Over the years, Apple has put its vast resources into making its operating systems more secure for end-users. Beginning with macOS Catalina, the company has taken this to all-new levels by introducing beneficial security changes that make it even harder for tricksters to play havoc with our computers. However, because security is an ever-changing enterprise, so-called improvements for some might not work for others. Specifically, Apple's decision to make Gatekeeper even more difficult to crack is a significant step forward for everyday Mac users. But, for developers, perhaps not so much. Luckily, there's a workaround.

WARNING: This terminal trick disables important security aspects of Gatekeeper, which leaves your Mac vulnerable to malware. We highly recommend you reenable the default security settings if you chose to follow this guide at your own risk.

What is Gatekeeper?

Gatekeeper has been an essential part of macOS for years. As its name suggests, the tool has been designed to check recently downloaded apps for known malware and sends it to quarantine. Previously, Gatekeeper didn't take the same approach with apps launched via Terminal. It also didn't check non-quarantined apps and files for malware. In other words, it checked an app only once for malware.

Now, apps started through Terminal are also checked on all the best Macs. These files get the same malware scan, signature check, and local security policy check. The difference: even on the first run, you only need to explicitly approve software launched in bundles, like a standard Mac app bundle, not for standalone executables or libraries.

Gatekeeper will also check non-quarantined apps and files for problems. Not just once or twice, but every time you run it. When your Mac detects a problem, it blocks the file, then sends you an alert.

If all this sounds fantastic to you, terrific. That's undoubtedly Apple's intent. However, some developers might view this differently and find the changes cumbersome.

A workaround

Even though Gatekeeper in macOS is now stricter than ever, there is a way around it. The workaround makes it possible to download and use apps downloaded from anywhere without a check.

First published in 2016 by OSX Daily, but still valid, the "fix" works like this:

1. Be sure to exit System Preferences on your Mac.
2. On Finder, click Go.
3. Select Utilities from the pull-down menu.
4. Double-click Terminal.

5. Type of the following command syntax: sudo spctl --master-disable .
6. Hit Return
7. Authenticate with an admin password.
8. Hit Return.
9. Exit Terminal.

Changing your settings

Now, it's time to allow your Mac to open any app.

1. Click on System Preferences on your Mac Dock.
2. Choose Security & Privacy.
3. Tap the lock at the bottom left of the screen.

4. Enter your password to unlock Security and Privacy.
5. Choose the Anywhere under Allow apps downloaded from. Prior to making the change, this option wasn't available.
6. Click the unlocked lock to keep the change.

With this change, Gatekeeper no longer monitors your computer for malware coming from apps and files.

Restoring to the original settings

If you'd like to return to the default Gatekeeper settings, perform these steps:

1. Be sure to exit System Preferences on your Mac.
2. On Finder, click Go.
3. Select Utilities.
4. Double-click Terminal.

5. Type of the following command syntax: sudo spctl --master-enable .
6. Hit Return
7. Authenticate with an admin password.
8. Hit Return.
9. Exit Terminal.

View the change

To confirm your Mac has returned to the default settings:

1. Click on System Preferences on your Mac Dock.
2. Choose Security & Privacy.

Under Allow apps downloaded from, notice the select is now App Store and identified developers.

So, should you make the switch?

For nearly every Mac user, there's no reason to make the listed change under Security & Privacy. It should only be performed if you can quickly determine whether apps are legitimate or not. Keep this in mind.

What you need to know

• Apple has changed the way two-factor authentication SMS messages look.
• Now, Apple's messages will only have iOS, iPadOS, and macOS autofill on authentic websites.

Apple has made a change to the way two-factor authentication SMS messages look in an attempt to help boost security.

Apple's change essentially means that any time it sends you a new SMS as a form of two-factor authentication the message will only be provided for autofill on Apple services and websites thanks to the addition of a new piece of text. As reported by Macworld, the move was first proposed more than a year ago — in August 2020, to be exact.

The new messages will include more text than usual — and have already been rolling out for the last few weeks, too.

• A standard human-readable message, including the code, followed by a new line.
• The scoped domain as @domain.tld.
• The code repeated again as #123456.
• If the site uses an embedded HTML element, called an iframe, the source of the iframe is listed after %, such as %ecommerce.example. (The original spec specifies @; Apple appears to be using % for its texts.)

This whole system works in a similar way to how password managers and iCloud Keychain will only present a password on a specified website or in an associated app. This means that fake websites can't use autofill to accept a two-factor authentication code because iOS, iPadOS, and macOS will spot that the domains don't match.

You still need to keep an eye on where you are clicking and what passwords you are entering, but this SMS change should at least help matters.

You can read more about how this all works in the original Macworld article, too.

What you need to know

• Journalists and activists in El Salvador have been targeted by Pegasus spyware.
• El Salvador government says it too has been a target.

The infamous NSO Group's spyware app, Pegasus, has been found to have been used to hack into devices owned by journalists and activists in El Salvador, according to a new report. The discovery was made after two journalists reached out to Citizen Lab with concerns that their devices had been compromised.

Both journalists and activists critical of alleged government corruption appear to have been targeted, with an investigation confirming that devices had indeed been attacked according to a Reuters report.

President Nayib Bukele says that his country doesn't work with NSO Group, going on to also confirm that an investigation would be opened. It was also claimed that government officials were also targeted.

Pegasus has been used by various outfits to access text messages, call histories, and more on devices that they believe may be of interest. Those devices often belong to members of the press as well as anyone they believe to be a threat.

Apple recently filed a Lawsuit against NSO Group and reports suggest the outfit is considering closing the spyware operation as it burns through cash.

What you need to know

• Apple will join other tech companies in a White House discussion of software security.
• Microsoft, Google, and Amazon will be among the attendees.
• Concerns have been raised following high-profile cyberattacks in the United States.

Apple, Microsoft, Google, Amazon, Facebook, and more tech companies will take part in a discussion about software security at the White House, according to a new report. The meeting comes after a year that saw multiple high-profile cyberattacks against the United States.

The meeting was set up following a December letter from White Hosue National Security Advisor Jake Sullivan, reports Reuters. The letter was prompted by the "discovery of a security vulnerability in open-source software called Log4j that organizations around the world use to log data in their applications."

The main source of concern appears to be the use of open-source software and the fact that it is maintained by volunteers, something seen as a "key national security concern."

Last year saw multiple attacks, some of which many believe were at the behest of Russia. One such attack, which breached SolawWinds software, gave attackers access to government offices and more. Emails at the U.S. Treasury, Justice and Commerce departments were also reportedly accessed.

Cybersecurity is a hot topic around the world and is high on President Biden's agenda. With some of the biggest technology companies across the United States set to be involved in the meeting it could be quite the get-together.

What you need to know

• Pareto Security is a Mac app that checks to make sure your machine is as secure as it could be.
• 36 different security checks are carried out so you'll always be told if there's a feature you haven't enabled yet.

Keeping your Mac as safe as possible is something we should all be doing, but sometimes it's easy to miss a setting that leaves a machine open to attack. That's where Pareto Security comes in so handy — because it looks at all of the Mac's security settings and potential attack vectors and warns you if you've left one wide open.

The Mac app, which is available for download from the developer website, is available for a one-time fee of $15 and is also part of the Setapp bundle as well. No matter how you pay for it, Pareto Security is well worth checking out. You might be surprised at what it will find.

As an example, it turns out my Mac's firewall was turned off until about 5 minutes before I began writing this post. I had no idea until I ran a Pareto Security check and it warned me. There are other things it isn't happy about as well. Apparently, my screensaver is set to come on after more than five minutes, which could be a security risk. I have AirPlay enabled, too. FileVault is disabled, too. I should probably get around to changing that.

It isn't just me, either. here's Pareto Security founder Neyts Zupan explaining his own story:

Zupan had a colleague run the app while it was still in alpha mode and they found the same thing, too. Just imagine what you'll find if you install Pareto Security on your machine.

Pareto Security currently checks 36 different aspects of your Mac to make sure it's as secure as possible, with more on the way. You can learn more about the app and the kinds of things it can prevent on the website, too. Remember, the best Mac is a secure Mac!

What you need to know

• NSO Group is reportedly struggling for cash and is considering a sale.
• The company behind the Pegasus spyware is facing pressure from the United States as well as Apple.

NSO Group, the outfit behind the now infamous Pegasus spyware, is reportedly burning through money and considering closing down the Pegasus unit and selling the entire company amid pressure from multiple angles.

According to a new Bloomberg report, NSO is struggling for money following the news that the company has been listed as a national security threat by the United States. Apple also recently filed a lawsuit against NSO relating to its creation of the Pegasys spyware.

As a result of all this, NSO is considering shuttering the Pegasus spyware outfit as well as selling the company as a whole.

Notably, the same report suggests that one of the outfits keen to buy NSO could use the know-how behind Pegasus to turn it into a defensive tool, rather than an offensive one. As a result, Pegasus could become a force for good — as unlikely as that might sound.

It seems unlikely that many people will feel too badly for NSO for obvious reasons here, although it's important to remember that the company likely employs a ton of people that know little to nothing about Pegasus and what it's being used for.

With security being one of the best iPhone features according to Apple's own marketing campaigns, the loss of Pegasus would definitely be something celebrated within the halls of Apple Park, that's for sure.

What you need to know

• Apple has issued a support document detailing how users will be informed of a potential state-sponsored attack.
• Apple is suing NSO Group, the outfit behind Pegasus which is itself a tool used by bad actors.

Yesterday saw Apple announce that it is suing NSO Group, in part over its creation of Pegasus, a spyware tool that has been used to target politicians, journalists, and more. The company has also published a support document that highlights how it will warn people if they're thought to be under attack.

The new document, first spotted by MacRumors, outlines the security issues caused by state-sponsored spyware across Apple devices — including the new iPhone 13.

Apple goes on to say that it will notify people that they are a target by sending them emails and iMessages, while a message will also appear when they log into their Apple ID on the Apple website. No links will be sent and no credentials will be requested.

Apple also offers some ideas for how people can try to ensure they don't fall victim to such attacks.

• Update devices to the latest software, as that includes the latest security fixes
• Protect devices with a passcode
• Use two-factor authentication and a strong password for Apple ID
• Install apps from the App Store
• Use strong and unique passwords online
• Don't click on links or attachments from unknown senders

Security is one of the best iPhone features that Apple isn't shy about marketing, but even iPhones aren't guaranteed to be safe from attacks like this.

Those interested in learning more, and finding out what to do if they think they're a target, can read the full support document now.

What you need to know

• A new stolen iPhone trick allows thieves to disable Find My and erase the device entirely.
• People are stealing iPhones and sending text messages to the stolen number pretending to be Apple, tricking them into giving up their Apple ID credentials.

People stealing iPhones is absolutely nothing new, unfortunately. But people using Find My to disable their devices is usually a good port of call because it prevents them from being accessed or set up anew. A new trick shared by one unfortunate iPhone owner shows that thieves are finding new ways to get around things like Find My — and it's all too easy.

An India Today report tells the story of Vedant, someone who lost his iPhone 12 before going through all the usual steps — including trying to use Find My to locate it.

A few days went by and it was assumed that all hope was lost. Then, Vedant received an SMS suggesting the iPhone had been found and that tapping a link would display the location. The link looked legit because it contained 'icloud' and 'findmy,' but it wasn't.

After tapping the link Vedant was asked to log in, which they did — giving the new owner of the iPhone their Apple ID and password.

The link was from the person that had the iPhone in their possession and they were able to use the Apple ID credentials to disable Find My on the iPhone. They got Vedant's phone number by putting the SIM into a new device and calling themselves, which explains that part of the mystery. What's less clear is why the number the link came from also appears to be the number Microsoft uses to send its two-factor authentication codes via. Likely, the number was spoofed — another sign that the thief was no amateur.

With Find My disabled, the iPhone could be wiped and set up as a new device using anyone's Apple ID — just as if it had been bought legitimately.

Normally this is where I say to make sure that you have two-factor authentication enabled, but that would likely have failed to do its job here, too — Vedant would have entered that into the fishing site and handed it to the thief along with the username and password.

The real moral of the story? Check and double check links before accessing them and consider using a password manager that will alert you if you're entering details into a site other than the one you saved them from. Remember, a secure iPhone is the best iPhone!

What you need to know

• NSO has been added to the US Entity List over national security concerns.
• NSO is the creator of a prolific spyware app called Pegasus that's been used against journalists, governments, and more.

NSO, the company behind the Pegasus spyware, has been added to the US Entity List over national security concerns. The Commerce Department's Bureau of Industry and Security (BIS) added NSO to the list along with three other companies.

By adding a company to the Entity List, the government is making it impossible for its products to be imported into the United States. They also can't be exported or passed from one organization to another.

The addition of NSO was first spotted by 9to5Mac, with countries in Russia and Singapore joining it.

While most people are highly unlikely to need to be concerned about Pegasus, those in positions of power or even just reporting on it could potentially be targeted. Journalists and activists have reportedly been targeted by Pegasus over the last few months alone.

Apple often touts its security as one of the best iPhone features when compared to Android, but Pegasus continues to find ways to be effective.

You may love Facebook or just hate it with a burning rage. Regardless of how you feel, Facebook is still immensely popular with many people, and it's even considered the primary way some people keep in touch with others. But your information on Facebook, even if you don't use it much, is something you don't want others to get a hold of. Therefore, you should take any means necessary to protect your data. Thankfully, Facebook supports two-factor authentication (2FA) in a few different ways.

Here's how to set up two-factor authentication for Facebook, no matter what device you're using, from the best iPhone or iPad to your Mac.

How to set up 2FA for Facebook on Mac

Getting 2FA set up on your Mac (or PC) from a web browser is an easy process. Once you're logged in to your account on Facebook, just follow these steps:

1. Click the Account button in the upper right corner (it looks like a triangle pointing down).
2. Click Settings & Privacy from the drop-down menu.
3. Click Settings.

4. Click Security and Login in the left sidebar menu.
5. Scroll down and click on Use Two-Factor Authentication.

6. Choose your 2FA Authentication method. Your options include an Authenticator app (recommended) or Text Message (SMS) (less secure).
7. Scan the QR Code or input the secure code into your authenticator app of choice. We recommend Authy.
8. Click Continue and follow the rest of the on-screen directions.

Once you have added your Facebook account to your authenticator app, it generates six-digit codes that you'll need to input whenever you try to log in to your Facebook account. These codes expire after 30 seconds.

How to set up 2FA for Facebook on iPhone or iPad

If you prefer to use the Facebook mobile app on your iPhone or iPad, such as the iPhone 13, then you can set it up from there as well.

1. Launch the Facebook app on your iPhone or iPad.
2. Tap the menu button in the bottom right corner. It looks like three lines stacked vertically (hamburger).
3. Scroll down and tap on Settings & Privacy.

4. Tap Settings from the drop-down menu.
5. Tap Password and Security.
6. Tap Use Two-Factor Authentication.

7. Choose your 2FA Authentication method. We recommend Authentication app because it's more secure, but you can also use Text Message (SMS) if you want, though it's less secure.
8. Tap Continue.
9. Scan the QR code with your authenticator app, or tap Set up on same device. You can also copy and paste the secure code into the app.
10. Once you've set it up in your app, tap Continue and follow the rest of the on-screen directions.

Protect yourself with 2FA for Facebook and more

Adding 2FA to any of your online accounts gives it another layer of protection and security. It is highly recommended to enable it whenever possible, so it's harder for people to force their way into your digital accounts.

What you need to know

• WhatsApp has enabled end-to-end encryption for chat backups.
• Users can create a password or 64-bit key to protect their backup.
• Encryption works no matter whether the backups are stored in iCloud or Google Drive.

Popular instant messaging service WhatsApp has rolled out a new security feature that will keep chats safer than ever before. The new end-to-end (E2E) encryption option for chat backups works whether they're saved in iCloud or Google Drive and users get to choose how they're authenticated.

Facebook's Mark Zuckerberg made the announcement, saying that users will be able to create their own password or 64-bit key by way of authentication.

Zuckerberg did note that, with more than two billion users, WhatsApp will need to roll the feature out slowly. If you aren't seeing it yet, sit tight —it's coming. WhatsApp users can find more information about how to enable E2E chat backup encryption on the WhatsApp website, too.

WhatsApp is hugely popular and is one of the best iPhone options for people who want to be able to chat with people on Android devices without falling back to SMS. Features like this go a long way to ensuring the chats people run are safe, even when backed up to third-party servers.

What you need to know

• Apple has patched a security flaw with the release of iOS 15.0.2.
• Like a previous fix, Apple has not given credit to the researcher that discovered the zero-day flaw.

Apple appears to have fixed a zero-day vulnerability with the release of iOS 15.0.2, but like previous instances, it hasn't given credit to the researcher who discovered the problem and reported it.

Researcher Denis Tokarev has previously had trouble getting Apple to acknowledge security vulnerabilities. Now that Apple is at least fixing the problems he found, it isn't doing a great job of giving him credit.

This follows a similar instance where another flaw was fixed by iOS 14.7 in July, again with Tokarev not being credit. At the time, Apple said that it was a "processing issue" and that credit would be given in a future update.

That didn't happen.

Only Apple knows why it seems so keen not to give this particular researcher credit for finding security holes in its software, but the good news from a user's point of view is that the issue is fixed. However, long term, Apple's stance on first acknowledging and then dealing with the problems before not giving credit for their discovery could well cause researchers not to report bugs in the future.

That's bad for everyone.

Security and privacy have long been some of the best iPhone features that Apple relentlessly markets. Faux pas like this might not help it maintain that stance in the long run.

What you need to know

• Carrier T-Mobile has confirmed that unauthorized access to data on its servers did occur.
• The company hasn't confirmed that personal data was stolen during the attack.

Following the news that T-Mobile was the victim of a data breach that saw personal data appear on the black market, the carrier has now released a statement. That statement confirms that someone did have access to data that they shouldn't have, but T-Mobile isn't sure that any of it was personal.

Yesterday saw Vice report that it had seen data that was supposedly stolen during the attack, including "social security numbers, phone numbers, names, physical addresses, unique IMEI numbers, and driver licenses information."

T-Mobile isn't so sure.

Both T-Mobile and the person who claims to have carried out the attack say that access to the servers has been revoked, so thinks should be fine from here on out. That doesn't mean that people won't be concerned about the information that could now be in the wild, however. T-Mobile says it will reach out to customers if and when it learns more.

T-Mobile has long been a popular option for people on the lookout for a great iPhone carrier. But security issues like this might give new customers cause for concern.

What you need to know

• T-Mobile is investigating claims that 100 million users had their data stolen from its servers.
• A forum post claims to be from someone ready to sell the data.

Carrier T-Mobile is investigating claims that 100 million people had their data stolen right off its servers after someone posted to a forum saying they had the information for sale.

As reported by Vice, a forum member didn't explicitly say that the data came from T-Mobile initially, but later did confirm that it originated from the carrier's servers.

The data includes various pieces of information that could be useful to someone trying to steal an identity, including "social security numbers, phone numbers, names, physical addresses, unique IMEI numbers, and driver licenses information."

The forum member was asking for 6 bitcoin, or around $270,000, for some of the data including 30 million social security numbers and driver licenses. The rest of the data, Vice reports, is being sold privately.

T-Mobile's statement on the subject reads "We are aware of claims made in an underground forum and have been actively investigating their validity. We do not have any additional information to share at this time." The hacker noted that they have now lost access to the servers they stole the data from, pointing out that they had already downloaded it for safekeeping locally.

T-Mobile has long been a popular option for people on the lookout for a great iPhone carrier. But security issues like this might give new customers pause, not that the competition is invulnerable to their own security issues.

To better protect your files, Apple offers several built-in Mac encryption tools. Once implemented, the files are digitally scrambled, so you need a secret key, password, or portable RFID chip to read them. Here's a look at how to encrypt macOS.

These steps work on macOS Monterey and earlier with all of the best Macs.

How to encypt with FileVault

When starting your Mac for the first time, the system will ask you whether to use FileVault. When activated, FileVault will automatically encrypt content in the background. It uses XTS-AES-128 encryption with a 256-bit key to help prevent unauthorized access to the information on your startup disk. As a result, FileVault is the easiest and most practical way to encrypt everything on your computer. If you didn't activate FileVault when setting up your computer, you can do so manually at any time.

1. Go into System Preferences on your Mac.
2. Click Security & Privacy.
3. Choose the FileVault tab.

4. Click the lock icon at the bottom left.
5. Enter an administrator name and password.
6. Select Turn on FileVault. If there's more than one account on your Mac, you'll need to type in the password for those users on the next screen, or they won't be able to unlock the disk. For each user, click the Enable User button and enter the user's password. User accounts that you add after turning on FileVault are automatically enabled.
7. Click Continue.

Assuming you're Mac is using OS X Yosemite or later, you can choose to use your iCloud account to unlock your disk and reset your password.

There are various ways to choose how to unlock your Mac and reset your password when using FileVault. If you rather not use iCloud FileVault recovery, you can create a local recovery key. Keep the letters and numbers of the key somewhere safe — other than on your encrypted startup disk.

You can disable FileVault at any time by following the directions below:

1. Go into System Preferences on your Mac.
2. Click Security & Privacy.
3. Choose the FileVault tab.

4. Click the lock icon at the bottom left.
5. Enter an administrator name and password.
6. Select Turn off FileVault.

How to encrypt folders

You can use Mac encryption to protect individual folders at any time. This solution is ideal when you plan on sharing the folders.

1. Create a folder on your Mac. You can right-click anywhere on your computer and choose New Folder.
2. Rename the folder when applicable.
3. Add the files you wish to encrypt to the folder.
4. Choose the Finder in the Mac dock.

5. Select Go on the menu bar.
6. Pick Utilities.
7. Choose Disk Utility.

8. Select File.
9. Choose New Image.
10. Pick Image from Folder.
11. Find, then highlight the folder you wish to encrypt.
12. Click Choose at the bottom right.

13. Toggle your level of encryption (128-bit or 256-bit AES Encryption).
14. Add a password, then confirm.

15. Select Choose.
16. Choose Read/Write as your Image Format selection at the bottom right.
17. Select Save to exit the window.

18. Click Done when the encryption process completes.
19. Exit Disk Utility.

Your created .dmg file is secure. You can share the file just as you would any other one. Double-click to open it — you'll need to type in the password to complete the process. That's Mac encryption!

Questions?

Let us know in the notes below whether you have questions about Mac encryption or macOS overall.

What you need to know

• An update to the iMazing app means it can now tell you if you're infected with the Pegasus spyware.
• Pegasus has been in the news of late because it's being used to spy on journalists and other high-profile figures.

You'd need to have been actively trying to avoid Apple news of late to have missed the furor surrounding Pegasus, a spyware tool that's being used to target journalists and other high-profile people. All of the headlines surrounding Pegasus have people wondering if their iPhones could have it installed without their knowledge. Now, an iMazing app update means it can tell you.

While it's highly unlikely that most people need to worry about someone installing Pegasus on their iPhone, it never hurts to have that added peace of mind. Previous methods of checking whether you have Pegasus installed were less than user-friendly, so this new iMazing update is a welcome one.

According to iMazing, it decided to look into adding Pegasus detection when users began to ask for it — mainly because the other methods of checking for the spyware were too complicated.

No setup or device backups are needed to make the iMazing Pegasus detection work. Users simply connect their iPhone to a computer and press a button. It doesn't get more simple than that!

The iMazing app was already one of the best Mac apps for doing all kinds of things with your iPhone — now it's better than ever thanks to a tool most people probably don't need but might want to use anyway. It's a funny old world!

You can read more about the iMazing update on the announcement post, too.

What you need to know

• Apple has released security updates to both macOS Mojave and macOS Catalina.
• The updates come on the same day that the company released macOS Big Sur 11.5.

Earlier today, Apple released macOS Big Sur 11.5 to the public. In addition, the company has released some important security updates for users on macOS Mojave and macOS Catalina.

Apple has released the full list of security updates that were released today to both macOS Mojave and macOS Catalina. The updates include fixes to audio, Bluetooth, and WebKit.

You can check out the full list of security fixes below:

AMD Kernel

Available for: macOS Catalina

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2021-30805: ABC Research s.r.o

AppKit

Available for: macOS Catalina

Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution

Description: An information disclosure issue was addressed by removing the vulnerable code.

CVE-2021-30790: hjy79425575 working with Trend Micro Zero Day Initiative

Audio

Available for: macOS Catalina

Impact: A local attacker may be able to cause unexpected application termination or arbitrary code execution

Description: This issue was addressed with improved checks.

CVE-2021-30781: tr3e

Bluetooth

Available for: macOS Catalina

Impact: A malicious application may be able to gain root privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2021-30672: say2 of ENKI

CoreAudio

Available for: macOS Catalina

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved state management.

CVE-2021-30775: JunDong Xie of Ant Security Light-Year Lab

CoreAudio

Available for: macOS Catalina

Impact: Playing a malicious audio file may lead to an unexpected application termination

Description: A logic issue was addressed with improved validation.

CVE-2021-30776: JunDong Xie of Ant Security Light-Year Lab

CoreStorage

Available for: macOS Catalina

Impact: A malicious application may be able to gain root privileges

Description: An injection issue was addressed with improved validation.

CVE-2021-30777: Tim Michaud(@TimGMichaud) of Zoom Video Communications and Gary Nield of ECSC Group plc

CoreText

Available for: macOS Catalina

Impact: Processing a maliciously crafted font file may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-30789: Sunglin of Knownsec 404 team, Mickey Jin (@patch1t) of Trend Micro

CoreText

Available for: macOS Catalina

Impact: Processing a maliciously crafted font may result in the disclosure of process memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-30733: Sunglin from the Knownsec 404

CVMS

Available for: macOS Catalina

Impact: A malicious application may be able to gain root privileges

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2021-30780: Tim Michaud(@TimGMichaud) of Zoom Video Communications

dyld

Available for: macOS Catalina

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: A logic issue was addressed with improved validation.

CVE-2021-30768: Linus Henze (pinauten.de)

FontParser

Available for: macOS Catalina

Impact: Processing a maliciously crafted font file may lead to arbitrary code execution

Description: An integer overflow was addressed through improved input validation.

CVE-2021-30760: Sunglin of Knownsec 404 team

FontParser

Available for: macOS Catalina

Impact: Processing a maliciously crafted font file may lead to arbitrary code execution

Description: A stack overflow was addressed with improved input validation.

CVE-2021-30759: hjy79425575 working with Trend Micro Zero Day Initiative

FontParser

Available for: macOS Catalina

Impact: Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents

Description: This issue was addressed with improved checks.

CVE-2021-30788: tr3e working with Trend Micro Zero Day Initiative

ImageIO

Available for: macOS Catalina

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2021-30785: Mickey Jin (@patch1t) of Trend Micro, CFF of Topsec Alpha Team

Intel Graphics Driver

Available for: macOS Catalina

Impact: An application may be able to cause unexpected system termination or write kernel memory

Description: This issue was addressed with improved checks.

CVE-2021-30787: Anonymous working with Trend Micro Zero Day Initiative

Intel Graphics Driver

Available for: macOS Catalina

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: An out-of-bounds write was addressed with improved input validation.

CVE-2021-30765: Liu Long of Ant Security Light-Year Lab

CVE-2021-30766: Liu Long of Ant Security Light-Year Lab

IOUSBHostFamily

Available for: macOS Catalina

Impact: An unprivileged application may be able to capture USB devices

Description: This issue was addressed with improved checks.

CVE-2021-30731: UTM (@UTMapp)

Kernel

Available for: macOS Catalina

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A double free issue was addressed with improved memory management.

CVE-2021-30703: an anonymous researcher

Kernel

Available for: macOS Catalina

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A logic issue was addressed with improved state management.

CVE-2021-30793: Zuozhi Fan (@pattern_F_) of Ant Security TianQiong Lab

LaunchServices

Available for: macOS Catalina

Impact: A malicious application may be able to break out of its sandbox

Description: This issue was addressed with improved environment sanitization.

CVE-2021-30677: Ron Waisberg (@epsilan)

LaunchServices

Available for: macOS Catalina

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: An access issue was addressed with improved access restrictions.

CVE-2021-30783: Ron Waisberg (@epsilan)

Model I/O

Available for: macOS Catalina

Impact: Processing a maliciously crafted image may lead to a denial of service

Description: A logic issue was addressed with improved validation.

CVE-2021-30796: Mickey Jin (@patch1t) of Trend Micro

Sandbox

Available for: macOS Catalina

Impact: A malicious application may be able to access restricted files

Description: This issue was addressed with improved checks.

CVE-2021-30782: Csaba Fitzl (@theevilbit) of Offensive Security

WebKit

Available for: macOS Catalina

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2021-30799: Sergei Glazunov of Google Project Zero

What you need to know

• Apple has released the details of its security fixes in iOS 14.7 and iPadOS 14.7.
• The fixes include ones for Find My and WebKit.

Earlier today, Apple released iPadOS 14.7 to the public after releasing iOS 14.7 earlier this week.

In addition to those software releases, Apple has published the full list of the security fixes it has released as part of those software updates. The updates include security fixes to both Find My and WebKit.

You can check out the full list of security fixes below or on the Apple Support website:

ActionKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A shortcut may be able to bypass Internet permission requirements
• Description: An input validation issue was addressed with improved input validation.
• CVE-2021-30763: Zachary Keffaber (@QuickUpdate5)

Audio

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A local attacker may be able to cause unexpected application termination or arbitrary code execution
• Description: This issue was addressed with improved checks.
• CVE-2021-30781: tr3e

AVEVideoEncoder

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: An application may be able to execute arbitrary code with kernel privileges
• Description: A memory corruption issue was addressed with improved state management.
• CVE-2021-30748: George Nosenko

CoreAudio

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution
• Description: A memory corruption issue was addressed with improved state management.
• CVE-2021-30775: JunDong Xie of Ant Security Light-Year Lab

CoreAudio

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Playing a malicious audio file may lead to an unexpected application termination
• Description: A logic issue was addressed with improved validation.
• CVE-2021-30776: JunDong Xie of Ant Security Light-Year Lab

CoreGraphics

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution
• Description: A race condition was addressed with improved state handling.
• CVE-2021-30786: ryuzaki

CoreText

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
• Description: An out-of-bounds read was addressed with improved input validation.
• CVE-2021-30789: Mickey Jin (@patch1t) of Trend Micro, Sunglin of Knownsec 404 team

Crash Reporter

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to gain root privileges
• Description: A logic issue was addressed with improved validation.
• CVE-2021-30774: Yizhuo Wang of Group of Software Security In Progress (G.O.S.S.I.P) at Shanghai Jiao Tong University

CVMS

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to gain root privileges
• Description: An out-of-bounds write issue was addressed with improved bounds checking.
• CVE-2021-30780: Tim Michaud(@TimGMichaud) of Zoom Video Communications

dyld

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A sandboxed process may be able to circumvent sandbox restrictions
• Description: A logic issue was addressed with improved validation.
• CVE-2021-30768: Linus Henze (pinauten.de)

Find My

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to access Find My data
• Description: A permissions issue was addressed with improved validation.
• CVE-2021-30804: Csaba Fitzl (@theevilbit) of Offensive Security

FontParser

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
• Description: An integer overflow was addressed through improved input validation.
• CVE-2021-30760: Sunglin of Knownsec 404 team

FontParser * Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) * Impact: Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents * Description: This issue was addressed with improved checks. * CVE-2021-30788: tr3e working with Trend Micro Zero Day Initiative

FontParser

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
• Description: A stack overflow was addressed with improved input validation.
• CVE-2021-30759: hjy79425575 working with Trend Micro Zero Day Initiative

Identity Service

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to bypass code signing checks
• Description: An issue in code signature validation was addressed with improved checks.
• CVE-2021-30773: Linus Henze (pinauten.de)

Image Processing

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may lead to arbitrary code execution
• Description: A use after free issue was addressed with improved memory management.
• CVE-2021-30802: Matthew Denton of Google Chrome Security

ImageIO

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted image may lead to arbitrary code execution
• Description: This issue was addressed with improved checks.
• CVE-2021-30779: Jzhu, Ye Zhang(@co0py_Cat) of Baidu Security

ImageIO

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted image may lead to arbitrary code execution
• Description: A buffer overflow was addressed with improved bounds checking.
• CVE-2021-30785: CFF of Topsec Alpha Team, Mickey Jin (@patch1t) of Trend Micro

Kernel

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication
• Description: A logic issue was addressed with improved state management.
• CVE-2021-30769: Linus Henze (pinauten.de)

Kernel

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations
• Description: A logic issue was addressed with improved validation.
• CVE-2021-30770: Linus Henze (pinauten.de)

libxml2

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A remote attacker may be able to cause arbitrary code execution
• Description: This issue was addressed with improved checks.
• CVE-2021-3518

Measure

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Multiple issues in libwebp
• Description: Multiple issues were addressed by updating to version 1.2.0.
• CVE-2018-25010
• CVE-2018-25011
• CVE-2018-25014
• CVE-2020-36328
• CVE-2020-36329
• CVE-2020-36330
• CVE-2020-36331

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted image may lead to a denial of service
• Description: A logic issue was addressed with improved validation.
• CVE-2021-30796: Mickey Jin (@patch1t) of Trend Micro

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted image may lead to arbitrary code execution
• Description: An out-of-bounds write was addressed with improved input validation.
• CVE-2021-30792: Anonymous working with Trend Micro Zero Day Initiative

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted file may disclose user information
• Description: An out-of-bounds read was addressed with improved bounds checking.
• CVE-2021-30791: Anonymous working with Trend Micro Zero Day Initiative

TCC

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to bypass certain Privacy preferences
• Description: A logic issue was addressed with improved state management.
• CVE-2021-30798: Mickey Jin (@patch1t) of Trend Micro

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may lead to arbitrary code execution
• Description: A type confusion issue was addressed with improved state handling.
• CVE-2021-30758: Christoph Guttandin of Media Codings

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may lead to arbitrary code execution
• Description: A use after free issue was addressed with improved memory management.
• CVE-2021-30795: Sergei Glazunov of Google Project Zero

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may lead to code execution
• Description: This issue was addressed with improved checks.
• CVE-2021-30797: Ivan Fratric of Google Project Zero

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may lead to arbitrary code execution
• Description: Multiple memory corruption issues were addressed with improved memory handling.
• CVE-2021-30799: Sergei Glazunov of Google Project Zero

Wi-Fi

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Joining a malicious Wi-Fi network may result in a denial of service or arbitrary code execution
• Description: This issue was addressed with improved checks.
• CVE-2021-30800: vm_call, Nozhdar Abdulkhaleq Shukri

What you need to know

• A flaw in the way iOS 14.6 handles iMessages saw journalists, activists, and others have spyware installed on their devices.
• This is despite iOS 14 protections that were supposed to prevent this from happening.

Journalists, activists, and other groups around the world have seen their iPhones infected with spyware without their knowledge — and without them having to tap a thing to initiate the download. The spyware, Pegasus by NSO Group, is available commercially.

According to a report by multiple news outlets as well as Amnesty International's Security Lab, commercial hacking spyware Pegasus has been found to infect thousands of devices. The report is based on a list of 50,000 phone numbers that were thought to be of interest to clients of NSO. When security experts inspected some of the devices attached to those numbers, they found infections galore.

For its part, NSO says that none of this is anything to do with the company — pointing out that it doesn't have access to anything its customers collect via its software. As if that matters one jot.

The fact that Pegasus can be installed without the victim doing anything is of particular concern, as is the fact it still seems to be able to worm its way onto devices running iOS 14.6, as noted by MacRumors.

While Apple is testing iOS 14.7 with beta testers right now, iOS 14.6 is the latest version available to everyone else. That means the best iPhone software available to the world, as of today, appears to remain vulnerable to Pegasus.

Those involved in the investigation intend to release a list of the people whose numbers appeared on the list of potential targets. It's said to include business executives, journalists, religious figures, and even government officials.

What you need to know

• A support document for the device police use to unlock suspects' iPhones has been seen by Motherboard.
• The GrayKey devices can unlock iPhones even when they're locked using an alphanumeric passcode and turned off.

Instructions on how to brute force and then extract data from an iPhone – including the latest iPhone 12 – using a GrayKey device have been seen by Motherboard and it's just as grim as you might think.

Procured via a freedom of information request and seemingly written by the San Diego Police Department, the document details what police can and cannot do with a GrayKey device – so long as they have a legal right to do so of course.

The document goes on to state that the agent used to unlock an iPhone can be installed even when the device has "2 to 3% battery life" left.

The use of an alphanumeric passcode is thought to be one way to try and scupper GraKey's ability to brute force a device, but that likely isn't the case if real-world words are used. Instead, a mishmash of random letters and numbers generated by a password manager would be a better option.

You can read more about what Motherboard saw in the original Vice piece and it's interesting reading for anyone who is concerned about law enforcement's potential access to their devices and data.

Apple is in a constant cat-and-mouse chase with devices like the GrayKey as it tries to ensure that data held on iPhones and iPads is as safe as possible. It's something that has drawn the ire of law enforcement officials before, with Apple itself often unable to access the data living on encrypted iPhones.

A locked and turned-off iPhone is the best iPhone in terms of security, but even then it seems GrayKey might be able to find a way in.

What you need to know

• A WebKit exploit exists that could allow the execution of malicious code on a Mac, iPhone, and iPad.
• Researchers told Apple how to fix the issue three weeks ago, but it still hasn't been done.

A security exploit that could allow malicious code to be run on Macs, iPhones, and iPads hasn't been fixed despite someone telling Apple how to do so three weeks ago. The flaw relates to WebKit across macOS, iOS, and iPadOS.

Webkit is what powers Safari and a number of similar web browsers and the bug appears to be related to AudioWorklet which manages audio output from web pages. When exploited, the bug could allow malicious code to be run as reported by ArsTechnica.

But most notable is the fact that security researchers have already provided Apple with the tools they need to fix the issue entirely – but three weeks later, that's yet to happen.

Apple recently shared a number of updates including some that fixed another WebKit security flaw in iOS 14. It isn't clear why this one didn't make the cut or indeed if it will in a future release.

Despite still being affected by this issue, the recently released iPad Pro is still arguably one of the most secure devices you can buy, thanks in part to the App Store and its app distribution model. Be sure to check out our collection of the best iPad Pro deals before you place your order!

What you need to know

• Apple's recent macOS Big Sur 11.4 release fixes a critical security bug.
• Attackers could have been able to take screenshots without the user knowing.

Apple's recent macOS Big Sur 11.4 release brought with it a fix for a critical security flaw that could have seen attackers able to take screenshots without the user being aware. Those same attackers could also have been able to record a user's screen, all by piggybacking off apps like Zoom amongst others.

The flaw itself was highlighted by device management outfit Jamf via a detailed blog post that goes into exactly what was going on and how attackers could have exploited the flaw. That flaw allowed an attacker to bypass key macOS privacy settings, allowing Full Disk Access and other permissions that would normally require a user's consent.

"In the latest macOS release (11.4), Apple patched a zero-day exploit (CVE-2021-30713) which bypassed the Transparency Consent and Control (TCC) framework. This is the system that controls what resources applications have access to, such as granting video collaboration software access to the webcam and microphone, in order to participate in virtual meetings."

"The exploit in question could allow an attacker to gain Full Disk Access, Screen Recording, or other permissions without requiring the user's explicit consent — which is the default behavior. We, the members of the Jamf Protect detection team, discovered this bypass being actively exploited during additional analysis of the XCSSET malware, after noting a significant uptick of detected variants observed in the wild."

The news that the exploit had been used isn't great, but Apple has now fixed the issue and as ever we'd suggest making sure that you update to the latest available build of macOS to make sure you're fully protected. You can also read more about the ins and outs of what went down over in that Jamf blog post, too.

Now that another security flaw has been fixed, why not check out some of the best iMac deals and treat yourself to one of those gorgeous, colorful computers?

What you need to know

• Someone has been able to send arbitrary text via the Find My network.
• They created a fake AirTag to send the messages.

Find My, the network of iOS and macOS devices that is used by AirTag and others for location tracking, can be used to send arbitrary text to other devices. That's the discovery of one security researcher who published their findings in a new blog post.

Researcher Fabian Bräunlein essentially created a fake AirTag to send text across the Find My network, receiving it on a remote Mac. It's notable that it isn't thought that the process used by Bräunlein is something Apple can easily work to block.

The good news is that the text that can be sent is so small it's unlikely anyone will be able to get up to no good. But the fact still remains – arbitrary text can be transmitted via the Find My network of millions of devices, all without their owners knowing.

There's a ton of technical information about what exactly went down over in the blog post and it's a fascinating read if you're so inclined.

This is all caused by the Find My network so the best Bluetooth trackers out here won't be susceptible. Something to keep in mind if you're at all concerned.

What you need to know

• Security researcher Jack Dates discovered a zero-day exploit with Safari.
• The researcher earned $100,000 for the discovery.
• The Zero Day Initiative pays security researchers to responsibly uncover vulnerabilities.

A security researcher has earned $100,000 for discovering a Safari exploit at the Zero Day hackathon event.

As reported by MacRumors, security researcher Jack Dates discovered a Safari to kernel zero-day exploit during the event, earning Dates $100,00.

The Zero Day Initiative, as it explains on the website, encourages security researchers to find zero-day vulnerabilities by compensating them for their discoveries.

You can check out an overview of the Zero Day Initiative below:

What you need to know

• There's malware out there that is adapting to run natively on the M1 chip.
• The malware in question is "GoSearch22," which disguises itself as a Safari browser extension.
• Never click on suspicious things.

Apple released its own M1 silicon a few months ago and has touted it to be the latest and greatest for the future of the Mac, but it's still susceptible to malware, apparently. That's right — malware that has been specifically tailored to run on M1 Macs has been discovered. This means that malware authors are adapting to Apple's latest technology.

A report by Mac security researcher Patrick Wardle, via Wired, explains all of the details about how this malware has been adapted and recompiled to natively run on the M1 chip. This malware was first discovered in the form of a Safari adware extension that was originally created for Intel x86 chips. "GoSearch22" is the extension in question, and it's apparently a well-known member of the "Pirrit" Mac adware family, first spotted towards the end of December 2020. Considered to be one of the oldest and most active Mac adware families, Pirrit is known to constantly change and evolve in order to evade detection. With this information at hand, it's not surprising that it has adapted to the M1 chip.

With GoSearch22, it will present itself as a legitimate Safari extension, looking innocent on the surface. But as it runs in the background, it will collect user data and deliver a large number of ads and popups, with some linking back to malicious websites to proliferate even more malware. According to Wardle's report, the adware has been signed with an Apple Developer ID last November to avoid detection — this verification has since been revoked.

This new M1 malware is still in the early stages, so it is hard to detect it with antivirus scanners when compared to the x86 versions. Any signatures that are usually used to detect security threats in malware on the M1 has not fully been observed yet, making resources scarce at this time.

The security company, Red Canary, had researchers tell Wired that there are also other types of native M1 malware, different from Wardle's results, have also been found and are currently being investigated.

As of right now, the M1 chip is only found in the MacBook Air, 13-inch MacBook Pro, and the Mac mini. It's expected to expand into the rest of the Mac lineup later this year. As Apple's technology for the Mac continues to evolve, we should also expect malware and other security threats to adapt and target them.

A good first step towards preventing malware and viruses on your Mac is to never click links or attachments that look suspicious.

What you need to know

• Apple has added a new BlastDoor security system to iMessage in iOS 14.
• It stops malicious messages from having access to the operating system and user data.

As reported by ZDNet, Apple has added a new security system called BlastDoor to protect against malicious attacks in its iMessage messaging service.

The system prevents malicious code hidden within a message to have access to the operating system or a user's data. According to the report, several security researchers in the past have pointed out iMessage's lack of sanitizing incoming data in iMessage, hence the addition of the BlastDoor service.

Groß says that the protection is most likely the best Apple could put in place considering its need to support older versions of iOS.

What you need to know

• Corellium is making its iOS virtualization tool available for individuals.

In a blog post, iOS virtualization company Corellium has announced that it is not offering virtual iOS-based devices for individual accounts. The company had previously only supported virtual iPhone and iPad devices for its Enterprise customers.

The company says that individual pricing will be the same as enterprise, charging per CPU cores required to run the virtual device. Corellium says that iOS devices can require up to 6 CPU cores to run.

Individual customers can choose either a monthly subscription model or a usage-based model to fit their specific needs.

The company has also stated that all individual accounts will go through the same vetting process as its enterprise clients to ensure their virtualization tools are not used for malicious purposes.

Corellium is the security research firm that just won a lawsuit filed by Apple this past December. Apple had claimed Corellium's virtualization tool violated its copyright, but the court ruled it did not, affirming it as a tool for security researchers.

You can have it for years, and it'll still work fine without any major issues. The downside is, when Apple releases a new Mac, you don't really need to get one since your current MacBook still works fine, and is still getting software updates, like Big Sur. If you're still rocking an older MacBook with no Touch ID, you don't know what you're missing. Being able to unlock your Mac with the tip of your finger is simple and more convenient than typing your password every time you use it.

Fortunately, you can still enjoy Touch ID, even if you're MacBook doesn't have the necessary hardware. And that's thanks to a little app called MacID. With this little app, you can unlock your Mac, control your music, and even send a copied text from your device to your Mac's clipboard. All that right from your iPhone or iPad. If you want to learn how to use Touch ID on older Macs, here's what you need to know.

How to get MacID

To use MacID, you'll need it on your iPhone or iPad and your Mac. You can purchase the iOS version in the App Store for $3.99. The Mac version is available for free directly from the developer's website. Make sure all of your devices are compatible before downloading the app.

• MacBook 2015 and newer
• MacBook Air 2011 and newer
• MacBook Pro 2012 and newer
• Mac Mini 2011 and newer
• Mac Pro 2013 and newer
• iMac 2012 and newer
• iPhone 4s and newer
• iPad 4th generation and newer
• iPad mini
• iPad Air
• iPod Touch 5th generation and newer
• Apple Watch

How to set up MacID on your iPhone and Mac

You'll have to set up MacID on both your iPhone (or iPad) and your Mac so the two devices can communicate with each other.

1. Launch MacID on your iPhone or iPad.
2. Launch MacID on your Mac.
3. Select your iOS device from the list in MacID on your Mac.
   • If no device appears, you can reset Bluetooth, which will restart your Mac. This will clear any miscommunications between your iOS device and your Mac.

4. Enter your Mac's login password.
5. Re-enter your Mac's login password to confirm.
6. Click Continue.
7. If applicable, make sure that MacID is set up to show on your Apple Watch.

When you look at MacID on your iPhone, you will see that your Mac is listed under Connected Devices.

How to use Touch ID on older Macs using MacID

Once the two apps are set up and synced to talk to each other, you will be able to set up MacID to automatically lock when you leave the room, wake up when you walk back into the room, and unlock using Touch ID on your iPhone or secure contact using Apple Watch.

1. With the screen locked, wake your Mac.
2. On your iPhone, hold your Touch ID registered finger on the Home button to unlock your Mac. On your Apple Watch, tap Unlock.

Your Mac will unlock and you can start working.

You can set up your Mac to automatically lock when you walk away from it (and have your iPhone and Apple Watch on you). I should note that, even if you have MacID on your Apple Watch, you will need to move your iPhone away from your Mac to trigger proximity auto-lock.

1. On your Mac, click on MacID in the Menu bar.
2. Click on Auto-lock when away from Mac from the drop down menu.
3. Click on the distance threshold to lock your Mac. You can choose from low, medium, high, or a customized distance.

When you walk away from your Mac, it will automatically lock.

You can set up MacID so that it wakes your screen when you walk into the room. You can also enable it to automatically unlock your Mac, instead of having to follow the two-step process of waking, and then unlocking your Mac. This method is slightly less secure, so I only recommend using it with Macs that are stationary in your home and won't ever leave your house.

I should note that, even if you have MacID on your Apple Watch, you will need to move your iPhone away from your Mac to trigger proximity wake.

1. On your Mac, click on MacID in the Menu bar.
2. Click on Proximity Wake from the drop down menu.

3. Click On.
4. Click Custom to adjust how close you must be to wake your screen.
5. Click on Unlock automatically to enable MacID to wake and unlock your Mac in one step.

How to lock or unlock your Mac with a tap pattern using MacID

You don't have to use biometrics to unlock your Mac. If you have a trackpad or Magic Mouse, you can actually set up a tapping pattern instead.

1. On your Mac, click on MacID in the Menu bar.
2. Click on Tap to Unlock.
3. Click on Set up.

4. Hover your mouse over the virtual trackpad on the screen and tap your physical trackpad or Magic Mouse in specific spots.
   • This takes a bit of practice to get used to, so you may have to re-setup your tap pattern a few times before you get it right.
5. Click Save.

6. Click on MacID in the Menu bar again.
7. Click on Tap to Unlock.
8. Click on Taps visible on Lock screen to see a visual notification that your taps are actually working when your Mac screen is locked.
9. Click on Only enter password if primary device is connected so that you can't use the trackpad or Magic Mouse to unlock your Mac if your iPhone or iPad is not connected.
10. Click on Tap pattern also locks Mac to enable the ability to lock your Mac using the same tapping pattern.

How to control audio playback on your Mac with your iPhone or iPad using MacID

You can do many other things using MacID, not only learning how to use Touch ID on older Macs. For instance, if you are playing music from your Mac, you can use MacID on your iPhone or Apple Watch to pause/play or skip ahead or back. On Apple Watch, you can also adjust the volume or mute the audio.

1. Play music on your Mac.
2. Launch MacID on your iPhone or Apple Watch.
3. On your iPhone, tap pause/play, skip ahead, or skip back on the connected device. On your Apple Watch, tap the musical note, then tap pause/play, skip ahead, or skip back.

4. On your Apple Watch, tap volume up, volume down, or mute to adjust the audio.

How to turn on your Mac's screensaver using MacID

With MacID, you can quickly trigger the screensaver on your Mac without having to wait for it to turn on automatically.

1. Launch MacID on your iPhone or Apple Watch.
2. On your iPhone, swipe to the left on your connected device.
3. On Apple Watch, tap the More button (...).

4. Tap Screensaver.

How to share clipboards between iOS and Mac using MacID

MacID makes it possible to copy text from your Mac and paste it on your iPhone or iPad. So, if your Mac doesn't support Universal Clipboard in macOS Sierra, you're in luck.

1. Copy text from a document, app, or web page on your Mac.
2. On your Mac, click on MacID in the Menu bar.
3. Click on Send clipboard text to all iOS devices.

4. On your iPhone, select a text field (like email, message, URL, etc.).
5. Press and hold the screen until the options menu appears.
6. Tap Paste.

The text you copied from your Mac will paste into the text field on your iPhone or iPad.

Any questions?

As you can see, MacID has a bunch of features you can use, but they may be hard to understand at first. Do you still have any questions about how to use Touch ID on older Macs? Let us know in the comments!

Updated December 2020: Updated for iPadOS 14.

Your Apple Watch isn't only useful for tracking your fitness or using Apple Pay: If you have a compatible Mac, you can also use Auto Unlock: The feature (which requires macOS Sierra or later and watchOS 3 or later) lets you pair your watch to your Mac; once you've done so, you can automatically unlock your computer just by sitting down in front of it, no password required — if your Apple Watch is unlocked and on your wrist when you sit down. Here's how.

Before you start using Auto Unlock

Before you start using Auto Unlock, you'll need to make sure your Mac and Apple Watch are compatible and that you've set up two-factor (not two-step) authentication for your iCloud account.

To use Auto Unlock, you'll need:

• Any Mac manufactured mid-2013 and later (sorry, early 2013 Mac owners)
• An Apple Watch Series 0, 1, 2, 3, 4, 5, 6, and SE

If you own an Apple Watch Series 0, 1, or 2, you'll need to be running watchOS 3 or later on your smartwatch; additionally, your compatible Mac needs to be running macOS Sierra or later. Newer Apple Watches need watchOS 4 or higher.

Note: Your Mac must have Wi-Fi and Bluetooth turned on.

Because you can use Auto Unlock to bypass your Mac's login password, Apple wants to make sure your computer is as safe as can be by enabling two-factor authentication on your iCloud account.

• How to set up two-factor authentication for Auto Unlock

Note that we said two-factor, not two-step — the latter was Apple's older enhanced security protocol, while the former is the company's most secure version. If you already use two-step verification, you'll have to disable it to start using two-factor authentication.

To enable two-factor authentication, your iPhone will also need to be running iOS 9 or higher.

To use Auto Unlock, your Apple Watch and Mac must be using the same iCloud account. Make sure you've signed in on both devices with the same Apple ID.

• How to log in and manage your iCloud account

You may not have thought it necessary to use a passcode with your Apple Watch when you first set it up, but if you want to use Auto Unlock, you'll need one.

• How to create or remove a passcode on your Apple Watch

You also need to set up a login password on your Mac.

• How to add or change your Mac's login password

If your Apple Watch isn't unlocked and on your wrist, you won't be able to connect it with your Mac. If it is on your wrist and unlocked, your Mac will register the device and allow you to turn on Auto Unlock.

How to enable Auto Unlock on your Mac

Once you've prepared your devices, enabling Auto Unlock is a breeze.

1. Click on the Apple icon in the upper left corner of your screen.
2. Select System Preferences from the drop-down menu.

3. Click on Security & Privacy.
4. Click on General.
5. Tick the box to Use your Apple Watch to unlock apps and your Mac.Auto Unlock will activate; this will take a few seconds.

Note: If you don't see the box to allow your Apple Watch to unlock your Mac, there's an issue. Review your preparatory steps above; if you still see a problem, check out our troubleshooting guide.

Troubleshooting Auto Unlock: Why can't I see Auto Unlock on my Mac?

There are a few additional steps you may have to take if you can't enable Auto Unlock. We've got a full guide below:

• Can't unlock your Mac with your Apple Watch? Here's how to fix it!

What time is it?

Are you in the market for a new Apple Watch? Check out our favorites of the year.

Any questions?

Let us know in the comments!

Updated November 2020: Updated for the new devices.

What you need to know

• New research raises concerns about how messaging apps handle link previews.
• Some apps could be leaking your location to third parties.
• Files you share could also be accessible by other people and companies, too.

New security research by Talal Haj Bakry and Tommy Mysk has found that some messaging apps are mishandling data, potentially sharing details like your IP address and location with third parties. Files that you send could also end up on a third-party's server as well.

On top of all that, link previous could also download multiple gigabytes of data if the link takes a messaging app to a large file.

Link previews give the person receiving a URL a glimpse of what they will see if they tap on it. But that preview needs to be generated and if it's the receiver doing it, it could be happening on a server somewhere. And it's there where the data leak can happen.

The researchers tested a number of popular and high-profile messaging apps and services including Discord, Google Hangouts, Instagram, Slack, Zoom, and iMessage. Some fared better than others with one in particular, LINE, behaving particularly badly. While it offers end-to-end encryption on its messages, it still sends links to a server for the preview to be generated. Effectively undoing the encryption.

Even worse, some apps allow malicious actors to run arbitrary JavaScript code on remote servers via a well placed link.

The full report is a great read if you're at all interested in what can happen when developers and back-end server architects don't think things through properly. Thankfully, some companies have already reacted to the findings of this report. Now we need the rest to follow suit.

You may not keep security information or top-secret plans on your Tumblr account, but that doesn't mean it's not worth securing from potential password hacks. Here's a quick guide on setting up two-factor authentication to protect your Tumblr gifsets, memes, songs, blogs, and more.

How to set up Tumblr's two-factor authentication

After logging into Tumblr, setting up two-factor security is as simple as visiting the settings page. Here's what you need to do.

1. Click the user icon in the upper-right corner of the Tumblr website.
2. Click Settings.

3. Under Security, flip the switch next to Two-factor authentication.
4. Enter you account password.

5. Click Enable.
6. Click the switch next to either Send code via SMS or Generate code via authenticator app. For better security, choose to generate a code in an authenticator app like Google Authenticator or Authy, or a password manager that supports that functionality like 1Password.

7. With your authenticator app, scan the QR code that appears on-screen.
8. Enter the code your authenticator app gives you.

9. Click Enable.

If you choose to use SMS (which is a much less secure method of two-step authentication), follow the steps above through Step 5, when you click Enable. After that, do the following:

1. Click the switch next to Send code via SMS.
2. Enter your phone number.

3. Click Send Code.
4. Enter the code sent to you over SMS.

5. Click Enable.

Additionally, because Tumblr uses the Google Authenticator service for two-factor authentication, this means that you can use an app like Authy instead of an SMS message to authenticate your account. You can set that up by toggling the Generate code via authenticator app option.

This gives you a QR code you can scan with the Google Authenticator or Authy apps; from there, you can generate random approval codes whether that device is connected to the internet or not.

Questions?

Let us know in the comments.

Your Dropbox account has been designed to store some of your most important documents. To better secure your Dropbox account, consider activating two-factor authentication. With this type of authentication, there's a more substantial barrier against would-be hackers by requiring anyone who attempts to access your account have both your password and access to your mobile devices. Here's how to set it up.

How to set up two-factor authentication for Dropbox

1. Log into your Dropbox account at the official website.
2. Click your account at the top right of the page.
3. Choose Settings from the pull-down menu.

4. Choose Security at the top of the page.
5. Toggle on Two-Factor Authentication.

6. Click Get Started in the box.
7. Add your Dropbox password in the box.
8. Choose Next.

9. Choose how to receive your security code. Choices include Use text messages or Use a mobile app.
10. Click Next after making your choice.

1. Add your phone number for your mobile device in the boxes.
2. Choose Next.

Follow the directions, which include confirming that you received information from your mobile phone.

1. Scan the barcode on the screen using your mobile phone to open up your authenticator app.
2. Choose Next.
3. Add the six-digit code from your authenticator app.
4. Select Next.
5. Add an optional phone number.
6. Choose Next one final time.

After activating two-factor authentication, you'll need to use your Dropbox password and mobile device to log into your Dropbox account for the first time on a new device.

Questions?

Let us know if you have any questions about Dropbox or two-factor authentication in the comments below.

What you need to know

• TikTok is big. Really big.
• But it isn't without its problems, including security flaws.
• The latest allows bad actors to make fake videos appear as if from trusted accounts.

TikTok is hot right now but it's already had a security scare after it turned out the app could read your iPhone's clipboard without your knowledge. Now things are even worse – people can create fake videos and make them appear as if they came from verified and trusted accounts.

The revelation came after developers Talal Haj Baktry and Tommy Mysk shared details about their escapades in a blog post. The gist is surprisingly simple – TikTok pulls videos from a content delivery network (CDN) via a standard HTTP connection. That means there's no encryption. And that means the whole thing can be spoofed.

But both Apple and Google give developers a way to opt out so they can maintain backward compatibility where needed. But TikTok seems to be using this opt-out option for reasons unknown. By doing that it opens itself up to all kinds of problems by doing so. TikTok for iOS (Version 15.5.6) and TikTok for Android (Version 15.7.4) still use unencrypted connections.

So the two developers set about creating their own server and pointing their DNS server at it. That meant that any request for one of TikTok's three media servers went to a server that was owned by the developers. And then they went to work.

The result? See for yourself.

This threat does require that someone have access to the DNS server your device is using. But that's easier than you might think. Internet Service Providers, unscrupulous VPN companies, governments, and more could all tamper with DNS entries. Especially if you happen to live in certain parts of the world.

With "around 800 million monthly active users," TikTok really ought to up its game. And fast.

I'm a huge proponent of backing up all the things — your computer, your phone, your tablet, your laptop, your smartwatch. If you store any kind of data on any of your devices, you should be protecting that data by executing a backup plan.

We've done the research, gone through the processes, tried the products, and come up with the ultimate guide to backing up everything. Whether you are protecting private information, securing family photos, or just want to keep a log of your daily jog, you'll find everything you need to know about backing up your iPhone, iPad, and Mac right here.

Why should you have a backup plan?

Some people will tell you that they don't need a backup plan because they keep everything in the cloud. While cloud storage is absolutely a great way to make sure much of your data is backed up, it's a very good idea to have a secondary, and even a tertiary plan for added protection. A hard backup of your iPhone or iPad makes it possible for you to restore your device settings. Backing up your Mac with a hard drive and an off-site backup service ensures that you're doubly protected in case something goes wrong.

Why should you back up your device?

Best services and accessories for backing up

If you haven't even started the process of planning how to back up your data, iMore Editorial Director, Rene Ritchie, has a quick and dirty plan to get you motivated. Before you get started, you're going to need a few peripherals. Once you decide which plan is right for you, check out our suggestions for backup services and hard drives to meet your needs.

• Best backup services and programs for your Mac
• Best cloud service apps for your iPhone and iPad
• Best photo backup services for the iPhone, iPad, and Mac
• Cheap cloud services: which ones save you the most?
• Best hard drives for backing up your Mac
• Best thumb drives for backing up your iPhone

How to back up everything

Once you've figured out what plan (or plans) you want to use to have a solid backup plan, you'll need to know how to actually back up your data. If you're backing up your Mac, iPhone or iPad, Apple TV (sort of), or Apple Watch, we have all the steps to secure your data on all of your devices.

There are a variety of ways you can back up your Mac, including using the built-in backup program Time Machine. You can also use cloud-based or cloning services, and there are even ways you can back up your contacts and store your desktop files in iCloud.

• How to back up your Mac
• How to back up your Mac with Time Machine
• How to back up your Mac with a cloud service
• How to clone your Mac
• How to encrypt your backups on the Mac
• How to back up your iCloud Photo Library
• How to back up your contacts on the Mac
• How to save your Desktop and Documents Folder on the Mac

You might think that iCloud keeps your iPhone and iPad safe from data loss. For the most part, that's true, but there's a little more to it. You can selectively back up some data, copy chats, save voicemails, and a lot of customizable backup options.

• How to back up your iPhone and iPad
• How to choose what your iPhone backs up to iCloud
• How to extract your messages and voicemail from your iPhone and iPad
• How to back up your WhatsApp chats
• How to move your iPhone and iPad backups to an external drive
• How to delete old iCloud backups

So, there is no way to simply back up every byte of data on your Apple TV, even in a cloud-based service, but much of your content is linked to your iTunes account and Apple ID. iCloud can also keep your photos safe. Until Apple lets us back up our Apple TV data, here are the backup workarounds.

How to back up your Apple TV

Apple Watch automatically backs up to your iPhone. So, as long as your iPhone data is safe, so is your Apple Watch data. Transferring health data from an old Apple Watch to a new one, or and old iPhone to a new one, can be a little bit tricky, but it is possible.

• How to back up your Apple Watch
• How to save and back up your Health data on your Apple Watch
• How to move your health data to a new iPhone

How to restore your data from a backup

OK, so now that you have a backup plan in place and all of your precious data is secure, what do you do? Well, hopefully, nothing ... ever. But, if you ever have an issue with your iPhone, iPad or Mac, you can use your backed up data to restore some or all of its content.

• How to restore your Mac from a backup
• How to restore your iPhone or iPad from a backup
• How to restore your Apple Watch from a backup
• How to recover deleted photos from iCloud

How to recover data when you don't have a backup

I'm not going to say, "I told you so," but if you're reading this, there is a chance that you didn't execute a backup plan, and now you're looking for some help recovering data that you have lost. Before you start looking for a tech service that recovers data from corrupted computers and phones, take a look at our suggestions. It's possible you can get back that little something important without having to spend a lot of money.

• How to recover older file versions of a document within an app
• How to contact Apple support if you can't recover files on your Mac

Troubleshooting backup problems

Even when you have the perfect backup plan in place, things can go wrong. Take a deep breath and read some of our support articles. If you don't see your problem, be sure to visit our forums. The iMore community is the best around. They are patient, friendly, and love to help people having a tech crisis.

• How to free up space on your Mac by deleting old backups
• How to keep all of your private photos off iCloud

Questions?

How do you back up? Let us know in the comments.

Apple has made some excellent improvements to password and account management in iOS and iPadOS, including the ability to access stored accounts and passwords when you're logging in on the web and in apps. In apps and on websites that use username and password fields, your iPhone 14 Pro or iPad will display a key icon above the keyboard. Tapping on the key will give you access to your stored accounts and passwords, letting you log in to your account with a few quick taps. If you're looking for your accounts and passwords — either to edit them or add to them — here's where you find them!

How to find your accounts and passwords on iPhone or iPad

1. Open Settings on your iPhone or iPad.
2. Tap Passwords.
3. Authenticate as needed with Face ID or Touch ID.

4. Tap the search field to search for an entry if you need to.
5. Tap the entry you're looking for.

6. Tap on a username/email address or password if you want to copy one of them.
7. Tap Copy to copy the username/email address or password.

When you've gained access to your accounts and passwords, you'll see a searchable list of entries. Tapping an entry will bring up a Username, a Password, and the Website that corresponds with your account. You can tap and hold on both the Username and Password entry to copy their contents.

How to add accounts and passwords on iPhone or iPad

iOS has a built-in mechanism for adding account and passwords to your iCloud Keychain. When you start to create an account, Safari will suggest a password for you. If you choose to use that password, Safari will also save your account details to iCloud Keychain. You can learn more about using iCloud Keychain by checking out the following post:

How to use iCloud Keychain on iPhone and iPad

If you'd like to manually add accounts and passwords on iOS, here's how!

1. Open Settings on your iPhone or iPad.
2. Tap Passwords.
3. Authenticate as needed with Face ID or Touch ID.

4. Tap the + button in the top-right corner of the screen.
5. Type in the Website, Username, and Password fields where you'll use these credentials.
6. Tap Done.

How to delete accounts and passwords on iPhone or iPad

1. Open Settings on your iPhone or iPad.
2. Tap Passwords.
3. Authenticate as needed with Face ID or Touch ID.

4. Tap Edit in the top right corner.
5. Tap to select the credential(s) you want to delete.

6. Tap Delete in the upper-left corner.
7. Tap Delete.

The password will be removed from iCloud Keychain and will no longer be accessible when you access the website associated with it.

Maintain easy access to vital data

If you've been having trouble finding your accounts and passwords on the iPhone or your best iPad, this confusion could definitely cause a lot of headaches. With these simple instructions, you should have no problem from now on. This interface will also inform you if any of your passwords have appeared in a data leak, so it can't hurt to come back and check regularly.

Updated December 2022: This article was updated to reflect the latest version of iOS.

Security is at perpetual war with convenience. The faster and easier it is for us to get to our stuff, the faster and easier it is for someone else to try to break in. Make it tougher for them, though, and it can get tougher for us as well. One of the biggest advantages the iPhone and iPad give us is a better balance of the two. Touch ID and Face ID let us have strong passwords but also biometric access. iCloud Keychain lets us have unique passwords but not have to remember them all. Two-step authentication protects our accounts but in a way that's still simple to use. That said, the iPhone and iPad also have options that help us be even more private and secure. Here's how to use them!

1. Be strong

If you have a recent iPhone or iPad, you have one of Apple's personal identity sensors—Touch ID or Face ID. It lets you use biometrics to authenticate so you can unlock your device and use Apple Pay, and authorize purchases for iTunes, the App Store, and other apps. Because of this added convenience, you now have the option of creating a six-digit password, rather than using just four digits.

Take advantage of it—if you're not using 6-digits yet, go to Settings > [Touch ID or Face ID] & Passcode, and change your passcode. You'll be able to enter a new six-digit code. Even better, because you no longer have to enter your passcode as often, switch to a stronger, longer, more complex password lock instead. Sure, once in a while it'll be a pain to enter it, but that's offset by how infrequently you have to do it—only when you reboot, fail Touch ID or Face ID multiple times, or don't use your phone for 48 hours. (If you're really concerned about security, and are willing to give up on convenience for it, turn Touch ID or Face ID off and force a strong, complex password for entry.)

Even if your device doesn't have Touch ID or Face ID, you should absolutely still use a passcode lock. Not only does it protect your iPhone or iPad from casual snooping—or from people tweeting "poopin" the minute you leave it unattended—it prevents thieves from getting your data, and makes wiping it just a secure.

2. Be private

What good is having biometric ID and a 6-digit passcode or strong password if the lock screen gives all your personal data and access away?

• Control Center lets you turn on the flashlight with unlocking, but also lets a thief turn on Airplane Mode to prevent tracking.
• Notification Center lets you glance are your messages and updates, but also lets a snooper do the same.
• Siri lets you ask questions and give commands, but also lets anyone else pull up some of your information.

Touch ID and Face ID are so convenient that it only takes a second or two to unlock anyway. So, if you're the least bit concerned about privacy and security, disable notification center, control center, and even Siri from your lock screen. If you want to go half-way, disable control center and turn off previews for your messages. That way no one can disable your device or read your messages (though they can still see who messaged you).

3. Be safe

Security works best with defensive depth, and defensive depth means having as many layers to your security as possible. A passcode is something you know. Touch ID and Face ID—your fingerprint and your face—are things you have. Sadly, since Apple doesn't allow you to use both passcode and biometric identification for added security, that alone doesn't add any depth. It simply adds convenience. Enter 2-step verification.

With 2-step you need to enter both as password and a token—something you know and something you have. The token is supplied to your iPhone, iPad, Apple Watch or another device over SMS or over an app like Google Authenticator, Authy, 1Password, etc. That way, if someone gets your password but doesn't have the device and the current token—which change continuously—they still can't get in.

Not all services offer it and many do it differently but for anything that contains personal information, including your email, messages, online storage, etc., you should absolutely enable it.

Note: Apple is in the midst of transitioning from an old to the new 2-factor system but everyone should still have access to one of the two.

• How to set up two-factor authentication for iCloud
• How to set up two-factor authentication for Google
• How to set up two-factor authentication for Dropbox
• How to set up two-factor authentication for Facebook
• How to set up two-factor authentication for Twitter
• How to set up two-factor authentication for Tumblr
• How to make two-factor authentication easy with Authy

4. Be clean

What you look at on your devices is your business. If you don't want it being anyone else's business, though, you should make sure cookies, web history, and other information about your browsing doesn't get recorded and tracked across the internet. Safari pioneered private browsing, but almost every browser offers it now. They also offer ways to delete information that's already been logged. For iPhone and iPad, simply go to Settings > Safari. For Google, regardless of device, go to activity controls.

If you're at a coffee shop, hotel, or some other public place where you can't trust the network, you may want to consider tunneling your activities through a VPN as well.

5. Be tough

Just because an app wants your location it doesn't mean you want that app to have it. Not only is your location among the most private information you have, monitoring your location is a drain on your iPhone's or iPad's battery and processor. So, make sure you go through your Settings > Privacy > Location and turn off anything you don't use regularly or need urgently. You can always turn in back on when and if you need it again.

Likewise, if you've given other apps access to your Twitter (make sure you use Share > Request Desktop Site on iOS), Facebook, or other accounts, periodically go through and review that access as well.

6. Be smart

Security is at constant war with convenience. Fortunately, in order to tip the scales slightly more towards convenience, there are password managers. They store all your strong, unique passwords and grant you access with either a single master password or your fingerprint or face via Touch ID or Face ID. Thanks to action extensions, you can even use them to fill passwords right into Safari and other apps.

iCloud Keychain comes built right in, but if you want to be even more secure, you can use 1Password, Lastpass, DataVault or another dedicated password manager that offers additional features like security audits, alerts, teams, token support, and more.

Your top tips?

Those are our top tips for taking your iPhone, iPod touch, and iPad security to the next level! If you've got any other tips, or alternate ways to keep stuff safe on iOS, let us know!

What you need to know

• U-Lock secures bicycles using biometric technology.
• Cabinet and Drawer Locks operate completely wirelessly using AA batteries.
• Updated colors for padlocks will also be available soon.

Popular biometric lock company Benjilock is back with its latest offerings that takes security on the go and inside of the home. Announced at CES 2020 today, Benjilock has introduced a bicycle lock, a cabinet/drawer lock, and some color updates to their existing padlocks.

Benjilock's U-Lock, which comes in both 6 and 8 inch variants in a matte black finish, provides a way to cyclists to secure their bikes while out on the road. The lock uses the company's biometric technology to store up to 10 unique fingerprints, enabling a convenient way for riders to access their bike without yet another key.

For security, the lock includes a "case-hardened" steel shackle that the company claims can resist bolt cutters as well as a pick and drill resistant cylinder. The U-Lock also features an IP65 weather resistance rating and is powered by an internal lithium battery that can last up to 6 months on a single charge. And just in case something goes really wrong, a physical key can be used for bike access if needed.

Inside the home, Benijilock has introduced their Cabinet and Drawer Lock which was designed for bedroom and closet use. The company states that they see it as a way to keep children from accessing things such as medications, as well as others from getting their hands on valuables such as jewelry.

The Cabinet and Drawer lock can be installed on most sets of furniture, and is powered by 4 AAA batteries. Just like with the bicycle lock, the indoor lock unlocks via a scan of a fingerprint, and is capable of storing up to 10 different prints in total. The drawer lock will be available in matte black, satin nickel, and satin brass when they are released later this year.

Benjilock has also announced that additional colors for their line of travel and padlocks will also be hitting the market soon. The full-size 43mm padlock is getting a new "dark navy" color, and the smaller TSA Travel/Luggage lock is getting a new "rose gold" finish.

The U-Lock will be available in Q3 2020 with an MSRP of $69 and $79 depending on size. The Cabinet and Drawer Lock will also be available in Q3 with a retail price of $75 regardless of color option. Pricing and availability for the updated pad and travel lock colors has not yet been revealed.

What you need to know

• ToTok is a popular chat app.
• It's been removed from the App Store by Apple.
• There are concerns that it is a spy tool used by the UAE.

Apple has removed the popular ToTok chat app from the App Store after a New York Times (via 9to5Mac) report said that the app was used by the United Arab Emirates as a spy tool. A classified intelligence assessment also raised concerns.

ToTok might not be a household name yet but lat week it was able to become one of the most downloaded social apps in the United States. However, it has been revealed that it was phoning home to the UAE government. With sensitive data also shared.

It's worth noting that the app does not offer end-to-end encryption so anyone with access to the data would be able to read anything and everything. Essentially, no messages sent via ToTok were safe from being read. And the report notes that the company behind ToTok is a front for the UAE government.

But it seems none of this is news to the US intelligence services who have already warned allies that they shouldn't use the app over fears that it isn't secure.

If you do or have used ToTok, I'd suggest removing it from your devices as soon as possible.

Between the Tile Mate and Chipolos Classic, I have to give the edge to the Tile. While you'll probably be happy with either tracker, the Tile has a louder maximum ring volume, is water resistant, and has a battery that will last a solid year. It's range might be a bit shorter than the Chipolo Classic's, but it's still probably long enough to find anything you might have lost inside your home.

If you want color options, a slightly longer range, and don't mind changing the battery a little more often, the Chipolo Classic is still a good tracker.

The breakdown

There's a lot that the Tile Mate and Chipolo Classic have in common. The trackers are around the same size, and owners of either tag can utilize the respective community of Tile or Chipolo owners to find items that they've left behind someplace. But the differences between the two are important to note.

The Chipolo Classic's biggest advantage used to be its range. At 200 ft, Chipolo beats most of the competition by about 100 feet, but with the latest revision to the Tile lineup, that advantage has disappeared, as the Tile now also sports a 200-foot rang. The Classic does still come in more colors, with six available: yellow, red, blue, white, green, and black, so you can get the one that best matches your personal style.

Meanwhile, the Tile Mate's biggest advantages are its battery life and ring volume. When you ring your Tile Mate to try to find it, it's maximum volume is 119 decibels (dB), almost 30 dB louder than the Chipolo (and almost 40dB louder than the previous-generation Mate). It's battery also lasts for a year, and like the Chipolo, that battery is replaceable. The Tile Mate also has an advantage with voice assistants. Like the Chipolo, the Tile Mate is compatible with Google Assistant and Amazon Alexa, but if your iPhone is running iOS 12 or later, it's also compatible with Siri thanks to Shortcuts. You can create a shortcut, complete with a custom activation phrase, to find your lost item using Siri.

While we'd like to see a more robust rating (like those found in past Tiles), the Tile features an IP55 dust and water protection rating. This means that its rated for protection against some dust intrusion, as well as low-power water jets. While you certainly shouldn't submerge your Tile, it's still better protected than the Chipolo if you take your things around water.

These are both great tracking tags, each with their own advantages, but all things considered, the Tile Mate is your best bet. A year of battery life, compatibility with all of the major voice assistants, water resistance, and a louder ring volume all help elevate the Tile Mate above Chipolo's offering. If you want more something more colorful or smaller, then the Chipolos Classic is still a good choice

Both cameras offer great solutions for keeping an eye on your castle. While the Nest Cam has several different options to choose from, the Circle 2 is a much better all-in-one package.

What's the same

Both the Circle Cam 2 from Logitech and the Nest Cam from Nest and Google (Google purchased Nest a few years ago) do essentially the same thing: they monitor your home to watch for predators or to make sure those in the house are safe. They each have quite a few similar features that make them compelling options for anyone looking to add some home security.

To have a successful home monitoring system, you need a camera or cameras that can mount indoors or outdoors; they need to be able to see a large area with a high-quality image; they need to be able to store footage to review later. Thankfully, both of these cameras do all of those things well. Each of them is able to be installed anywhere inside or outside of your home, the cameras record in 1080p to ensure that you always have a clear image, and both companies offer storage options for the footage. If that's all you need, either of these products is a win.

What's different

While the service they provide may be the same, each company has a different way of going about it.

Logitech went with an all-in-one approach. The Circle Cam 2 is a single camera that's weatherproof so it can be mounted inside or out — you can even mount it on a window with the optional window mount accessory. This allows for limitless flexibility, so you don't have to worry about getting the right camera for the right place in your home. It also included compatibility with Alexa, Siri, and Google Assistant so no matter how you control your smart home, your Circle Cam will work.

Google, on the other hand, offers four different Nest cameras: the Nest Indoor, Nest Indoor IQ, Nest Outdoor, and Nest Outdoor IQ. While options are great, sometimes having too many can be difficult. If you go with Nest, you have to make sure you look at exactly what your needs are and make sure you get the exact camera setup you need. Because it's owned by Google, Nest will only work with Google Assistant and while the Indoor IQ camera has Google Assistant integrated directly into the camera, not being able to connect to Siri or Alexa may be a dealbreaker for some.

Having a clear image is important for security cameras but so is how much you can see. The Field of View (FOV) is the term for how much the camera can see in through the lens and here Logitech has done a little better. It offers a 180-degree FOV whereas Nest only has 130 degrees on its (base model) indoor camera. Being able to capture more things in one image can make quite a difference in home security.

Storage is gonna cost you

Both have storage options but again, go about it in different ways. Logitech offers 24 hours of video storage for free with 14-day and 31-day options available for a subscription. The 31-day subscription option also allows you to set person detection and Motion Zones in your house to alert you when movement happens inside those zones.

The only free storage option from Nest is three hours of motion snapshots and audio, so no video storage for free. Thankfully, each of its subscription options includes all of the premium features. You don't need the highest tier to get any extra features — the only difference is storage length. You can choose between 5-, 10-, and 30-day options.

Anything else?

There are a couple more features worth noting. The Circle Cam 2 has an available wireless option if you wanted to go portable. The wireless has a 130-degree FOV and motion based fixed length recording of 10, 30, and 60. HomeKit does not yet support power saving mode for the Circle Cam 2 but Logitech and Apple are working on a fix. Also, battery life is rated from "a few days to as long as three months" depending on usage.

The Nest Cam offers a feature called Supersight which will zoom in and track a person if any motion is detected within an Activity Zone, which we think is handy.

Verdict

For me, the clear winner is the Logitech Circle Cam 2. It offers an all-in-one package that is cheaper than the Nest with free 24-hour video storage. With a larger FOV and the ability to work with whichever automation system I want, it's hard to turn away from it. If you're all in on Google Assistant and you know exactly what camera you need for your home then Nest is a great option for you. For everyone else, Logitech is the better buy.

Tile has finally listened to the cries of its consumers and created two versions of the Tile with replaceable batteries. This is fantastic news. For one, you won't have to buy a new Tile every year, and secondly, our landfills will fill up with unusable Tiles at a slightly slower rate. If you need to know how to replace the battery on your Tile, it's incredibly easy. Here's how to do it.

• Battery power: CR1632 battery for Tile Mate ($6 at Amazon)
• Replace it: CR2032 battery for Tile Pro ($6 at Amazon)

How to replace the battery on your Tile Mate or Tile Pro

1. On the back side of your Tile, push down gently on the battery door and slide out.
2. Use a paperclip or something similar to pop the battery out of the cavity.Source: Tile

3. Insert the new battery into your Tile.
4. Slide the battery door back from whence it came.

Once your fresh battery is installed and the door replaced, your Tile is ready for action for another year. You will no longer have to worry about wandering around, looking for those misplaced items.

Your best buy for batteries

These are the mandatory or core equipment selections. Optional or ancillary equipment will follow.

There are so many options when it comes to buying a battery on Amazon that it can be overwhelming at times. This pack represents a great deal and won't see you drowning in unused batteries for years to come.

For me, 10 batteries are the perfect amount. I won't have to rush out and buy more right away, and I won't have to find a place to stash 50 of them.

The older Tile versions do not allow you to replace the battery. This means that you would have to replace the whole darn thing. If you replace them one last time with the newer models, you will merely have to swap out the battery every now and then.

Tile Mate ($25 at Amazon)

The Tile Mate is the entry-level model. Find all your missing items as long as they are within 200 feet.

Tile Pro ($35 at Amazon)

If you want to upgrade your Tile game, then you can get this two-pack of Tile Pros. The pro helps you find your missing stuff within a 400-feet.

There are quite a few reasons to get Tile Premium if you're already using Tile products, including Smart Alerts, free battery replacements, location history, extended warranty, unlimited sharing, and premium customer support.

The Smart Alerts are super useful to have. With this enabled, you'll be notified every time you leave home without your Tiles or Tile-enabled devices.

The Tile Mate and Tile Pro have replaceable batteries. Previous versions required buying an entirely new unit once the battery ran out since they were not replaceable. If you subscribe to Tile Premium, you'll get free yearly battery replacements for all applicable Tile Mate and Tile Pro units that you own.

Location History tells users exactly where their Tiles or Tile-enabled devices have been for the last 30 days. That's a pretty long history and helps when you need to track down where an item's been.

With the Extended Warranty, users get another three years of warranty coverage. This covers any defects or other issues with how the Tile works with your smartphone app.

Unlimited Sharing lets users share their Tile with trusted friends and family members who can help you find your stuff. With Tile Premium, the number of people you share with has no limit.

First, you'll need to have a Tile Mate or Tile Pro. The Tile Mate starts at $25 for one, or you can buy a 4-pack for $70. Tile Pro starts at $35 per unit; you can get a 2-pack for $60, or go big with the 4-pack for $100.

Then you need to sign up for Tile Premium, which starts at $2.99 a month or $29.99 for a year. You'll end up saving some money by going for the annual subscription, but you'll need to commit to using your Tile trackers.

Not sure if it's for you yet? Luckily, there's also a free trial so you can test the service out and see if it works for you.

Once you sign up for Tile Premium, all of your Tiles and devices become part of the subscription. However, if someone who isn't a Premium subscriber is sharing a Tile with you, you won't be able to use Tile Premium specific features with this Tile, just the ones you specifically own.

Since Tile Premium is account-based, your subscription covers any existing and future Tiles. Just add a new Tile to your account, and the Premium-only features get applied.

Tile Premium is available for your iPhone or Android phone.

Of course! Tile does not require a Premium subscription to use their trackers. They work as standalone units, and users can access all of the core features without paying extra. Tile trackers work with the free Tile app, so you can see where they last were, and you're able to ring your Tile as long as it's within Bluetooth range. If you lose something, you can utilize the large Tile community to help locate the missing item.

There are a lot of great things Google has brought to the table over the years, including Search, Maps, and the Google Pixel smartphone (its cameras, anyway). Unfortunately, it's also an apex predator often accused of mining and collecting personal data in questionable ways.

A case in point is the GoogleSoftwareUpdate.app file that gets installed on Macs in the presence of Google apps such as Chrome and Google Earth.

First discovered by Wired a decade ago, the pesky file runs in the background and supports software patching and updating. Unfortunately, it also grabs your computer's hardware information, usage frequency, the number of active profiles on your computer, and more.

Recently, it's been rearing its ugly head again with the update to macOS Catalina. With the new Catalina security settings in place, updaters you may not have even known were there are being spotlighted, asking if you're OK with what they're doing. The first time you open Chrome on your Mac, you may see a notification asking if you want to run GoogleSoftwareUpdater.app, noting that Google installed it at a previous time. If you click "OK," you're back to what you've always been doing. If you click "Cancel," you have a new set of annoyances to deal with.

The folks over at E-Thinkers say what Google claims the file does is "harmless." However, because of how it's been designed, it "behaves like a malware."

What will you think if I'm telling you that there is a piece of software that:

• it installs in your computer without explicit asking for your permission, nor giving the options to decline it;
• it frequently sending data back to Google without your knowledge;
• it can't be configured via a settings menu;
• there is no uninstallation tool for you;
• and it will re-install by itself if you delete it."

I would agree, which is why removing GoogleSoftwareUpdate.app permanently might be the best course of action for most Mac users. However, because the tool's main objective is to automatically update Google software in the background, a better solution might be to change how often Google can check for those updates.

Warning: This guide is for expert-level users. If you don't have a comfortable understanding of Terminal, low-level systems, and security, stay away. Otherwise, as a responsible adult: proceed at your own risk.

Confirming GoogleSoftwareUpdate.app

Before attempting to delete or adjust the Google file, you should confirm its existence on your computer. Hint: If you have a Google product installed, it's almost certainly there somewhere!

E-Tinkers first published each of the following steps in January 2018. Apparent changes made by Google required an update released in July 2019.

To confirm GoogleSoftwareUpdate.app is installed, you'll need to bring up Terminal.

1. Selection Go on the Mac toolbar.
2. Choose Utilities.
3. Click Terminal.

4. Type of the following command syntax: defaults read com.google.Keystone.Agent.plist .
5. Hit Return. You should see a screen like the following; if you don't, the file isn't installed:

Adjusting how often GoogleSoftwareUpdate.app runs

In the screenshot above, note the checkInternal setting. This shows how often Google checks your computer for software updates in seconds. In the example above, Google checks every five hours (3,600 x 5 = 18,000 seconds) by default. You can adjust this time by changing it using Terminal. By changing how often the updater check for software updates, you can continue to use your Google apps, but only run it once in a while.

1. Selection Go on the Mac toolbar.
2. Choose Utilities.
3. Click Terminal.

4. Type of the following command syntax:defaults write com.google.Keystone.Agent checkInterval 604800 where the check now happens every 24 hours.

If you change the checkInternal to 0, Google's no longer sending data, which E-Tinkers rightly notes is sufficient for most users.

For those who don't like how Google uses the GoogleSoftwareUpdate.app on Mac, uninstalling might be the best option.

You can disable GoogleSoftwareUpdate.app by using the command syntax: sudo rm -R ~/Library/Google/GoogleSoftwareUpdate/. Unfortunately, with this solution, it will quickly return if you once again run a Google app on your Mac.

Because of this, you need to take different steps to uninstall the app. These steps will prevent Google apps from reinstalling the update again by creating a dummy file with the same name:

1. Selection Go on the Mac toolbar.
2. Choose Utilities.
3. Click Terminal.

4. Type of the following command syntax:sudo touch ~/Library/Google/GoogleSoftwareUpdatesudo chmod 444 ~/Library/Google/GoogleSoftwareUpdate

In July, E-Tinkers determined Google had changed a setting so GoogleSoftwareUpdate.app would install on the global level on a Mac if a user deleted it at the user level. Therefore, you should also run this command in Terminal:

sudo touch /Library/Google/GoogleSoftwareUpdate

sudo chmod 444 /Library/Google/GoogleSoftwareUpdate

To confirm the Google app is now removed from your computer:

1. Launch Google Chome.
2. Type chrome://help in the URL. You should see the following:

It's light's out for GoogleSoftwareUpdate.app on your computer!

What about updates?

If you want to update a Google app on your Mac after following the steps above, you'll need to delete it, then install it again from the Google website. You'll once again need to delete GoogleSoftwareUpdate.app after doing so, however.

Any questions?

Let us know if you have any questions about the steps offered in this post below.

If you start to notice weird advertisements popping up in strange places on popular websites like YouTube, you might be infected. These ads tend to feature adult content or claim that a virus has been detected on your device and will often appear in places that you don't normally see ads.

You may also discover that your personal email or social networking sites are sending out messages that you didn't write. If this happens, you should immediately change your password to stop any more messages being sent from your account.

If your Mac just isn't responding the way it should, you might have malware planted into your system somewhere. If it takes much longer for your Mac to wake up than it used to, there may be something lurking in the shadows.

You won't always know if you have a virus. Technology has improved for the bad guys just as much as it has improved for the good guys. There are viruses out there that are smart enough to know how to hide deep in your system and work constantly to keep you from noticing it, all while performing malicious attacks. And once you're infected, it super easy for other devices connected to your network to become infected, too.

While you may think you don't need antivirus protection on your Mac, it's more important than ever now that Apple has grown so popular. Even if you use a limited, free version of a program, you'll be doing yourself a favor.

The Mac operating system includes a number of security tools that help keep adware and malware off your computer, including default restrictions on opening apps from unidentified developers. If you stick to only downloading apps from the Mac App Store and are good about staying away from seedy websites, you can keep your computer secure from most virus issues.

In fact, Apple's security tools are why you'll hear many old-school Mac users say that you don't need anti-virus protection. The Mac is locked down well right out of the box.

However, there is more to protecting yourself than just avoiding bad apps and websites. You never know when you are going to pick something up that could create havoc on your Mac or on somebody else's PC. That's why, for added protection, you should think about getting antivirus software.

You don't have to be a celebrity to have your private photos and personal data hacked. Although the blame and fault of these hacks rest entirely on the criminals, each new case is a cold reminder that security in the digital world is just as urgent as that in the real world.

Whether you're storing data on Apple's iCloud, Google Accounts, Microsoft, Dropbox, or any other service, there are steps you can take to protect yourself from would-be hackers better. Here's how:

Don't use weak passwords

Everyone should know by now to avoid passwords like "password," "123456," your birthdate (or anyone's birthday), nickname, pet's name, child's name (or anyone's name). You also want to avoid any word or set of words in the dictionary and even common variations thereof, like d!ct!0n@ry.

Anything easy for you to remember is also easy for someone else to guess or "brute force."

Do use strong, pseudo-random passwords

The best passwords are blobs of pseudo-random letters, numbers, and symbols. The longer the series, the stronger the password. Most of us don't have to worry about nation-states or hackers with similar resources trying to get into our accounts. However, once you start using a password manager (see below), you might as well be as secure as possible.

Don't use the same password for more than one website

Let's say you set up your iCloud account with a strong password but use the same password to set up your account with home supply store. Then that home supply store gets hacked and, it turns out, they didn't bother to secure passwords properly. The hackers then start trying those passwords on other sites, including your iCloud account.

If your passwords are all different, one hack doesn't compromise all your accounts.

Do use a password manager to store and auto-fill unique passwords

It's impossible to remember even one long, secure password, let alone dozens of unique ones for every site you visit online. That's where a password manager like 1Password or Lastpass comes in. They'll generate the long, strong passwords for you, store them, and when you go to those sites, they'll automatically fill in the passwords for you.

They also support Touch ID and copy/paste, so they're easy to use.

• Best password manager apps for iPhone and iPad
• Best password manager apps for Mac

Don't use researchable security questions

Security questions are bad for security, and I wish companies would stop using them. If you're a public figure, Wikipedia can usually provide anyone with the answers to several common security questions. Even if you're not a public figure, Google can sometimes offer the same information. And if people get those answers, they can reset your password and try to get into your account.

So, avoid using security questions, regardless.

Do treat security questions like extra passwords

If a service insists on requiring security questions for password recovery or reset, don't use anything anyone else can research. Instead, treat security questions as extra password fields.

Generate long, strong blobs of pseudo-random characters and store them in your password manager. Then, if you ever need them, copy/paste them in.

Don't just use passwords

A password is a single factor. If that's all you use and someone somehow gets your password or security questions, they can get access to your account.

Add in a second factor, though, and the password only gets them halfway.

Do use 2-factor authentication

Most major online services, including iCloud, offer 2-factor authentication (2fa). Apple's version pops up a token code on your iPhone, iPad, or Mac, and you have to punch it in to get access. Other systems use apps like Google Authenticator, 1Password, or Authy to supply you with a token. (If the service only offers tokens over SMS, it's not as secure — contact them and ask them to provide proper 2-factor support.)

It's less convenient, but it's far more secure. And if the 2-factor token pops up when you're not trying to log in, you know someone else is trying to get into your account.

• How to set up two-factor authentication for iCloud
• How to set up two-factor authentication for Google
• How to set up two-factor authentication for Dropbox
• How to set up two-factor authentication for Facebook
• How to set up two-factor authentication for Twitter
• How to set up two-factor authentication for Tumblr
• How to make two-factor authentication easy with Authy

Don't click on links in emails

Phishing is when a hacker sends out volumes of fake emails saying there's a problem with your account, a special deal you can get, or anything else designed to entice you to click on a link. Spear phishing is similar, but targeted just at you and is often more personal and even more enticing.

The link is to a fake account page where they hope you'll type in your real password so they can get it. Never click a link in any email asking you to enter your login information anywhere.

How to identify and report Phishing

Do go to account sites directly

If you get an email from Apple, Google, Microsoft, Dropbox, or anyone stating there's a problem with your account, open your browser and type in the website address yourself — iCloud.com, Gmail.com, dropbox.com, etc. — and then use your password manager to log in.

If there is a problem, there should be a notification for that problem on the account page along with any real steps you need to follow.

Secure your home

Now that you've learned how to protect your personal information online, consider some of our favorite smart home security cameras:

Arlo Ultra 4K Wire Free Security Camera ($400 from Amazon)

The Arlo Ultra 4K is a security camera designed to provide ultra high resolution imagery during the day and night through 4K video and HDR support. An included LED spotlight shines when motion is detected ensuring that your recordings capture every detail, even when it is dark.

Wyze Cam Indoor Wireless Camera ($26 from Amazon)

The Wyze Cam Indoor Wireless Camera is a low-cost device that provides many of the same features that its higher-priced competitors offer. Even with its low cost, there are no additional subscriptions or fees involved, which means that the price that you pay is the only price involved.

Blink Indoor Home Security Camera ($80 from Amazon)

Blink's Security Camera is a truly wireless solution that runs on two AA batteries for up to two years. Free cloud storage makes this an economical choice for those looking for just the basics.

Any questions?

Having your data leaked is a horrible violation and should never happen to anyone. If you're storing sensitive information or content online, though, do everything you can to protect it.

Any questions or additional tips, drop them in the comments below!

Updated July 2019: We've reviewed the guidelines below and they're still the best practices to avoid having your personal photos and data leaked out onto the internet.

Even if you've never been the victim of a phishing attack, you've likely seen attempts — that email from "Apple" or "Google" asking you to "update your account information," or Nigerian princes looking for money to restore them to the throne.

But while those phishing lures may be fairly obvious, there are others that might be a little trickier to identify. Luckily, there are a lot of signs that you can look for in order to determine if someone is trying to illicitly obtain important credentials from you.

Here's how you might be able to identify a phishing attack, and how to report one.

What is phishing?

At its most basic, phishing is when someone attempts to gain information like passwords and credit card numbers by posing as someone you might trust. The attacker will often spoof a legitimate website, for instance, Apple's, and attempt to guide their target to that location in an attempt to access some sort of credentials.

While phishing attacks generally take place over email, attackers have also been known to use other methods such as instant messaging and phone calls.

How do I identify a phishing scam?

The most common type of phishing scam attempts to try and retrieve your passwords and usernames through social engineering. These attacks are often disguised as emails from major companies like Apple, Google, Facebook, or your bank; largely, it's because these companies have millions of customers and the chance of sending an email to someone who actually uses services from that website is very high. These emails will contain links to a spoofed website posing as the legitimate company's page, usually asking you to sign in or provide a security question.

There are a number of different things you can do that might help you identify if you're the target of a phishing attack.

Note that you should never rely solely on one of these techniques to identify a phishing scam; sophisticated attackers work hard to pass off their scams (and related websites) as legitimate, and spotting a scammer can be harder than it first appears.

The first piece of advice is also the least technical. If you feel at all suspicious about an email, don't click on it at all. Also reach out to the person or company who sent you the message (with an original message, don't reply to the one you just received) and ask them if they sent you something.

Posing as a legitimate company, an attacker will often ask you to do something like "verify your password" or "update your account information." Most companies, banks and other legitimate institutions won't solicit account details over email or SMS.

You should take a look at the email address from the sender of the message you received, which you can often do by clicking (or tapping) their display name (another thing to watch out for). If the email address is strange, or seems overly long for the company is question, don't trust that email. However, smart attackers will have included the company's name somewhere in the email address in an effort to appear more legitimate. It's important to pay attention to the legitimate emails that your bank, for instance, sends you, and what email address or addresses they use.

This also goes for the links they send you. Without clicking on the link, hover your mouse cursor over it or tap and hold the link on a mobile device to get more detail. If it doesn't look like a link from the company, it's probably not.

It's also worth checking out which email address a message has been sent to. For instance, I've often received emails "from Google," but they've been sent to my iCloud email address and not the backup email address that I've established with Google.

While many attackers are able to easily spoof the names of companies in their phishing attempts, less sophisticated attacks will get even these details wrong. Others will use names that might seem correct at first glance, but on closer inspection contain errors.

For example, a recent attempt I saw was sent by "AppleID Support". This name has a couple of red flags. For one, Apple spells it "Apple ID" with a space. Second, Apple's emails are often just sent from "Apple," with no particular branding like "Support".

As strange as it may sound to some, spelling and grammar can often give away a phishing attempt. Someone I know recently received an email with this phrase:

Things like this are a dead giveaway. In this case, the email was from "AppleID Support", and there are some pretty obvious mistakes in the grammar.

Be sure to pay attention to the style of email sent to you. Get a Google email whose colors or logo seem a little outdated? That might be a scam, for instance. Companies almost always have contact details or at least an address at the bottom of the email, while many phishing emails do not.

The Federal Trade Commission maintains a Scam Alerts site that warns consumers of the dangers of phishing attacks. The site offers news on new attacks, as well as general bulletins about online safety and avoiding scams.

• FTC Scam Alerts

The thing about avoiding phishing is that it's not about a single technique. Attacks can be extremely incompetent or highly sophisticated. It's important to be careful, and not place all of your trust in one solution.

How do I report phishing?

There are a number of resources that you can use to report phishing attempts, both to companies and to the government. Company's like Apple and Facebook often have email addresses specifically for forwarding phishing attempts, while Google has a button in Gmail that lets you do just that.

When using the following links, be sure to forward the phishing email that you're reporting:

• Report phishing to Apple
• Report phishing to Facebook
• Report phishing to the FTC
• Report phishing to US-CERT

I've been the victim of a phishing scam. What do I do?

Get in contact with the company whose credentials were phished, and see what they can do to help you. If an attacker got your credit card, be sure to cancel that card. As soon as you can, you'll also want to reset any passwords that you need to.

Questions?

If you want to know anything more about phishing, or even relay a phishing attack or attempt that has happened to you, be sure to sound off in the comments.

Updated January 2019: We've updated this piece with the latest information in light of the latest phishing scams.

Both security cameras provide a powerful, useful experience. It's the little things that distinguish one from the other and that'll make the difference for you.

The differences

When it comes to price, service plans, and storage, these products are surprisingly similar. Elsewhere, each has individual strengths (and weaknesses).

Neither choice is objectively better over the other. Both cameras are terrific in what they do. The Circle 2 looks like a camera and has an ultra-wide angle lens to prove it. Thanks to its built-in swivel, you can rotate and tilt the camera for the best 180-degree view. Logitech's product is also the one that offers two-way communication without charging a monthly membership fee.

Circle 2 is also the one easiest to customize. While it's primarily for indoor use, you can purchase a window or plug mount and also a weatherproof extension for outdoor use. That way, you can use it just about anywhere. The Canary All-In-One would get all wet, by contrast. The Logitech product is also available in a corded or wireless model and is the one with more integrations and voice control options.

Canary's flagship product, on the other hand, has better video quality (by default the Circle 2 records at 720p, not 1080p) and superior extra features. For example, the Canary offers a built-in emergency alarm you can activate remotely to alert the authorities to distress. Canary is also distinct for having the ability to monitor air quality, temperature, and humidity in your home and alert you when there's a problem.

You can add extra features to both cameras through premium memberships. Circle Safe is available in a basic and premium package. The former gives you 14 days of camera footage, person detection, and motion zones, while the latter includes 31 days of footage plus the other features. Logitech charges as little as $1.15 per month, depending on the number of cameras you own.

For Canary, there's one premium package that runs $10 per month or $100 per year. For this, you get 30 days worth of video recordings, two-way communication, a safety button to alert authorities in the event of an emergency, and incident support. Discounts per device are available when you have multiple cameras on an account.

So the choice here comes down to which features you want. If you plan on using your security camera to talk to others in your home, you might want to select the Circle 2 since this feature doesn't require the purchase of a premium package. Otherwise, there's not much different about either package except that Logitech offers two membership levels.

Comparing these two cameras largely comes down to purpose. If you want an extra set of eyes to make sure your pets haven't eaten the sofa or your children haven't overthrown the government, the Omna 180 will get the job done. However, if you want an actual security measure that can be positioned wherever you need it to protect, the Circle 2 runs rings around the competition.

One can see your living room, one can see everything

In some ways, these cameras are very similar. They have identical maximum video resolution and a frame rate at 1080p (the Circle 2 does have a lower resolution rate set as default, but this is easily altered in the app). Both cameras have built-in microphones and speakers for two-way communication. Both Logitech and D-Link have made a big deal about their 180-degree wide-angle lens, as many other models only have a range of 120 degrees. This means both cameras are able to cover most of a room or a large portion of a garden depending on where they are placed. However, this field of vision does come at the cost of some picture distortion in the center of the recordings. Another selling point they both want to cash in on is the lack of effort needed to set them up. Not including your preferred mount for the Circle 2, either camera can be activated using an app in minutes.

The Omna has minutely better infrared, claiming night vision up to 16 feet, against the Circle 2's oh-so-lowly 15 feet. The Circle 2's LED ring, which uses different colors to indicate different states of operation, can be turned off if required. The Omna displays a green light when active and two red lights when night vision is being used. These LEDs cannot be turned off, which could be a downside if you wished to disguise its presence from intruders.

Talking of intruders, let's discuss motion detection. Both have it, but it's a bit more interesting from the Circle 2's point of view. Its smart technology includes machine-learning Person Detection, customizable Smart Alerts, motion zones, and a Day Brief that gives you a time-lapse video of all motion detected. Unfortunately, most of its more impressive features are only available if you subscribe to the Circle Safe Premium package, which will also entitle you to 31 days of cloud storage instead of a mere 24 hours. If you use the free or basic subscriptions (basic increases 24 hours to 14 days), you'll still be well covered, but the Day Brief and Smart Alerts are simplified and less customizable.

Premium Subscription also allows you to use geofencing to stop notifications when you're at home, something the Omna is unable to match. Neither the Omna nor HomeKit support geofencing, which hinders you from creating some fun integrations such as only recording when you've left the house. Unfortunately, you cannot specify times for the Omna's motion detection to turn on aside from either always on or only on after sunset. Workarounds could be possible using additional devices, but not with the camera alone.

HomeKit, for example, can use motion detection to trigger other interactions like lights or smart plugs. It can also be modified for sensitivity, a re-trigger delay can be added, and motion zones can be specified. However, they can only be selected from a grid layout of the feed, whereas for the Circle 2, you can specify a custom shape and location for your motion zones to match the exact area you want to monitor. A few users have had issues connecting the Circle 2 to HomeKit, so if your setup is very reliant on HomeKit integrations, you may find the Omna suits your personal needs the best.

The Circle 2 has a few additional specs that the Omna doesn't offer, like digital zoom, 360-dgree camera rotation, operating temperatures of -20 - 50 degrees Fahrenheit, and a choice between a wired or wire-free model. Accessories available also mean the Circle 2 can be mounted on any wall, ceiling, window, metal surface, plug socket, or anywhere else you may need it. The operating temperatures and weatherproofing mean it can be used indoors or outdoors, and this versatility really gives it an edge over the not-at-all-weatherproof Omna.

The Omna does well sitting on a shelf observing a room, as long as no objects are too close to damage its field of vision. It's about as versatile as a paperweight, with a chunky size and design that make it hard to mistake for anything other than a camera. This could be thought of as a good deterrence until you consider how the recordings are stored.

The camera only records when it senses movement, taking 20-second clips paced between 30 seconds to 5 minutes based on your preferences. These are saved onto an SD card, and while you can view the clips in your app, you can't download the footage onto your device from the app alone. Some customers like the lack of cloud storage since it makes footage harder to hack, but if the device is damaged or stolen there's no way to recover the recordings.

The Circle 2's smaller shape and choice of mounts allow it to be located out of easy reach, and its cloud storage means even if it's damaged in a break-in, the footage is safe. Unlimited downloads and streaming are available with all Circle Safe subscriptions, and as mentioned earlier, the length of time your footage is stored will depend on your package. The Circle 2 uses SSL to protect your data. There's also a privacy mode that continues to live stream, but won't record or send any notifications. The minimalist and sleek design also makes it easy to blend to any background in style.

The Omna has come to this battle with a couple of major disadvantages. The lack of cloud storage takes away its usefulness as a security feature. If an intruder breaks or walks off with the camera, you might as well have had a ceramic vase in its place. The Circle 2 has your back even if it's taken out of action. The accessories and wire-free alternative give you so much freedom. Need one outside? There's a weatherproof extension cable. Does the top of your fridge offer a great vantage point? There's a magnetic mount too.

Of course, as with the other fun bits of its technology, these additional mounts come at an additional cost, which is the biggest drawback of the Circle 2. Buying the camera alone won't unlock its full capability. The promised customizable Smart Alerts are only yours if you pay for a monthly or annual Circle Safe Premium Subscription. This offers longer cloud storage, but it will set you back. For one camera it's $10 a month or $100 a year. If you've decided to attach cameras to all your windows, there's a Home Plan package for up to five cameras at $18 a month or $180 a year, so you'll be cutting the cost per camera.

Really, it is all about your personal needs. If you just want to watch what your pets get up to when you're not around, the D-Link Omna 180 is a great option. If you're willing to invest in a security measure that will give you eyes wherever you need them to be, the Circle 2 is the better choice by far.

If you're looking for a home security solution, you can't get much better than the Logitech Circle 2, thanks in part to some amazing features you get if you purchase a Premium subscription, including Person Detection. Person Detection does exactly what it says: it alerts you when it sees a human. Its machine learning algorithm is even able to tell the difference between a pet and a person, so you shouldn't get a pop-up every time your dog decides it's party time. This feature works best when the camera is not obscured, is upright, and placed at a human height and in an area with good lighting (it's unfortunately not as accurate when using Night Vision). Here's how to set it all up!

• Amazon Circle 2 Wired Camera ($150)
• App Store: Logi Circle App (Free)
• Logitech: Circle Safe Premium ($10+/mo)

How to enable Person Detection

In order to use this guide, you will need a Logitech Circle 2, the Logi Circle app and a subscription to Circle Safe Premium.

1. Open up the Logi Circle app.
2. Find and tap the settings menu in the top left-hand corner of the home screen.
3. If you have more than one camera, find the one you would like to update and tap and hold Event Alerts next to its name. Alternatively, you could select More Settings (also next to its name) and choose the Smart Alerts option.

4. If the Smart Alerts toggle is not enabled, you will need to enable it now.
5. Select Alert Filters.

6. Here you will see Motion Zones and Detection. You will need at least one Motion Zone to use Person Detection. These can be set via the web app.
7. Person Detection can be enabled under Detection.

Hurrah! You will now be informed if unidentified human beings are spotted in your Motion Zones. With this feature enabled, activity bubbles with a person icon and the time they were detected will appear in your Circle mobile and web apps.

Our top equipment picks

Person Detection will be slightly more effective with the wider field of vision and recording time. However, the wire-free camera is still an excellent choice for your security needs. Logitech even offer bundles like their combo pack of two wired and one wire-free model.

Logi Circle App (Free from the App Store)

Connecting to your circle is fast and simple

Logitech Circle Safe Premium ($10+ at Logitech)

Open up your Circle 2's potential with a premium subscription.

While both mounts are good options to have in your home security system, we prefer the flexibility of the Magnetic Mount. Plus, it can literally be attached anywhere on the house since it comes with a metal plate, so you aren't limited to just magnetic surfaces.

The breakdown

While the Window Mount allows you to see more of what's going on outside from the inside of your home, the view really depends on where your windows are placed. Since it sticks to the window itself, you're not going to be able to adjust the angle, unless there's another window that gives you a better view. If there isn't a good window to place it in, then the Window Mount is kind of useless for the situation. I mean, who wants to do work on the house just to get the right position for a camera?

Out of these two options, the Magnetic Mount is definitely the better choice. Even though it's magnetic, Logitech provides customers with a metal plate that attaches anywhere with super strong, semi-permanent adhesive, so it can go on any surface regardless. And if you already have a good spot on a magnetic surface (i.e. rain gutters, metal door frames or posts, even light fixtures), then just attach the magnetic base and put it where you want — it won't budge! Just push the camera around the base until you find the perfect viewing angle, and you're good to go with no unsightly mess.

However, you should be aware that if you decide to use the metal plate, you need to firmly decide where it'll go, since the plate is very difficult to remove with the strong adhesive. At the least, you know it won't be going anywhere.

Another big advantage with the Magnetic Mount is that if you opted for the Wire-Free version of the Circle 2, the Magnetic Mount doesn't need to be plugged in to use, allowing you to remain untethered. The Window Mount, on the other hand, needs that plug, which makes having a wire-free version of a camera kind of useless. The Magnetic Mount can also be used both indoors and outdoors, whereas the Window Mount is only for indoor use behind a window.