, the same principles must become policy because employees may already be using AI tools with company data without IT’s knowledge. To get ahead of the issue, organizations should:

• Audit what’s already happening. Talk with employees to find out what they’re already using, inventory online apps with embedded AI features, and check browser extensions, which often fly under the radar.
• Classify workflows by risk. Not all workflows need the same level of attention. Low-stakes tasks like brainstorming and text editing can proceed with commonsense guidelines. High-stakes outputs—client communications, financial analysis, security configurations—need human review before they go live.
• Evaluate tools carefully. Before approving any AI tool for general use, understand what data it accesses, whether it trains on your inputs, what actions it can take, and what logging is available. Most paid tools won’t train on your data, or can at least be configured not to, but the more important your data, the deeper your research should go.
• Create clear policies and train employees. Define which tools are approved, what data can be entered into AI systems, when human review is required, and what’s prohibited. Employees need practical guidance on how to apply the policies to their actual workflows. Don’t assume that an email or two is sufficient—training is essential.

The biggest mistake people make about AI today is underestimating both its risks and rewards because they’re still thinking about ChatGPT from 2023. The chat box may look the same, but it now sits in front of systems that are vastly more powerful, meaning that it’s more important than ever to consider when to trust them, when to verify them, and when to keep them at arm’s length.

(Featured image by iStock.com/tadamichi)

Social Media: Still thinking of AI as just a chatbot? Today’s tools search the Web, run code, access your files, and can even take actions—all triggered from the same chat interface. The results are better but come with new responsibilities.

That’s the promise driving the recent surge in popularity of OpenClaw (formerly known as Clawdbot and Moltbot), which is now all the rage in tech circles. Token Security found that at least one person is using it at nearly a quarter of its enterprise customers, mostly running from personal accounts. That’s a shadow IT nightmare—employees connecting work email and Slack to an unsanctioned tool that IT doesn’t know about and can’t monitor. Whether you’re an individual tempted by OpenClaw’s promise or a manager wondering what your users are up to, you need to understand the risks these AI agents pose.

OpenClaw is an AI agent built around “skills”—installable plugins that let it integrate with your messaging apps, email, calendar, and more. You communicate with OpenClaw via Messages, Slack, WhatsApp, and similar apps. Because it’s open source, you’ll need to provide your own API keys for AI services like OpenAI or Anthropic, which means ongoing costs that can add up quickly—people have reported spending $10–$25 per day.

The more serious problem? Security researchers have discovered serious vulnerabilities, including misconfigured instances exposed to the internet that leak credentials, API keys, and private messages, and a supply chain vulnerability where malicious skills uploaded to the ClawdHub library can execute arbitrary commands on users’ systems. Even beyond specific bugs, OpenClaw’s fundamental design encourages users to grant broad access to sensitive accounts.

Why AI Agents Are Risky

Security concerns aren’t unique to OpenClaw—they apply to any AI agent that acts on a user’s behalf. Here’s what’s at stake:

• Credential exposure: For an AI agent to send emails, manage your calendar, or post to Slack, it needs your authentication tokens or login credentials. If the agent software stores these credentials insecurely, or an attacker gains control, they could be exposed.
• Prompt injection: AI agents work by following instructions, but they can’t easily distinguish between prompts and data in the content they use. A class of attacks called “prompt injections” trick AI systems by hiding malicious content in emails, websites, or documents that will be processed. An attacker could embed instructions in an email that would cause your agent to search for and forward email messages containing passwords or financial data, follow links to malware sites, or take other harmful actions. There is currently no foolproof defense against this class of attack.
• Data exfiltration: An AI agent with access to your email and your computer’s filesystem could be manipulated to extract information from elsewhere on your computer—financial data, customer lists, or personal details—and send it to an attacker.
• Unvetted extensions: OpenClaw and similar AI agents let users install “skills” or plugins to extend functionality. Libraries that allow users to share custom skills often have minimal or no security vetting, making it easy for attackers to submit poisoned skills. Installing such a skill could grant malicious code access to everything your agent can touch.
• Exposed control interfaces: Security researchers found OpenClaw control servers exposed on the Internet, potentially leaking API keys, VPN credentials, and conversation histories. This risk is unique to OpenClaw at the moment, but future AI agents may suffer from similar vulnerabilities, particularly as they’re adopted by less technically savvy users.

How to Reduce Your Risk

We’ll come right out and say it: we strongly recommend against installing OpenClaw or other AI agents on your Mac. In a year or so, Apple may have updated Siri to provide many of these capabilities with significantly stronger privacy and security. But for now, just say no.

If you decide to use AI agents despite these risks, here are practical steps to protect yourself:

• Use dedicated accounts: When possible, create separate accounts specifically for agent use rather than linking your primary personal or work accounts.
• Limit permissions: Grant the agent access only to accounts it absolutely needs. If you only want help with your calendar, don’t also connect your email and messaging services.
• Avoid connecting sensitive services: Never connect anything involving money, healthcare, or confidential business information. The liability is too high if something goes wrong.
• Review agent actions: If the platform offers logs or activity feeds, check them regularly. Look for unexpected messages sent, files accessed, or connections made.
• Vet extensions carefully: Don’t install skills or plugins from unknown sources, and even with known libraries, look for evidence of others using and reviewing the skills. Treat skills like any other software you’d install on your computer.
• Keep software updated: Security patches for OpenClaw and similar tools address known vulnerabilities. If you’re running an agent, keep it up to date.
• Run agents in isolated environments: Technical users should consider running agents in sandboxed environments or virtual machines to limit potential damage.

If you run a business, you should assume that some employees have already installed OpenClaw or will soon, and may have connected their work email and Slack accounts without realizing the associated risks. Here’s what you can do:

• Educate before it’s a problem: Proactively explain the risks to employees. People are more receptive before they’ve already invested time setting something up.
• Update acceptable use policies: Make clear that connecting work accounts to unsanctioned AI agents is prohibited, and explain why.
• Offer sanctioned alternatives: If employees want AI assistance, point them toward safer options that don’t require handing over credentials to sensitive accounts.

What About Claude Cowork and OpenAI Codex?

Not all AI agent platforms carry the same level of risk. Anthropic’s Claude Cowork and OpenAI’s Codex take a different architectural approach from OpenClaw. Rather than requesting authentication tokens for your email, messaging, and other personal services, they operate within their own controlled, sandboxed environments. These systems work primarily with files, code, and data you explicitly place into their workspace, which substantially limits the fallout from an attacker gaining some level of control.

This containment approach reduces risk, but does not eliminate it. Prompt injection remains a concern whenever an AI system processes untrusted content, even inside a sandbox. An AI agent analyzing a malicious document could still be manipulated into taking unintended actions within its allowed environment. Similarly, any code generated by these systems—particularly code that touches the network or executes system commands—should be reviewed carefully to make sure it hasn’t been compromised by prompt injection.

The key distinction is scope. Claude Cowork and Codex are designed to operate within a defined workspace, whereas tools like OpenClaw require standing access to your most sensitive accounts. From a security perspective, a compromised sandbox is a recoverable incident; a compromised email or messaging account may not be.

The Bottom Line

AI agents promise a lot and may provide genuine convenience, but at a cost beyond just paying for API tokens. Before you or anyone in your organization connects an AI agent to sensitive accounts, consider: What’s the worst that could happen if this system were compromised by an attacker? If the answer involves passwords being stolen, private email being exposed, or photos being posted to social media without your knowledge, proceed with extreme caution. If you can imagine a way financial accounts could be accessed or business data stolen, don’t proceed at all.

(Featured image by iStock.com/Thinkhubstudio)

Social Media: AI agents like OpenClaw promise to automate tedious tasks, but recent security vulnerabilities highlight the dangers of using them. Learn the risks and how to protect yourself—and your organization—if you choose to use an agent.

(Featured image by iStock.com/Tero Vesalainen; article image by iStock.com/Boris023)

Social Media: Phishing has a new face—literally. Scammers can now use AI tools to fake voices and videos that look real. Before you act on an “urgent” request, look for audio or visual clues and verify through another channel.

This issue affects all major videoconferencing platforms—Zoom, Microsoft Teams, Google Meet, and others. Many organizations also use standalone AI recording tools that can join meetings as participants, such as Otter.ai, Fireflies.ai, and tl;dv.

No one should feel ashamed of using AI-generated meeting summaries, nor should these tools be categorically avoided. They’re undeniably helpful, allowing people to focus on the discussion instead of taking notes or worrying about forgetting action items. We know people who consider them life-changing.

However, the fact remains: unlike a person tasked with taking notes, these tools record everything, including pre-meeting chatter, small talk, and personal asides that a person would know not to include. Making matters worse, AI notetakers are often configured to distribute transcripts and summaries automatically to all attendees—including those who were invited but didn’t attend. While this helps people catch up on missed meetings, it can cause problems if the absent individuals were themselves the topics of discussion. And we won’t even get into the potential legal and HR implications of certain conversations being made public.

Practical Solutions

Given the utility of AI-generated meeting summaries, what can you do to reduce the chances of potentially embarrassing or problematic conversations being shared inappropriately?

• Warn attendees: Although most videoconferencing tools alert users that recording is happening, everyone is used to these notifications. For a more explicit warning, the meeting host can remind everyone that summaries will be shared with all attendees.
• Pause/resume recording: While not all videoconferencing and AI recording tools offer the option to pause and resume, it can be useful. The meeting host can wait to start recording until everyone has arrived and the pre-meeting chatter has died down, and then stop it once the last agenda item has been discussed. The challenge is that this requires the host to remember to start and stop at the right times, and any valuable conversation before or after these points will be lost.
• Restrict distribution: Another option is to configure the system so meeting summaries are sent only to the host, who can then review and edit them if needed before sharing with the rest of the attendees. The drawbacks here are the extra work for the host and the delay in participants receiving the notes, which can hold them back from starting on action items.
• Watch what you say: Just as with social media posts, it’s important to think before you say something you might regret. If you assume that everything you say could be shared with your entire organization—including HR and your boss—you’ll be much less likely to get into trouble. Of course, this requires everyone to be sufficiently self-aware to avoid problematic topics.
• Use private channels: If you anticipate needing to discuss sensitive information with a remote colleague—the kind of thing you’d shut your office door to keep passersby from overhearing—use a private channel like a personal meeting room, direct message, or phone call. And if someone starts to say something problematic in a group meeting, gently suggest moving it to a private channel.

Although having AI-generated summaries of conversations you thought were private circulated to others may feel like a modern problem, variants have been around for a long time: the romantic message misaddressed to the company-wide email list, the list of layoffs left in the copy machine, or even a conversation that continues across stalls in the bathroom without realizing someone else has come in. Ultimately, all we can do is be mindful of what we say and who might hear it.

(Featured image by iStock.com/ArnoMassee)

Social Media: In virtual meetings, AI recording tools often capture and share everything—even those casual chats that occur after most attendees have left. Learn how to avoid having sensitive conversations broadcast to your whole team.

• ChatGPT: Go to Settings > Data Controls and turn off “Improve the model for everyone.”
• Claude: Navigate to Settings > Privacy and disable “Help improve Claude.”
• Gemini: Visit the Your Gemini Apps Activity page and turn off Gemini Apps Activity.
• Meta AI: Avoid it entirely, as it doesn’t allow you to opt out of training.

(Featured image by iStock.com/wildpixel)

Social Media: Don’t let sensitive business data become part of AI training sets. Here’s how to turn off training options in popular AI chatbots to protect your company’s information.

If you have an older non-smart TV that meets your needs, you’re in luck—an Apple TV provides streaming capabilities while avoiding the privacy concerns that plague modern TVs. For everyone else, here’s what you need to know about how TV manufacturers are monetizing your viewing habits and how an Apple TV protects you.

Data Mining: How TV Makers Profit from Your Viewing Habits

Arguably, the longevity of large-screen TVs has contributed to this trend. In the past, TV manufacturers focused on selling as many TVs as possible. Consumers see less need to upgrade when a modern 55-inch TV offers little beyond what a 15-year-old TV of the same size can provide. Sure, it might be a bit brighter, have better color accuracy, or provide higher refresh rates, but for most people watching streaming video in a dark room, such changes aren’t very noticeable.

In response, TV manufacturers have lowered prices to boost sales and turned to alternative revenue streams, including collecting and selling viewer data and displaying ads. Data can be sold to companies like Nielsen, a data and marketing measurement firm, and leveraged to provide advertisers with targeted audiences. Smart TV ad revenue is estimated to reach $46 billion worldwide this year, up 20% after another 20% increase in 2024. These ads appear on the smart TV’s home screen and in free, ad-supported streaming channels.

TV manufacturers track viewing habits using a technology called automatic content recognition (ACR). Software loaded on the smart TV captures frame-by-frame screenshots of content, creates a fingerprint for each frame, and then matches the fingerprint against an online database to determine what you’re watching. It works with all types of viewing, from standard TV to gaming. Since that data is tied to your specific household, companies can create audience segments and either use it for their own advertising or sell it to third parties. One analyst suggests you’re worth about $20 per year.

Wait, it gets worse! Many smart TVs feature microphones to enable voice commands, and some also include cameras to support video calling capabilities. Manufacturers can use captured audio and video to monitor viewer engagement—are you actually watching the show, or is it just playing in the background? That data also feeds into the profile that the TV manufacturers maintain about you.

If all this feels creepy to you, you’re not alone. Most annoyingly, apart from the opportunity to buy a cheap TV, there’s essentially no ongoing benefit to you in having your viewing habits packaged and resold. At most, you might get to ignore slightly more targeted ads.

Protect Your Viewing Privacy with an Apple TV

If you currently have a smart TV or are looking to replace an older TV, there’s an easy solution: use an Apple TV instead of the smart TV’s built-in apps or a similarly problematic media streaming box from the likes of Amazon, Google, and Roku. Although Apple isn’t perfect when it comes to privacy, the Apple TV provides a complete streaming solution that doesn’t share your viewing data with advertisers and data brokers. Here’s how:

• No ACR tracking: Apple has confirmed that the Apple TV doesn’t use ACR at all.
• No built-in advertising: Unlike Roku OS and Samsung’s webOS, the Apple TV doesn’t display ads on the home screen or in the screensaver.
• Privacy-first setup process: During setup, you’re given the opportunity to disable Siri, location services, and analytics.
• Limited data collection: Even when you do allow Apple to collect data, it’s done in ways that guarantee anonymity and used only in aggregate. No personal information is ever shared with Apple.
• Strong third-party app tracking controls: tvOS apps must ask for permission to track you, just like iOS apps. You can (and should) always reject such requests or prevent them from asking at all by going to Settings > Privacy > Tracking > Allow Apps to Request to Track.

Even with an Apple TV, you’ll need to take a few additional steps to protect your privacy since smart TVs can still track content playing through HDMI connections:

• Disable ACR tracking: Turn off ACR in your TV’s settings to prevent it from analyzing what you’re watching. This setting can be tricky to find since TV manufacturers deliberately make it difficult and use different names. Consumer Reports provides instructions for many TV models and streaming media devices.
• Consider blocking Internet access: For maximum privacy, you can prevent your TV from connecting to your Wi-Fi network and accessing the Internet, though this comes with trade-offs. While it ensures that no data leaves your TV, you’ll miss out on bug fixes, security updates, and certain features like picture calibration. You may also encounter connection error messages, and some TVs require occasional Internet connectivity for validation purposes. You may have to connect periodically to keep it working.

By turning off ACR, disconnecting the smart TV from the Internet, and using an Apple TV instead of a smart TV’s built-in apps or other streaming devices, you can enjoy your favorite shows without feeling like you’re being watched.

(Featured image by Apple)

Social Media: While you’re watching TV, your smart TV is watching you. Find out how manufacturers track your viewing habits and learn simple steps to protect your privacy with an Apple TV.

(Featured image by Google)

Social Media: Curious about how your personal information shows up in Google searches? Google’s Results About You service helps you monitor and manage your digital footprint.

For more information on all the great Apple products, features, and services, give us a call!  940-767-MACS (6227).  Or stop by MacTech Solutions, 4020 Rhea Rd, Suite 3B, Wichita Falls.  We’re open Monday thru Friday, 10am to 6pm

(Featured image by iStock.com/yacobchuk)

We’ll assume that you already keep your devices up to date, use FileVault on Macs, have at least a six-digit iOS passcode, have strong password habits, and use multi-factor authentication wherever possible. Other options are more specific to travel.

As with our more general article about increasing security last month, we’ve divided our list of suggestions into two parts: things that everyone should do and measures that only people who worry about being specifically targeted should employ.

Sensible Travel Security Precautions for Everyone

These suggestions are appropriate for everyone who travels, and they’re aimed primarily at avoiding relatively common problems: loss, theft, data loss, and generalized snooping:

• Focus on physical security: As a tourist, you may be targeted by thieves, so it’s important to keep your iPhone in a secure pocket whenever you’re not using it. Carry an iPad or laptop in a bag that can’t be snatched, or leave them locked or at least concealed in your hotel room.
• Enable Find My for all your devices: You should have already done this, but if not, enable Find My to improve your chances of finding a device you lose or accidentally leave behind. It might help if the device is stolen, but local police cooperation for recovering stolen items can vary widely. Don’t attempt to recover a stolen device yourself.
• Put AirTags in your luggage and laptop bags: AirTags can help you track down lost luggage—you can now share their locations with airlines—and prevent you from accidentally leaving bags behind. An AirTag may also help with locating a stolen item, but always work with local law enforcement.
• Enable biometric authentication and Stolen Device Protection: Using Face ID or Touch ID wherever possible and having Stolen Device Protection enabled on your iPhone in Settings > Face/Touch ID & Passcode is even more important when traveling.
• Use a VPN or iCloud Private Relay: Because you may be using Wi-Fi networks whose security you know nothing about, it’s best to use a VPN like Mullvad VPN, NordVPN, or ProtonVPN to encrypt all your traffic. At a minimum, use iCloud Private Relay, which requires an iCloud+ subscription and won’t encrypt traffic from most non-Apple apps.
• Use iCloud Photos or another backup option: To ensure you don’t lose precious vacation photos, use iCloud Photos so all your photos are uploaded to the cloud whenever you have access. This will almost certainly require an iCloud+ subscription for sufficient storage space. If Wi-Fi and cellular are too slow or unavailable, consider an external SSD to which you can manually export photos and videos for backup. To speed up the process, you could create a shortcut that automatically copies all photos taken that day.
• Use iCloud Backup: It’s best to use iCloud Backup to back up your entire iPhone every night. That way, if your iPhone is lost or destroyed, you may be able to buy a replacement and restore from backup in relatively little time. You will probably need an iCloud+ subscription to have enough backup space.
• Practice dealing with a lost or stolen device: If the worst happens and you lose one of your devices while traveling, you need to know what to do. Immediately go to Find My on another device or iCloud.com and mark the device as lost. If there’s a chance of getting it back, stop there. However, if you believe the device was stolen, your data is at risk, and tracking it is no longer useful, use Erase This Device in Find My to wipe it. Activation Lock will remain enabled to prevent anyone from reusing the device.

Increasing Travel Security for People Who May Be Targeted

Not all travel is fondue and gamelans. If you’re a journalist, activist, government employee, or corporate executive with access to sensitive data, you could be a target while traveling. This is particularly true if you are headed to countries like China, Russia, or others with authoritarian governments and powerful intelligence agencies. Along with the suggestions above, we recommend:

• Be aware of local laws and government practices: It’s important to read up on regional laws regarding data access and potential government capabilities at your destination. Knowing what to expect can help you reduce your risks and take appropriate precautions.
• Use caution with cellular access: Even if your carrier allows roaming, consider using a dedicated eSIM for international travel, separate from your personal one. That way, you can use local cellular networks without revealing your home number. Be aware that your traffic may be monitored.
• Enable Lockdown Mode: If you’re concerned about your iPhone or iPad being targeted by local law enforcement or government intelligence agencies, turn on Lockdown Mode in Settings > Privacy & Security > Lockdown Mode. To increase security, it blocks most attachment types in Messages, complex Web technologies, incoming FaceTime calls from unknown callers, non-secure Wi-Fi network connections, and incoming invitations to Apple services. Plus, it excludes location information from shared photos, requires approval to connect accessories, and more.
• Reduce and protect your use of cloud services: While using a VPN is essential, you should still avoid using cloud services much if government entities might have access to stored files. If you need to upload files, encrypt them first using the free and open-source Cryptomator.
• Know how to disable Face ID and Touch ID: If you find yourself in a situation where you believe you may be compelled to unlock your iPhone or iPad with your face or fingerprint, press and hold the side or top button and either volume button to display the power off slider. This temporarily disables biometric authentication, requiring your passcode for the next unlock.
• Use dedicated travel devices and accounts: If you’re traveling to a potentially hostile part of the world, we strongly recommend carrying only devices—preferably iPhones or iPads, which are more secure than Macs—configured to contain none of your personal data or regular accounts. Keep them with you at all times, assume they could be confiscated, and be aware you might be compelled to share passcodes or other account information. Create a separate Apple Account for such devices.

Best of luck in your travels! With just a little preparation, you can reduce the chances that something bad will happen during a vacation. If you’re traveling on business to somewhere more concerning, putting in additional effort could prevent truly problematic things from happening.

For more information on all the great Apple products, features, and services, give us a call!  940-767-MACS (6227).  Or stop by MacTech Solutions, 4020 Rhea Rd, Suite 3B, Wichita Falls.  We’re open Monday thru Friday, 10am to 6pm

(Featured image by iStock.com/metamorworks)

For more information on all the great Apple products, features, and services, give us a call!  940-767-MACS (6227).  Or stop by MacTech Solutions, 4020 Rhea Rd, Suite 3B, Wichita Falls.  We’re open Monday thru Friday, 10am to 6pm

(Featured image based on an original by iStock.com/Armastas)

The effort and inconvenience that different people are willing to endure also vary. Higher levels of security often necessitate significant effort and inconvenience. We have divided our list of suggestions—roughly organized from easiest to hardest—into two sections: actions we believe everyone should take and security measures mainly for those most concerned and willing to tolerate some fuss.

Before we delve into the details, it is important to remember that privacy and security are not the same thing. Privacy refers to the proper collection, use, and governance of personal data. Security, conversely, is concerned with protecting data from unauthorized access and malicious threats. It entails defending data against external dangers, while privacy ensures that the management and use of that data adhere to agreed-upon standards.

Security Improvements for Everyone

These actions are generally beneficial for most users. They don’t require much technical knowledge and can often be accomplished with easily accessible tools and settings:

• Keep apps and operating systems up to date: Nearly every operating system update from Apple addresses numerous security vulnerabilities, and the same is often true for major apps. Always ensure you’re running current versions to take advantage of all those security improvements.
• Enable FileVault: While all data on the internal SSDs of Macs with Apple silicon and Intel-based Macs with the T2 chip is automatically encrypted to prevent unauthorized access if the SSD is removed, it is automatically decrypted whenever the Mac boots, even before you log in. To link decryption to your user account, which makes your login password necessary to decrypt all data, enable FileVault in System Settings > Privacy & Security > FileVault. There are essentially no drawbacks.
• Improve your passcode: For nearly a decade, it has been easy to set a six-digit passcode on the iPhone and iPad, greatly enhancing security compared to the previous standard four-digit passcode (1 million possible combinations versus only 10,000). If you still use four digits, consider switching to six digits, a custom number of digits, or a custom alphanumeric passcode in Settings > Face ID/Touch ID & Passcode > Change Passcode > Passcode Options. Alphanumeric passcodes offer the highest level of security but are more challenging to type.
• Turn on biometric authentication and Stolen Device Protection: If you aren’t already using Face ID or Touch ID on your iPhone or iPad, that’s a mistake. Both provide significantly stronger security than repeatedly entering your passcode, which could be observed. Turn on biometric authentication and Apple’s Stolen Device Protection in Settings > Face/Touch ID & Passcode.
• Adopt strong password habits: If security matters at all to you, you must use a strong, unique password for each online account and never reuse a password. It’s easy and secure as long as you create and store passwords with a password manager like Apple’s Passwords or 1Password.
• Enable MFA whenever it’s available: Multi-factor authentication greatly enhances security, safeguarding you even if your password is compromised in a breach. It typically requires entering a six-digit code that you retrieve from an app or receive via text message. Apple’s Passwords and 1Password can both automatically enter MFA codes for many websites.
• Use an ad blocker: Much of today’s surveillance society relies on ads to track you. Anything you can do to block ads will enhance your privacy, so use ad blockers whenever possible. Highly regarded options include 1Blocker, AdGuard, NextDNS, and uBlock Origin.
• Enable privacy and security features in Web browsers: Safari can prevent cross-site tracking and hide your IP address, along with other privacy and security features. In Safari > Settings, review all the options in the Privacy and Security screens and enable those that are appropriate. (Keep cookies and JavaScript enabled; many sites won’t function properly without them.) If you don’t use Safari, choose Brave or Firefox instead of Google Chrome.
• Utilize secure DNS services: To enhance browsing privacy and protect against DNS leaks, configure your devices to use a privacy-focused DNS service like Cloudflare’s 1.1.1.1 or Quad9’s 9.9.9.9.
• Minimize app exposure: Be vigilant about iPhone or iPad apps that might be sharing information about you with data brokers without your knowledge. Specifically:
  • Turn off Settings > Privacy & Security > Tracking > Allow Apps to Request to Track.
  • Rescind location tracking permissions for all apps except those that require it, such as navigation or weather apps, in Settings > Privacy & Security > Location Services.
  • Delete apps you’re not using to prevent them from spying on you.

Security Improvements for the Particularly Concerned

Implementing these actions may require extra steps, specialized knowledge, or significant changes in habits. They’re primarily for those with heightened concerns or those at greater risk, such as journalists, activists, and individuals handling sensitive data:

• Use independent search engines: Google and Microsoft are known for collecting information about their users. To keep your searches private, use a search engine that prioritizes privacy, such as DuckDuckGo, Brave Search, Kagi, or Startpage.
• Protect network traffic: While we used to recommend ensuring you were using secure HTTP (HTTPS) connections, that’s now the bare minimum. For greater privacy while browsing the Web with Safari, turn on iCloud Private Relay in Settings/System Settings > Your Name > iCloud > Private Relay. (This requires an iCloud+ subscription and won’t encrypt traffic from most non-Apple apps.) More broadly, you can safeguard all your traffic by using a trusted VPN service like Mullvad VPN, NordVPN, or ProtonVPN.
• Activate Advanced Data Protection: End-to-end encryption (E2EE) keeps your online data private from everyone, including cloud providers. However, it requires you to manage your encryption keys, which means no one can help recover your data if you lose those keys. You can enable E2EE with Apple services using Advanced Data Protection; turn it on in Settings/System Settings > Your Name > iCloud > Advanced Data Protection.
• Use encrypted messaging: The iMessage system used by Apple’s Messages app for blue bubble conversations is highly secure, particularly with Advanced Data Protection enabled. However, for the most secure messaging with E2EE, look to Signal. While WhatsApp also offers E2EE, its backups might not be encrypted, and its parent company, Meta, is one of the most egregious privacy abusers on the planet.
• Regularly review and revoke permissions: Periodically check and manage app permissions on your device to ensure that no apps have unnecessary access to sensitive information, such as your contacts or location. Work through the options in Settings/System Settings > Privacy & Security and revoke permissions for anything that seems inappropriate. Apps that require additional permissions will always prompt you again.
• Encrypt cloud-stored data: To ensure that cloud storage services like Box, Dropbox, Google Drive, and OneDrive cannot read your data, use the free and open source Cryptomator to encrypt it first.
• Use encrypted email: While it’s impossible to ensure that email will remain private because you can’t control your recipients’ actions, the most privacy-focused email services are ProtonMail and Tuta Mail. They employ E2EE for emails sent to other users of the same service and allow the encryption of email messages sent to any external recipient.
• Reduce reliance on cloud services: If you have general concerns about cloud services, consider exploring peer-to-peer alternatives that remove the need for a central provider. You can find peer-to-peer solutions for file storage, file sharing, chat and messaging, videoconferencing, collaborative documents, cloud-based notes, and more.
• Avoid social media: Posting on social media, especially on platforms owned by large corporations, allows those companies to create a comprehensive profile of you that is shared with advertisers and is vulnerable to data breaches. Further, any information you disclose about yourself could be exploited by hackers in social engineering attacks targeting your accounts. Consider replacing social media with independent forums devoted to your interests and private messaging spaces for friends and family.

Ultimately, enhancing privacy and security is your responsibility. Apple and other companies may offer tools to assist, but it’s up to you to implement them and stay vigilant against new threats. We’re also happy to provide advice and assistance.

Protect Your Digital Life with Confidence

Staying safe online doesn’t have to be complicated — and you don’t have to figure it out alone.

At MacTech Solutions, we’re passionate about helping you protect your digital life.

Whether you need help securing your Mac, your iPhone, or your online accounts, we’re here for you.

Stop by MacTech Solutions in Finishing Touch Plaza in Wichita Falls — and let’s make sure your digital world stays safe, private, and protected.

For more information on all the great Apple products, features, and services, give us a call!  940-767-MACS (6227).  Or stop by MacTech Solutions, 4020 Rhea Rd, Suite 3B, Wichita Falls.  We’re open Monday thru Friday, 10am to 6pm

(Featured image by iStock.com/andreusK)

Much of this is possible because people use apps that reveal their location to data brokers, who package the information and resell it to companies like Babel Street. Apple does have an advantage here—Atlas estimated they could locate roughly 80% of Android phones but only 25% of iPhones. That’s due to Apple’s App Tracking Transparency feature, introduced in iOS 14.5, which requires apps to get permission from users before tracking them for third-party advertising purposes. Unfortunately, many people unthinkingly grant such permissions, and location and identification data can also leak out in other ways.

Although it’s difficult to avoid being tracked by data brokers entirely, you can drastically reduce the likelihood and frequency of tracking, which helps ensure that any location information that does become available isn’t sufficient to identify you personally. Your employer may also consider your location to be sensitive information and want you to restrict it to the extent possible. To achieve this, you’ll need to adjust settings in several parts of Settings > Privacy & Security on your iPhone (and iPad, if you regularly use it in multiple locations).

Turn Off Allow Apps to Request to Track

You’ll find the most important setting in Settings > Privacy & Security > Tracking. At the top of the screen is a switch labeled Allow Apps to Request to Track. Make sure that is off! If it has been on in the past, apps that have requested permission will appear below.

By preventing apps from even asking if they can track you, you keep them from sharing a unique identifier associated with your iPhone with other apps and websites. Otherwise, advertisers can follow you from app to app and website to website, gathering information about you—often including your physical location—as you go about your life.

Don’t let apps persuade you to turn this setting on or allow them to track you. Apple’s rules explicitly forbid them from reducing functionality to those who refuse to allow tracking.

Allow Location Access Only for Apps That Need It

While you can turn off Allow Apps to Request to Track with a single switch, preventing apps from seeing your location requires more targeted work. Although Settings > Privacy & Security > Location Services has a big Location Services switch, turning that off will drastically reduce the utility of your iPhone. You won’t be able to get directions from Maps, tag photos with their location, share your location with family members, and much more.

Instead, for each app in the list, determine what level of location access you want to grant based on its function and description of why it needs access. Grant the minimal level of access necessary, which varies by app. Navigation apps need location access to work at all. Camera apps need it to geotag photos. Weather apps use it to provide custom weather reports and extreme weather notifications. But do you want to give a social media app access to your location at all times?

Apple provides five location access levels:

• Never: Choose Never for any app with questionable explanations of why location access is requested.
• Ask Next Time or When I Share: If you’re unsure if you want to allow or deny location access for an app, select this option. The app will prompt you the next time it wants your location, enabling you to make an informed decision based on your actions.
• While Using the App: For most apps you want to allow to see your location, choose While Using the App. It’s entirely reasonable that a location-requiring app be allowed to determine your location while you’re using it.
• While Using the App or Widgets: This option only appears for apps with widgets; choose it only if you use a widget that needs location access.
• Always: Grant Always access only to apps that generate location-related notifications when the app is not open. The most common example is a weather app that provides notifications of incoming storms.

The Precise Location option becomes available if you allow location access for an app. Turn it on only if the app needs to know your location within 15 to 200 feet (5 to 60 meters). An Uber or Lyft driver will need to know where to pick you up, for instance, so those apps should have Precise Location turned on, as should navigation and camera apps. For most others, turn off Precise Location. Your approximate location—a variable radius between 2.5 to 12 miles (4 and 20 kilometers)—is usually sufficient to locate you in the right part of the world.

Block Bluetooth and Local Network Access for Apps That Don’t Need It

Apps can use Bluetooth to infer your general location through interactions with other Bluetooth devices and movement patterns, so Apple requires apps to ask to use Bluetooth. As a result, just as with location, you should go through the apps listed in Settings > Privacy & Security > Bluetooth and revoke permission from any that don’t seem as though they should need it. Most will be legitimate—an app designed to communicate with a Bluetooth-connected device, for instance. Any app that needs access to Bluetooth and doesn’t have it should prompt you when you next open it.

Similarly, Apple now requires apps to request permission to use your local network. For the most part, these requests are reasonable—apps may need to discover network-connected devices like routers, printers, speakers, smart home gadgets, and more. Or games may need to discover other players on the network. However, because your network can reveal information about your location, it’s best to revoke access for any apps that don’t seem as though they should need it. There’s no harm in doing so; they’ll ask again if they need access.

Ultimately, all we can do is stay vigilant about what we’re allowing on our devices, encourage Apple to add even more privacy protections, and lobby our elected representatives for legal protection. It’s unconscionable that private companies can gather extensive location data on hundreds of millions of citizens.

For more information on all the great Apple products, features, and services, give us a call!  940-767-MACS (6227).  Or stop by MacTech Solutions, 4020 Rhea Rd, Suite 3B, Wichita Falls.  We’re open Monday thru Friday, 10am to 6pm

(Featured image by iStock.com/Chayada Jeeratheepatanont)

For more information on all the great Apple products, features, and services, or for more information on cybersecurity, give us a call!  940-767-MACS (6227).  Or stop by MacTech Solutions, 4020 Rhea Rd, Suite 3B, Wichita Falls.  We’re open Monday thru Friday, 10am to 6pm

(Featured image by iStock.com/Thapana Onphalai)

Social Media: Scams are starting to incorporate personal information stolen in data breaches, so you may get “sextortion” threats that purport to know your phone number, address, and more.

For more information on all the great Apple products, features, and services, give us a call!  940-767-MACS (6227).  Or stop by MacTech Solutions, 4020 Rhea Rd, Suite 3B, Wichita Falls.  We’re open Monday thru Friday, 10am to 6pm

(Featured image by iStock.com/SasinParaksa)