Kaspersky, the Russian security giant, recently found a large security hole in iOS — and promptly told Apple so that the firm could receive the bounty that large companies often get for finding vulnerabilities.

Apple, on the other hand, apparently has other ideas. Upon being told of the vulnerability, Apple has refused to pay the usually requisite bounty, leaving Kaspersky without the fee it usually passes on to charities.

• iPhone deals: Verizon | AT&T | Mint Mobile

No bounty?

Reported by Russian outlet RTVI, Kaspersky found “zero-day, zero-click vulnerabilities, transferred all the information to Apple, and did a useful job. Essentially, we reported a vulnerability to them, for which they must pay a bug bounty”. That bounty would normally be paid, according to Kaspersky, to charity.

The issue seems related to a previous Kaspersky find, which saw the security team publish a report on the “discovery of the ‘most sophisticated cyberattack’ on iOS, the purpose of which was to silently introduce spyware into the iPhone.” This was a security attack that could infect any iPhone. Users needn’t even click the contents of the related infected message they would be sent— merely getting the message into an inbox would infect a device, with an attachment opening itself and spreading the malicious code around the device.

According to Kaspersky, the attack is all about data gathering. “Collection of any information from devices: geolocation, cameras, microphones, files, contacts. In general, all the data that can be represented on the device. This was definitely not a financially motivated cyber attack.” It’s that last bit that’s so interesting — the attack isn’t interested in how you pay for things, only your information.

Currently, Kaspersky says that it found the security issue on staff iPhones, “both top management and middle managers.” While it seems like a targeted attack on one company, it’s still worth saying that being cautious remains key to your iPhone security.

Why isn’t Apple paying up?

As for the lack of bounty payment, that is anyone's best guess. 9to5 Mac points out that as a Russian company, Kaspersky could well be affected by sanctions on the country with the continuing war on Ukraine — although this is speculation on the part of the author.

Thanks to that lack of bounty payment Kaspersky says that it is now moving its focus away from iOS and towards the rival Android platform instead. “All employees of the company are now being issued corporate mobile devices on Android as planned, step by step. We left iOS not because it is less secure, but because we, as a security vendor, want to have more control over the security of devices” the firm explains — and really, can you blame it?

More from iMore

• Apple's new security bug bounty program: What you need to know
• Google is about to give iPhone owners a privacy and security headache
• Apple just fixed an iTunes security flaw for Windows users

Following the news that Apple sent alerts warning iPhone owners in 92 countries that they may have been the subject of a spyware attack, a report appears to point the finger at a specific piece of malware that has links to China.

Apple sent the warnings to people in 92 countries last week, saying that “Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple ID." The warning continued, saying that the "attack is likely targeting you specifically because of who you are or what you do. Although it’s never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning — please take it seriously." But Apple didn't get into specifics. Now, it seems that BlackBerry researchers may have some answers.

According to BlackBerry, the alerts may have been sent as a response to the resurgence of the LightSpy mobile malware software "which focuses on targets in Southern Asia and probably India, potentially indicating a renewed focus on political targets and tensions in the region."

China-linked

A BlackBerry blog post explains that the malware first popped up in 2020 and that it "possesses modules designed to exfiltrate device information and saved files, including data from popular messenger applications such as QQ, WeChat, and Telegram."

As for the source of the attacks, some familiar names pop up. "The threat actor group thought to be behind this LightSpy campaign reportedly had active servers in China, Singapore, and Russia," BlackBerry says.

It's important to remember that these kinds of malware attacks aren't random, however, and most people are unlikely to need to worry about them. But journalists, members of government, and public figures are potentially at risk and should take action should they receive one of the messages sent out last week.

More from iMore

• Malware threats against macOS surged over 1000%
• Apple blames malware, fraud, and scams for not allowing third-party app stores
• Apple has patched the Pegasus malware, but here's what you need to know

Using a VPN is a great way to keep your data private, bypass region locks, and more. And there is no shortage of iPhone VPN options for people to choose from. But one that people might already have is going away, and it might come as no surprise to you that the company ending its VPN service is none other than Google — the company that just can't stop ending support for services.

The service in this instance is the Google One VPN, one that Google only launched back in October 2020. The VPN feature was part of the wider Google ONe subscription and while prices originally started as high as $9.99 per month for the Gone Premium plan, just $1.99 per month is currently required to be able to use the VPN component. But that won't be the case for long.

Google has started to warn customers that it will start to discontinue the VPN functionality later this year. While those who own a Google Pixel Android phone will continue to enjoy VPN access as part of that device's list of features, everyone else who pays for Google One will lose out.

Nobody used it

The news was first shared by Android Authority with Google sending notifications that also detailed other changes, including the removal of free shipping on print orders via Google Photos.

"With a focus on providing the most in-demand features and benefits, we're discontinuing free shipping for select print orders from Google Photos (in Canada, the UK, US, and EU) starting on May 15 and VPN by Google One later this year," the alert reads. "As a Pixel user, you'll continue to enjoy being able to access VPN from Google through Pixel settings if you have Pixel 7 or newer models."

Google of course has a history of doing away with features and services that people seemed to really enjoy using. Google RSS is one example that many still refuse to forgive Google for taking away, but in this instance, it seems that the move might actually have merit.

According to 9to5Google, the reason that the One VPN feature is being removed is pretty simple — nobody ever actually used it. In a statement to the outlet Google reportedly said the company was “discontinuing the VPN feature as [it] found people simply weren’t using it.” As a result, the decision means that the team will be able to "refocus" and “support more in-demand features with Google One.”

Notably, Google announced that Google One reached the 100 million-user milestone earlier this year, so it begs the question of just how many people really were using the VPN feature for this decision to have been made.

Regardless, iPhone and Mac owners who now need to find a new VPN shouldn't have too many problems, the market is huge with some great alternatives. However, if you already pay for Google One each month and made use of the included VPN, you'll now need to look at finding an alternative and adding a subscription to your collection as a result.

While Apple doesn't offer a VPN itself, iCloud Private Relay can offer some of the same functionality. Part of the iCloud Plus subscription, the feature ensures that websites and services cannot see your actual IP address, reducing the chance for them to track you across the internet and between sessions.

More from iMore

• Should I leave my iPhone VPN connected all the time?
• The best VPN for iPhone and iPad in
• How to configure a VPN on iPhone or iPad

Your Apple ID is the key to your Apple identity, which is probably why that's what it's called. It's what you sign into all of your devices with and it's how you get access to your contacts, backups, photos and videos, and more. And losing access to it can be devastating. That's what makes a new wave of Apple ID scams so worrying, and there doesn't seem to be a way to prevent them from happening beyond staying vigilant and hoping that the scammers don't turn their attention to you.

The scam is a relatively simple one. According to reports, attackers bombard an iPhone owner with notification after notification by trying to reset the person's Apple ID password via the Apple website. That action triggers the message from Apple's servers and users are asked to allow or deny a password reset. If they press the Allow button, the attacker will be able to reset the password and potentially gain access to the Apple ID.

But it turns out that pressing Do Not Allow isn't enough to stay safe, either. If the user presses that button the second stage of the attack is initiated. And according to one person who suffered through this scenario, it'll be a pretty convincing one that some people may well fall foul of. Others will have accidentally pressed the Allow button before that happens, but for the lucky ones, the nightmare is just beginning.

Security watch

KrebsOnSecurity reports on one attack that befell Parth Patel, an entrepreneur working to build an AI startup. According to them, they received more than a hundred notifications requesting a password reset, seemingly in the hope that they would accidentally press the wrong button or just press Allow out of frustration.

“All of my devices started blowing up, my watch, laptop and phone,” Patel told KrebsOnSecurity. “It was like this system notification from Apple to approve [a reset of the account password], but I couldn’t do anything else with my phone. I had to go through and decline like 100-plus notifications.”

After declining the notification Patel then received a phone call from what appeared to be Apple. The attackers spoofed Apple's customer support phone number.

“I pick up the phone and I’m super suspicious,” Patel said. “So I ask them if they can verify some information about me, and after hearing some aggressive typing on his end he gives me all this information about me and it’s totally accurate.”

There was one anomaly, however.  The attacker gave Patel the wrong first name and that was enough to give the game away. But others may not be so lucky.

Those who do fall for the second half of the scam will receive a text message with a one-time passcode before being asked to hand it over. If they do, the attackers will have all they need to reset the Apple ID's password. From there, it's game over.

Another iPhone owner who experienced the same attack hung up the call and phoned Apple back to confirm it was legitimate. It wasn't, with Apple's support team confirming that employees will never call customers out of the blue — only when they've been asked to.

That appears to be the key here, although it doesn't help deal with the initial part of the attack that fills a person's iPhone with notifications. One user even said they received the alert on their Apple Watch overnight and could have accidentally tapped the Allow button — a mistake that could have had catastrophic consequences.

More from iMore

• How to change and manage your Apple ID
• How to reset your Apple ID password
• How to create an Apple ID for a family member

Cox Media Group Local Solutions -- a marketing company connected to one of the biggest telecom companies in the US -- claims it can listen to conversations through phones and other devices and was selling that information, iMore reported last week. Now Apple has contacted iMore to clarify that this would be in breach of its App Store guidelines.

As we said in our original report, Apple is known to take its privacy very seriously. But CMG didn't make clear how it gleams data and what from, other than nebulously stating it comes from 'smartphones, smart TVs, and other devices.'

An FAQ at the bottom of CMG Local Solution’s Blog (which was unceremoniously removed) stated that “our technology is on the cutting edge of voice data processing. We can identify buyers based on casual conversations in real-time. It may seem like black magic, but it's not -- it's AI. The growing ability to access microphone data on devices like smartphones and tablets enables our technology partner to aggregate and analyze voice data during pre-purchase conversations.”

In response to that claim, Apple noted its App Store Guidelines, which state "Apps must request explicit user consent and provide a clear visual and/or audible indication when recording, logging, or otherwise making a record of user activity." Data collected and stored must be made aware to the user, can be retracted at any time, and must be in line with current GDPR regulations.

Consideration – iMore’s take

Many iMore readers may not be aware of this but, in a life before writing here, I pursued a career in law and specifically studied the GDPR as part of the degree I proudly hang up in a wall back in my hometown. Something that is important to note is that, in a contract like that you sign with new apps, consideration is given on both sides to what you are getting from the interaction and what you are giving.

If you are not made aware of what you are signing specifically, it is not considered a valid contract, which is why Apple talks about "explicit user consent" in its guidelines. You can not sign away rights to something hidden in a contract that you were not made aware of. Apple confirmed to iMore that apps can't access your microphone or camera unless you let it, and clarified that an orange indicator displays when they are on, partially for this reason. You can technically give away your right to that information if made aware of that choice and if the data is handled responsibly so CMG could be reliant on people actively giving information made through recordings or videos to it. 

This is not to say that there aren’t legal ways to access information in other ways, especially that which you give it through search engines, smart speakers, and more. Siri itself does not tie your data to you and only uses information to improve the device. This also makes no mention of any other phone manufacturers, who will also have processes in place to stop activity like this. 

Apple also highlighted many of the privacy protections built into its iPhone with iOS, including permissions required for apps that want to track you, and its App Privacy report which shows how often your microphone, photos, camera, and contacts have been accessed over the last seven days. Apple also told iMore that any data processed or stored on servers is associated with a random identifier which means it can’t be traced back to you. 

CMG Local Solutions has made claims suggesting it either has a way around traditional processes in other phones or is potentially misleading clients as to how effective its marketing information is. CMG Local Solutions was pretty vague about how its data capture worked but it claims to work with partners like Amazon, Google, and Microsoft. This is not an indication of guilt from any of the named companies but we’re hoping the specific use of this data will be made clear further down the line. 

More from iMore

• iOS 17.2 has finally fixed one of the iPhone's biggest security issues
• Apple Releases New iOS 17.2 and iPadOS 17.2 updates
• tvOS 17.2 brings a much-requested feature to the Siri button

You can turn your Bluetooth on again! A few months ago, an engineer with a Flipper Zero showed off an exploit that could potentially lock down iPhones and Apple has finally put out a fix with iOS 17.2. 

As originally reported by ZDNET, you can no longer cause iPhones to crash by spamming Bluetooth notifications, though the first few pop-ups will still occur – moving a major exploit to a minor annoyance. This exploit wasn’t technically exclusive to the relatively niche multi-tool, as originally confirmed to iMore by Flipper itself. 'It’s important to highlight this is impossible on the default hardware. We have taken necessary precautions to ensure the device can’t be used for nefarious purposes. Since the firmware is open source, individuals can adjust it and use the device in an unintended way, but we don’t promote this and condone the practice if the goal is to act maliciously.

Potentially, one could repurpose an Android phone with custom firmware or any Arduino-like device with BLE capabilities to do the same. This is why we agree with the researcher that Apple should implement safeguards and eliminate the problem at its core.’

Keeping to its word – iMore’s take

Apple claims to take the security and privacy of its devices seriously and steps like these are important to back that up. We at iMore have known about this issue since the start of September, setting the rollout for this change at about three months. This is still a significant period of time and we have seen a major iOS rollout with iOS 17 and two smaller ones since then but a definitive fix like this is important and it’s good to see it addressed. 

iOS 17.3 seems set to follow this same vein with a security feature to stop thieves who have stolen your phone. It’s been a long time coming, but it’s great to see them rolling out on Apple devices. 

More from iMore

• iOS 17: Latest Version, features, supported devices, and more
• 20 iOS 17 tips and tricks: the ultimate iPhone cheat sheet
• iOS 17 review: Top 10 features ranked

Have you ever had a conversation with someone about an item only to have eerily familiar adverts come up on your iPhone or Android afterward? If so, one marketing agency has been bragging about its ability to sell this kind of data to other companies, but its blog advertising the feature has mysteriously gone dark. 

As originally pointed out by 404 Media, CMG (Cox Media Group) Local Solutions calls it Active Listening and specifically references conversations like “Do I see mold on the ceiling?” or “We need a better mortgage rate” as the data it would sell to other companies. On the original page, 404 found the following paragraph:

“What would it mean for your business if you could target potential clients who are actively discussing their need for your services in their day-to-day conversations? No, it's not a Black Mirror episode—it's Voice Data, and CMG has the capabilities to use it to your business advantage.”

Our Investigation

The page cited by 404 has been taken down by CMG, however, investigations by iMore confirm the group indeed published a blog post on November 28 titled "Active Listening: An Overview." That page states, in no uncertain terms, "Active Listening gives organizations clarity into the most effective channels and timing for their advertising efforts. By incorporating and analyzing customer data gleaned from conversations happening around smart devices, we can pinpoint where and when customers are most likely to engage with ads."

In the FAQ at the bottom of the page, it says “Our technology is on the cutting edge of voice data processing. We can identify buyers based on casual conversations in real-time. It may seem like black magic, but it's not-it's AI. The growing ability to access microphone data on devices like smartphones and tablets enables our technology partner to aggregate and analyze voice data during pre-purchase conversations.”

[Bold emphasis added by iMore]

To paraphrase Jordan Belfort, is this all legal? CMG's post again says "yes", and claims that "When a new app download or update prompts consumers with a multi-page terms of use agreement somewhere in the fine print, Active Listening is often included," meaning that users might actually be agreeing to this practice, if CMG is to be believed. As 404 originally reported, "Cox Media Group (CMG) claims it has the capability to listen to ambient conversations of consumers through embedded microphones" not only in smartphones but also smart TVs "and other devices to gather data and use it to target ads," suggesting that this isn't even a problem confined to our mobile devices. 

Cox Media Group is an American agency that runs its own advertising company, as well as tens of local TV and Radio stations. Its parent company, Apollo Global Management, is a private equity firm with hundreds of billions in assets. If properly introduced to the marketing market, Active Listening could represent a real privacy breach, something that Apple prides itself on. CMG Local Solutions has been involved in 200,000 + digital marketing campaigns since its inception and cites partners and publishers in the field such as Amazon, Google, Microsoft, and more. As of right now, we are unsure to what degree CMG Local Solutions has used Active Listening but 404 reports "the company notes it is 'a marketing technique fit for the future. Available today'" and states it found a company representative on LinkedIn "explicitly asking interested parties to contact them about the product."

I personally don’t like the idea of my devices listening to me and especially don’t like the idea of that information being used to sell me more things. It’s hard to believe that many of the users of modern smartphones are aware of, or consent to, this kind of information being used, aside from what CMG lists in its FAQ about user agreements. As the CMG Local Solutions site references its use of AI to do this, there is a chance it works like smart assistants – processing data without storing it. This means that your device can display adverts based on something you’ve said today but may not use that to form a wider dataset on your gender, age, hobbies, and more. Apple prides itself on taking user privacy very seriously, and touts privacy as one of the defining features of using its products, something Active Listening, if it's being used on iPhones, could seriously undermine. 

As these pages have been taken down, CMG Local Solutions likely recognizes how unpopular this kind of tech is. Hopefully, this will deter it from further exploring Active Listening. There is a possibility CMG published the article in error or has taken the page down to revise it, and the company wasn't immediately available to comment on the story. We'll update this story accordingly with more information should that change. 

More from iMore

• iPhone 15: models, specs, price, and release date news
• iPhone 15 Pro: Everything you need to know
• iPhone 15 Pro review: One week with the iPhone you should buy

If you, or someone you know, has ever had your iPhone stolen, a brand new feature planned for the release of iOS 17.3 should help soften that blow. Even thieves who have your unique passcode won’t be able to access some of your most personal information. 

In a comment made to The Verge, Apple spokesperson Scott Radcliffe said, “iPhone data encryption has long led the industry, and a thief can’t access data on a stolen iPhone without knowing the user’s passcode. In the rare cases where a thief can observe the user entering the passcode and then steal the device, Stolen Device Protection adds a sophisticated new layer of protection.”

With this, your iPhone needs authentication through Face ID or Touch ID to check finances, get access to iCloud accounts, and, most importantly, use Apple Pay. For things like changing your Apple ID password or turning off Find My, you need to authenticate via Face ID or Touch ID twice, one hour apart. You do have to opt into this feature, but it will be available to all iPhone users when iOS 17.3 launches (expected 2024).

A needed change – iMore’s take

This is a great feature that I’m surprised doesn’t already exist. Devices being locked to an Apple ID and tied to Find My is a good deterrent for possible thieves, but there are ways around it for those who are smart enough, especially if they are able to get your passcode before taking your device. This has been one of the biggest workarounds of iPhone’s security features until now, and it’s good to know it won’t be enough to steal and sell on your device in the future. 

However, there are still security flaws we know about right now in Apple devices. Just last week, a flaw was spotted that could spoof a Magic Keyboard on MacBooks, enabling a hacker to mimic keystrokes and steal information. Earlier this year, a report showed that someone with a Flipper Zero could spoof an AirPods ping to annoy or even lock down a phone. Neither of these have been addressed as of the time of writing. Hopefully, iOS 17.3 will go even further in regards to iPhone security. 

More from iMore

• Long-awaited Apple Music feature returns in iOS 17.3 beta 1, but will ...
• iOS 17.2's biggest change is an iPhone 15 Pro telephoto camera ...
• How to downgrade from iOS 17 back to iOS 16

If you have an Apple device and tend to have your Bluetooth on in public, there’s a chance someone could use it to exploit your device. Despite laying dormant for years, a Bluetooth security flaw has just been spotted and according to the Android Security Bulletin, it is a ‘critical security vulnerability.’

As originally spotted by Marc Newlin from Sky Safe, any user who connects a Magic Keyboard to their MacBook can be vulnerable. A person running Linux can register their device to it, effectively causing keystroke-injection vulnerabilities – mimicking keystrokes by the legitimate user. This can be used to steal information, run commands on the device, and more. These vulnerabilities were disclosed to Apple on August 1st this year, followed by a public disclosure on December 6th. 

A Bluetooth problem – iMore’s take

This is not the first time a major security fault has been spotted that accesses Bluetooth in some way. Back in September, a tech enthusiast discovered you could falsely ping iPhones with an AirPods notification with nothing but a Flipper Zero hacking tool. It did have to be very close to the device it was pinging, but it was theorized the distance could be much greater with the right tech. Turning off Bluetooth through Control Center wouldn’t fix this, and users had to turn it off in Settings. It is important to note that any device with Bluetooth capabilities could do the same, so this security fault lies in Apple's hands to fix. 

Bluetooth is a great bit of tech that has had some severe problems like the two examples above due to how easy it is to connect, and this vulnerability is just one of many. Despite being informed of this four months ago, Apple has not commented or changed anything publicly yet. A security patch for devices running Android 11 and onward has been issued, and future devices will contain the fix automatically, but devices running before Android 11 will be left vulnerable. Hopefully, Apple will fix this problem, too. 

iMore has reached out to Apple for comment. 

More from iMore

• Bring new life to your aging tech with this $10 Aukey Bluetooth ...
• iPhone not connecting to Bluetooth? Here's how to fix!
• Tips and tricks for getting Bluetooth to work on your iPhone, iPad ...

Back in September, an iPhone user reported a security issue that could render an iPhone unusable with nothing but a Flipper Zero multitool and some creativity. Now, months later, Apple has still not addressed this issue in any fashion, sparking concerns.  

Essentially, someone with the technical know-how could use the Flipper Zero to ping the AirPods Bluetooth connect symbol on the screen consistently to lock down a device. At the time, this was likened to a DDOS attack, which constantly pings an internet service with requests, taking it down. As 9to5Mac has pointed out, the iOS 17.2 beta does nothing to rectify this.

As of right now, the device needs to be quite close to the iPhone, and turning off Bluetooth entirely can stop it but this flaw could be exploited by users who know how to do worse. To protect yourself fully, you must turn off Bluetooth from settings – doing so from the Control Center doesn’t work. 

An Apple Problem - iMore’s Take

Back when this originally surfaced, a representative of Flipper Zero spoke to iMore, claiming:

'It’s important to highlight this is impossible on the default hardware. We have taken necessary precautions to ensure the device can’t be used for nefarious purposes. Since the firmware is open source, individuals can adjust it and use the device in an unintended way, but we don’t promote this and condone the practice if the goal is to act maliciously.

Potentially, one could repurpose an Android phone with custom firmware or any Arduino-like device with BLE capabilities to do the same. This is why we agree with the researcher that Apple should implement safeguards and eliminate the problem at its core.

The Flipper Zero is not the only device capable of spoofing a Bluetooth notification, so it's a problem Apple will have to fix internally to eliminate the threat for good. Perhaps a solution such as disabling Bluetooth after a handful of pings in a row or only allowing trusted devices to ping multiple times could be a software-based fix in a future version of iOS. 

Apple didn’t respond to a request for comment when the issue was first raised in September. 

More from iMore

• Every security camera with HomeKit Secure Video support in ...
• Apple's new security bug bounty program: What you need to know ...
• Arlo Pro 3 Wire-Free Security Camera System Review: Pay-per-view ...

Passwords are important. Strong passwords are even more important, as is using unique passwords, and above all, keeping them private is a pretty good idea as well. To make all of that easier, I've long recommended that people use a good password manager. I still do. But my thoughts on which password manager people should use have just changed. And not in the way that I expected.

See, I've been using 1Password for a long time now. I can't remember exactly when I started, but it was back in the days of buying it and syncing vaults using Dropbox. There was no built-in syncing and no subscription pricing, not that I mind the latter. The former is a necessity for anyone using multiple devices, but it's table stakes at this point.

Over the years I've used 1Password because of the cool apps, easy syncing, and above all, shared vaults. Being able to have a vault that has all of the family's passwords in is a lifesaver, especially when one of the kids needs the Netflix password or gets logged out of Disney Plus. Shared vaults were enough to keep me using 1Password and I basically ignored iCloud Keychain as a result. Sure it's free, and yes, it's built right into everything I use on the daily. But there's no way to have one password easily accessible to multiple people at all times.

Or at least, there wasn't. And now that there is, I figured it was time I take another look at Apple's password management system and potentially save a few dollars every month. And I liked what I saw.

Free as in beer

The obvious thing that iCloud Keychain has going for it is that it's free, which means that just by having the minimum features — so long as they actually work — it's going to be a winner for a lot of people. I could myself in that because while I'm more than happy to pay for software that makes my life easier or better, I'd rather use a free one so long as it does the same job as well or even better. It's with that mindset that I took a deeper look at what iCloud Keychain has to offer.

In use, it's almost identical to using 1Password which is a testament to Apple's APIs. The fact that third-party password managers function in the same way as iOS 17's built-in manager shows that Apple isn't blocking developers from competing here. The experience isn't going to be impacted by Apple.

So if entering a password when asked for it by a website or app is basically the same, it's time to look beyond that — how iCloud Keychain works.

In the case of sharing passwords, it's great. You create a shared group and tell the system who to send an invitation to and you're off to the races. It couldn't be easier, so long as they're using Apple devices of course. My family uses iPhones and iPads, so there were no issues there and anything I add to the shared group instantly appears on their devices. It's like magic, but better — it's free magic!

Beyond the shared vault situation, there was one smaller thing that kept me with 1Password — the lack of an actual iCloud Keychain app. That still irks me and I can't understand why one doesn't exist. But there are ways around that. There's a shortcut that can be used to instantly access the portion of the Settings app that currently holds all of our passwords, and it works. Add that to your Home screen and you can almost convince yourself it's an app. It's fine, but I still want a proper app in iOS 18.

Decision time

So with all of that said, I sit here with my 1Password subscription canceled and iCloud Keychain doing its thing. It manages my usernames and passwords and even hosts my one-time passcodes as well, so multi-factor authentication is taken care of.

Now yes, I know some people store much more than passwords in 1Password so for those people this might not work — although locked items in Notes might fit some of your needs, and credit/debit cards can be saved in Safari, too. But if you're just storing passwords and want to save some cash, iCloud Keychain is finally a viable option for me. I reckon it could be for you, too.

Owners of Apple's iPhones take it for granted that they will receive important security updates as and when they are required, but that might not be the case in the UK for much longer.

Proposed changes to the U.K.'s Investigatory Powers Act 2016 (IPA) could see Apple prevented from releasing certain security updates because they will interfere with the government's surveillance, it's reported.

The U.K. government can already interfere with apps and services, demanding the “removal by a relevant operator of electronic protection” of security features like end-to-end encryption. But the revisions to the IPA could go a step further.

No more security updates for you

Just Security reports that the new IPA revisions could have major implications for Apple and the millions of U.K. residents who use iPhones and other devices carrying that famous logo.

"Objective 4 of the proposed changes adds another layer to the current regulatory landscape by including an obligation for companies to notify the government before introducing any technical changes to their systems," the report says, adding that "while the proposal does not specify what technical changes would require notification, these may include changes in the architecture of software that would interfere with the U.K.’s current surveillance powers.

The upshot? Apple would have to tell the government if it wants to roll out a security fix and then face the possibility that it would be prevented from rolling it out if the fix blocks a vulnerability that U.K. law enforcement is using. "Device manufacturers would likely also have to notify the government before making available important security updates that fix known vulnerabilities and keep devices secure," the report explains. "Accordingly, the Secretary of State, upon receiving such an advance notice, could now request operators to, for instance, abstain from patching security gaps to allow the government to maintain access for surveillance purposes."

That's no doubt something that Apple would push back on but would likely have no choice over. The best iPhone is a private and secure one, of that there's no doubt. But Apple may find itself hamstrung by new U.K. rules regardless.

While it's true that when it comes to malware, Windows is a much bigger target for attackers than macOS, there are still plenty of bad actors out there. And now a dangerous old malware tool has started to make a return.

XLoader is a malware tool that has been around for a couple of years and is now becoming prominent thanks to the way it's making a comeback — not only is it masquerading as a piece of Microsoft productivity software aimed at businesses, but also carries an Apple developer signature.

That of course makes the app appear genuine, although there are plenty of things that give it away if you know where to look.

Security matters

The reappearance of XLoader was first picked up by SentinelOne, with the blog noting that, unlike previous iterations that targeted the Java Runtime Environment, this new one is a different animal.

"XLoader has returned in a new form and without the dependencies," the blog notes. "Written natively in the C and Objective C programming languages and signed with an Apple developer signature, XLoader is now masquerading as an office productivity app called ‘OfficeNote’."

The whole thing has an appearance of legitimacy, but there are signs that something is afoot. For starters, the malware is delivered in an Apple disk image called OfficeNote.dmg, which should be enough to raise the alarm. Another issue is the Apple developer signature by the name of MAIT JAKHU (54YDV8NU9C).

Thankfully, Apple has now revoked that signature but XProtect, the Mac's malware-blocking tool, wasn't preventing the app from launching at the time of writing — so if you don't notice something's amiss, macOS will launch it.

Once that happens XLoader will start watching Chrome and Firefox web browsers and start collecting data from them. Safari isn't targeted which is another reason to give it a try if you haven't of late.

The new iteration of XLoader is definitely going after business users so this is one for I.T. departments to be aware of. But it's another reminder that malware does exist on the Mac, no matter how much Apple's promotional materials might like to make it appear otherwise.

Apple takes the security of its phones, computers, and tablets seriously, but one researcher says that there's one known flaw that it hasn't yet gotten around to fixing.

That security flaw affects Macs around the globe and relates to vulnerabilities in Apple's macOS Background Task Management system, a feature that is supposed to warn people if an app tries to become persistent, ensuring that it can run without the user's knowledge.

However, one researcher says that while the Background Task Management system is well-intentioned, "the implementation was done so poorly that any malware that’s somewhat sophisticated can trivially bypass the monitoring,” Apple would no doubt agree that the best Mac is a secure one, making this claim particularly worrisome.

Deeper issues left unfixed

Wired reports that security researcher Patrick Wardle shared details about his findings at the Defcon hacker conference in Las Vegas. In fact, Wardle didn't just find one issue. There were a few.

"When Background Task Manager first debuted, Wardle discovered some more basic issues with the tool that caused persistence event notifications to fail," Wired reports. "He reported them to Apple, and the company fixed the error. But the company didn't identify deeper issues with the tool."

Wardle went on to say that Apple "didn't realize that the feature needed a lot of work.” As a result, there are still some problems for it to deal with — including ways for apps to disable persistence notifications generated by Background Task Manager without the need for elevated privileges.

"One of these exploits takes advantage of a bug in how the alerting system communicates with the core of a computer's operating system known as the kernel," Wired explains. "The other capitalizes on a capability that allows users, even those without deep system privileges, to put processes to sleep. Wardle found that this capability can be manipulated to disrupt persistence notifications before they can get to the user."

Wardle says that the only reason that these bugs have been shared at Defcon is that it already told Apple about the flaws, but they haven't been fixed yet.

It isn't clear if the upcoming macOS Sonoma update will address the security issues Wardle mentions, however.

The number of cyber criminals operating on the Dark Web who are focusing on macOS has surged significantly, according to findings from Accenture's Cyber Threat Intelligence (ACTI) unit.

Accenture's data suggests that there's been a huge tenfold increase in cyber attacks targeting some of the best Mac computers since 2019, with the majority of the incidents taking place over the past 18 months. 

While Accenture acknowledges that threats have been mostly directed at Windows and Linux devices in the past, it's now naive to think that Mac users are safe. The ACTI team say they've seen a vast Dark Web community of skilled cyber attackers who have set their sights specifically on Macs.

As part of Accenture's report, the company highlighted some of these Mac specific threats, including well-known threat actors creating specific ransomware strains to target Macs, as well as exploits for Macs that are being sold at a premium over those that are made to target Windows PCs.

Why the sudden interest in Macs? The Accenture analysts share their suggestions, but the short answer is: they're everywhere now.

"A combination of the increasing use of macOS in corporate environments, the high potential earnings of threat actors willing and able to target macOS and the surging demand for macOS tools and wares suggest this trend will continue," the report suggests.

Use protection

Rather than feel worried about the possible incoming threats to your Mac, use that fear and energy to take action. We have a guide to the best antivirus software for Mac filled with suggestions that'll keep your computer safe from unwanted attacks and infected files. 

Our current top pick is Bitdefender Antivirus for Mac. The company claims it's able to stop 99% of threats without slowing down your machine's performance. It also comes with multiple licenses to use across devices. In short, there's a lot to like about this Mac antivirus software. 

While you're beefing up your Mac's security, do take a look at our how to check for Mac viruses guide to ensure your system is as safe as it can be.

Apple's 'The Underdogs' ads have proven popular since their COVID-era debut and they continue to be at the center of some of Apple's best work. The latest ad is all about Macs and how their security can help foil thieves.

These ads all follow a group of people who are starting their own business and using Apple devices and services to do it. In this instance, they're using iPhones and Macs to prepare for a big funding meeting only for a MacBook containing the proposal to be stolen. What results is a crazy manhunt to try and find the people that stole it — all the while teaching viewers about the security Macs employ these days.

The full ad runs for more than eight minutes and is more of a short story than an advertisement. And it's well worth your time, if only to laugh at the hapless thieves throughout.

Find My and more

The ad shows people using Find My a bunch of times, first to locate the stolen MacBook and then to locate a missing coworker, but that's just the start. In fact, Apple's credits list all of the features that were used in the ad and it's a long one that includes:

• Touch ID and Face ID
• Find My
• Passwords and Passkeys
• Safari fraudulent website warning
• End-to-end encryption
• Notify when left behind
• MDM remote lock
• MDM remote wipe
• Secure enclave
• Family sharing

Other Apple apps and services are used throughout including Messages, Apple Maps, Apple Card, FaceTime, and more. Check the ad out for yourself and you'll see just how packed it really is.

The list of Apple security features is a long one these days and Macs are more secure than ever. But that's only made possible by the way Apple's other services and devices tie into an overarching ecosystem that, while sometimes limiting for power users, is undoubtedly the star of the show here.

Using an old Mac and looking to upgrade? The 15-inch MacBook Air is arguably the best Mac for a whole ton of people right now.

Apple released iOS 16.5.1 and iPadOS 16.5.1 to the public yesterday and while it did include bug fixes, it seems that there were some much more important improvements going on under the hood elsewhere, too.

Both iOS 16.5.1 and iPadOS 16.5.1 have their own security fixes that make them well worth downloading as soon as possible, but those with older devices should also update to the latest software as well — iOS 15.7.7 and iPadOS 15.7.7.

According to a Washington Post report, Apple's latest iPhone and iPad software updates fix two security flaws that had been used to hack devices in Russia. It took Russian antivirus outfit Kaspersky Lab to spot the issue and make an announcement three weeks ago, with the company saying that its own employees were impacted. 

Security matters

"At the same time as Kaspersky’s initial announcement, Russia’s Federal Security Service, known as the FSB, accused the National Security Agency of being responsible. It did not provide evidence or explain how it reached that conclusion," the Washington Post reports.

As for how the attack worked, it seems that it was as simple as sending a malicious attachment via iMessage. The recipient never actually needed to read the message for the payload to take over, it seems. "Without ever seeing that message, the phone’s user would be infected and the attacker could run code of their choosing," the report adds before noting that restarting the iPhone undid the hack, as did enabling Apple's Lockdown Mode.

Kaspersky says that the attack was capable of issuing 24 commands including extracting passwords from iCloud Keychain as well as monitoring location data.

Security release notes for iOS 16.5.1 and iPadOS 16.5.1 both reference fixes for the same Kaspersky-spotted security flaws as the notes for iOS 15.7.7 and iPadOS 15.7.7.

As always, we'd suggest updating to the latest versions of iOS and iPadOS whenever possible.

Apple is of course hard at work on its next big software releases in the shape of iOS 17 and iPadOS 17, both of which are in developer beta and are expected to ship this fall.

Logging into Apple's website is about to get a whole lot easier, so long as you're using the latest beta software.

That's because Apple's website now supports logging into your Apple ID using passkeys for the first time, doing away with the need to use a password that you probably can't remember.

Passkeys are the industry's answer to the password problem — people use poor passwords or reuse the same one across devices. Passkeys get around that by removing the password from the equation entirely, and they're coming to Apple's upcoming software updates including iOS 17, iPadOS 17, and macOS Sonoma.

Beta up

All of those software updates automatically assign a new passkey to your Apple ID which means that it can then be used to sign into iCloud and Apple's other websites, 9to5Mac notes. That does mean that you'll need to be using one of those software releases to sign in right now, however, with Touch ID or Face ID your new method of authentication.

With passkeys, users can sign into their accounts without having to enter the usual username and password combination that we're all so familiar with. Passkeys have the potential to make the internet a safer place for many, and 1Password has already announced support for storing passkeys in its Vaults.

While Apple's latest software is now available in beta, none of those updates will be available for the public to download until later this year. If everything follows the usual schedule we expect iOS 17 and iPadOS 17 to be ready in September, while macOS Sonoma might have to wait until October time.

Apple announced the software updates at WWDC on June 5 alongside the 15-inch MacBook Air, new M2 Mac Studio, Apple silicon Mac Pro, and of course the Vision Pro headset.

It’s more important than ever to keep your devices safe and sound. Apple’s products are known for their rock-solid security, but that doesn’t mean they’re invulnerable – all it takes is one silly mistake to get infected. But what’s the best way to ensure everything remains free from malware and privacy invasions?

Well, we recently spoke to password manager company 1Password, and they offered up some advice on how to keep your Mac, iPhone and iPad safe. Here are their top tips.

Secure your passwords

Given that 1Password is a password manager, it’s probably unsurprising that the first tip from Chief Product Officer Steve Won is how to strengthen them. “Always use strong, unique passwords – never reuse passwords,” he contends. The reason being if one account gets compromised and falls into the hands of a hacker, they won’t be able to use those details on any other account. In other words, your other logins are still safe.

As well as that, Won explains that “your password should be complex and randomly-generated. The longer and more complicated the password, it becomes logarithmically harder to crack. Using a password generator to create something unique for each site can make this simple to do.”

Even better, use a passkey instead of a password to secure your accounts. A passkey uses your unique biometric data – like a fingerprint – instead of a password, making them far more secure. Without that data, there is no password to leak or be phished.

Also, it’s a good idea to delete your old and unused accounts online. This one is simple: fewer accounts mean fewer places your data and passwords can leak from. If you’re not using an account, log onto the account’s website and delete it.

Multi-factor authentication

Don’t want to just rely on passwords? Use multi-factor authentication (MFA) on both your personal and work devices. You’ve probably come across this before: you log into a website and are sent an SMS message with a one-time code that you need to enter on the site to prove you are the account holder. That’s MFA.

Won recommends using an authenticator app or, if possible, a hardware token when using MFA. The latter is a small device that is used to authenticate your login, meaning whoever is trying to log in must physically possess the token. That makes it extremely difficult for bad actors to steal your MFA codes over the internet.

Even if you have to use text or email MFA authentication, you should do it, says Won, as “it raises the threshold for attackers.” This type of MFA can fall victim to so-called SIM swapping attacks, where hackers get the authentication code rerouted to a device they control. Still, using this kind of MFA is still more secure than not using it at all.

Disk encryption

The next security tip from 1Password is an easy one for Apple fans because it’s already there at your fingertips: disk encryption.

As long as you’ve set a password on your iOS or iPadOS device, its contents are automatically encrypted using a feature called Data Protection. Intel-based Macs use FileVault to protect the contents of the boot drive (although you’ll need to manually enable it). Apple silicon Macs, meanwhile, use a hybrid approach that sits somewhere between Data Protection and FileVault.

That means that whatever Apple device you’re using, your files can be safely encrypted to keep them out of the hands of hackers, phishers and other threat actors.

You can also enable Advanced Data Protection on iOS and macOS, which brings end-to-end encryption to your iCloud backups. When it’s disabled, Apple holds your decryption keys, which theoretically could be leaked if Apple got hacked. With end-to-end encryption enabled for your iCloud backups, only you can access those keys.

Freeze your credit

What else? Well, 1Password suggests that American readers could freeze their credit history. While this might sound drastic, it prevents your sensitive data from being accessed without your consent, and won’t hurt your credit rating.

Why would you do this? Won explains: “Chances are, between breaches from telecom providers, banks, credit bureaus, or even the federal government, your personally identifiable information is already out there.” By freezing your credit history, no one can open a fraudulent credit line using your stolen data. That protects you from having your credit score impacted by scammers on a spending spree.

It's free to do at Equifax, TransUnion, and Experian, and Won notes that “it’s easy to unthaw on a temporary basis for your next car purchase or rental application.”

What else can you do?

There are a few other things that could help you stay safe. Use Face ID or Touch ID wherever you can and always keep your operating system and apps up to date. Download an app like Truecaller or Hiya to block spam calls automatically. And use an app such as Little Snitch to find out if your device is communicating with servers that it shouldn’t (potentially a sign that it’s infected).

There’s some debate over whether you should use an antivirus app on Apple devices, given their existing security. But antivirus apps can provide some extra defense if Apple’s own measures like Gatekeeper don’t do the trick. A good VPN app can also help by keeping your web traffic private.

You can avoid becoming a victim by taking a cautious approach online and over the phone. Don’t visit disreputable websites and bookmark those you read regularly so you know you’re on the right one and not a nefarious imitator. Don’t hand over your passwords to someone calling or emailing claiming to be from your bank. And remove any unknown devices from your iCloud settings page immediately.

Put all these tips into action and you will go a long way to protecting your Apple devices and keeping them safe from malware. Most are easy to do, and you might have already enabled some on your own. They could be what saves the day when hackers come knocking.

Apple released iOS 16.5 last week with security fixes that resolve vulnerabilities in the operating system we use daily on our iPhones. But it looks like one of those security fixes is a follow-up to a previously addressed vulnerability back in 2022.

The ColdInvite vulnerability, CVE-2023-27930, according to a report by Jamf “can be exploited to leverage the co-processor in order to obtain read/write privileges to the kernel”

That means that someone malicious enough could've gained control of your iOS device using ColdInvite. Luckily, iOS 16.5 resolves the issues and protects your iPhone. 

Where things get interesting, however, is when you look at older vulnerability fixes dating back to last year in iOS 15.6.1. ColdInvite was discovered because of a vulnerability Apple fixed last year called ColdIntro (CVE-2022-32894). ColdIntro was patched as part of the iOS 15.6.1 update, and analysis from Jamf states that the 15.6.1 update “mitigates a specific way for an attacker to escape a co-processor but does not fix the root cause of the underlying vulnerability.”

In Layman's terms, iOS 15.6.1 fixed the ColdIntro security risk but not why the risk existed, to begin with. That means that Apple has taken nearly a year to find the root cause of the issue and, finally, has helped the iPhone get rid of its cold.

Apple saves the day

Security vulnerabilities are nothing new, but they can be worrying when you look into the nitty gritty details. Luckily, Apple puts security and privacy at the forefront of its ethos, leading to long-term development, like the one here, to solve potential security risks.

With WWDC on June 5 just around the corner. We'll be watching with eager eyes to see what security enhancements iOS 17 brings to the table. It looks like we could see iMessage Contact Key Verification, either in iOS 16.6 or when WWDC comes around.

If you own an iPhone or iPad, you should update to iOS 16.5 now after concerns of a significant security threat.

Apple released the iOS 16.5 update last week, highlighting security fixes for three zero-day vulnerabilities found within the WebKit browser engine. However, these vulnerabilities could be actively exploited, leading to worrying security concerns. 

The security risks impact iPhone 8 and later, all iPad Pros, iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later.

Apple's support document says the specific vulnerabilities are:

• CVE-2023-32409 which could enable a remote attacker to break out of the Web Content security sandbox.
• CVE-2023-28204 which may disclose sensitive information when processing web content.
• CVE-2023-32373 which could lead to arbitrary code execution using maliciously crafted web content.

Huge security concerns

Forbes spoke to Sean Wright, the principal application security engineer at Featurespace. He said iOS 16.5 shows "another mixed bag of vulnerabilities, some with quite severe impacts if an attacker were able to successfully exploit them,"

"Chaining some of these vulnerabilities together could potentially allow an attacker to be able to remotely gain full control of a device"

Wright says the WebKit vulnerabilities are very worrying and urges everyone to update regularly to ensure their iOS devices are protected from potential security issues.

It's worth noting that while vulnerabilities should be a concern, you shouldn't worry too much about these vulnerabilities. As long as you update your device and remain vigilant, your iOS device should be protected against major threats. 

Since the release of iOS 16.5, Apple has started seeding iOS 16.6 beta to developers, looking to keep improving security across iOS. 

With WWDC around the corner on June 5, there will be hopes that Apple strengthens security across its operating systems to make sure that iOS 17 and iPadOS 17 are as stable and security-rich as possible. 

Apple is making a big play with passkeys, the first real alternative to the humble password that we've seen in a long time. But it hasn't even gotten its password situation right yet.

Apple's been syncing people's saved usernames and passwords for a long time as part of the iCloud Keychain feature. There are plenty of third-party password managers of course, but iCloud Keychain is free and built into every iPhone, iPad, and Mac. But there's still one glaring problem — the app.

As in, the fact there just isn't one. It's not that Apple gave us an iCloud keychain app and it's bad. It just didn't give us one at all and instead all of your saved passwords live in the Settings app — something nobody at Apple will ever be able to convince me makes sense.

Passkey promotion

Apple is making a big deal about passkeys, as well it should. It's part of the FIDO Alliance alongside Google and Microsoft and it knows that it's high time that passwords were killed off for good.

Databases full of leaked or stolen usernames and passwords are available online, potentially opening your data to people who have no right to be anywhere near it. Passkeys fix that by putting the authentication mechanism behind biometric security like Face ID or Touch ID. In the world of passkeys there's nothing of use for thieves to take from remote servers, whereas passwords have been known to go missing with alarming regularity. I'm oversimplifying, but you get the gist.

So, with that in mind, now is the perfect time for Apple to make iCloud Keychain less of an afterthought on its own platforms. We shouldn't have to rely on 1Password or other apps to give us a proper interface for managing passwords or passkeys, but we do.

If Apple really is going all-in on passkeys, could it break iCloud Keychain out of the settings app soon? With iOS 17, macOS 14, and iPadOS 14 set to be announced during the WWDC23 opening keynote on June 5, we can only hope there's some positive news. Even if we do have to wait until September for those updates to be rolled out to everyone.

But that wait is fine because, as we know, passkeys aren't ubiquitous just yet. Some services like PayPal and Google already support them, but they're the exception rather than the rule. 1Password does manage a list of websites and services that already have passkey support, so be sure to go there if you want to check if your favorite is ready to go. You might be surprised, but probably not.

A big year for Apple

We already know that 2023 is going to be a big year for Apple. There's the Reality Pro AR/VR headset and the 15-inch MacBook Air still to come. Then there is the iPhone 15 lineup in September as well as a new Apple Watch or three.

But I'd humbly suggest that Apple got itself into this mess and it's time it got itself out of it. The lack of an iCloud Keychain app is unforgivable at this point — make the time to make it happen.

Even if you have to put it in AR or VR to get the attention of whoever needs to OK it at Apple Park.

Smart light manufacturer WiZ has announced that the new Home Monitoring system that will use your existing smart lights to protect your home from intruders and other ne'er do wells.

If you're an Amazon Alexa or Google Home user, it could be an interesting way of keeping yourself and your property safe.

For Apple users, however, not so much.

All about the lights

Centered around the new WiZ indoor camera, the new security feature, powered by 'SpaceSense motion detection technology', can detect movement and then create lighting scenes based on what's happening around your house. That could be a deterrent to alert a potential burglar, such as flashing lights, or using these to make it look like there's someone staying in when you're not at home.

It's all going to be accessible from the WiZ home app, so there will be no new software to download, and it will work with all the existing WiZ lights so you won't have to upgrade. All you'll need to do is buy a WiZ indoor camera. From the app, you'll be able to create what WiZ calls 'routines', so that you can keep your house safe.

As said before, this is going to be great for Google Home or Amazon Alexa users, as the new standard fits perfectly with the two standards. Unfortunately for Apple HomeKit users though, there will be no such luck as there is no support for HomeKit or Apple's Home app.

After reaching out to WiZ, we've been told that because Matter is yet to receive support for cameras the WiZ home monitoring format will not be available with the standard. Once cameras are added to Matter, WiZ hopes to add support.

Until then, the WiZ indoor camera will be available from the second half of May and will cost $69 / £79 / €89.

It’s not much of an insight to say that passwords are a security risk and that most of us use ones that are far too weak. While we tend to begrudgingly acknowledge that, actually putting things right – going through your accounts and changing every password to something unique and memorable – is both difficult and tedious. We’re using a lousy solution for a critical problem.

Recently, though, there have been rumblings of a better alternative, one that’s been sneaking quietly under the radar. If you watched Apple’s WWDC show last year, you’ll have seen Craig Federighi and friends talk about passkeys and how they’re a password replacement that is not only more secure, but easier to use too. But what exactly are passkeys and how do you use them?

To find out, we sat down with Jeff Shiner and Steve Won, 1Password’s CEO and Chief Product Officer, respectively, to hear how the popular password manager is implementing passkeys and why it thinks they’ll soon help you secure your logins without even having to think about it.

What are passkeys?

In layman’s terms, a passkey lets you log in without a password. That may sound unsecure at first, but we’re not talking about simply leaving the front door unlocked. Instead, you can use your own biometric information instead of a password. You know when you unlock your iPhone 14 Pro or confirm a purchase using Face ID or Touch ID? A passkey can harness that biometric security and convenience to log into your apps and online accounts. By nature, passkeys are both quick and secure.

Instead of having to remember a complicated set of unique, hard-to-crack passwords for the hundreds of accounts you use, you just log in with your face or your fingerprint. Not only do you avoid the risk of reusing passwords for different websites, but only your own biometric data will be accepted for logging in. There’s nothing to phish and nothing to leak.

That could be a game-changer. As Shiner puts it, “One of the things that’s exciting for us is I think we’re going to start to see in 2023 passkeys really take off.” He continues, “I think when we look at it in terms of where passkeys are at, some of the releases that we’ve seen from other platforms, and obviously what we’re doing ourselves, 2023 is going to be a year where passkeys start to take off.”

1Password’s passkey beta

To make that happen, 1Password will start supporting passkeys in an open beta around the early summer, but we’ve had advance access for a couple of weeks. 

1Password’s passkey beta is extremely easy to use – creating a passkey on a compatible website basically involves clicking “create passkey,” with no need to dream up a complicated password at any point. Then when you next go to sign in, you’ll be prompted for your biometric info and 1Password will fill in the passkey for you. It couldn’t be simpler.

At the time of writing, there are around 50 websites that support passkeys, including Google, eBay and Best Buy, and 1Password has created a handy website at passkeys.directory for you to see which sites are compatible. You can also upvote any sites you want to implement passkeys.

The process is so straightforward that it almost feels too simple, and that’s something 1Password is aware of. As Won says, “there’s still the human psychology of ‘man, that was a little too easy. Are you sure it’s secure?’” But 1Password has earned a trustworthy reputation, Won says, and that can help ease people into using passkeys. Besides, so many of us use Face ID or Touch ID every day knowing they’re safe, and that could help reduce the friction.

Removing the phishers’ reward

It’s easy enough to remember, say, five different passwords. But these days, we all have way more accounts than that. Won remembers that when he first started working for 1Password over a decade ago, he had just under 100 items saved in his password manager. “Now, if I open it up, I have like 890 items,” he says.

Remembering that many unique passwords simply isn’t feasible, so we cut corners and reuse passwords. But if one of the websites you use gets hacked and bad actors make off with your login details, and you’ve reused those details elsewhere, suddenly the hackers can get into as many accounts as you’ve reused the password for.

With a passkey, there’s no repeated password to be stolen. That’s important because, in the words of Shiner, “if we can remove the credentials with something like a passkey, then we remove the reward that the phishers are going after.” In other words, your risk drastically diminishes.

The Apple ‘bullhorn’

Both Shiner and Won seem confident that 2023 will see a breakthrough moment for passkeys, although it could take many years until they’re as widespread as passwords. 

That breakthrough could arrive thanks in part to the public adoption of passkeys by industry titans with wide, loyal followings. Apple, Microsoft and Google have all either flirted with passkeys or fully implemented them, and Shiner says that if these big names act as a “bullhorn” to promote passkeys, they could become a part of everyday life for billions of users.

It’s no good having your passkeys work on your iPhone but not on your Windows PC, though. To make passkeys really work, they have to be interoperable and extendable. While insisting he has no secret knowledge, that’s something Won is hoping Apple will announce at WWDC this June. If it comes to pass, it might mean the feature opens up “step by step for third parties to push into.”

With WWDC 2023 rapidly approaching, the turning point could be almost upon us. With it, we may finally see the beginning of the end for vulnerable passwords. As Won puts it, passkeys could help us move past a world “where we increasingly put more sophisticated locks on our doors, but the bad actors are just breaking the window to get in.”

A change to the way WebKit handles some internet cookies means that Safari 16.4 will invalidate them more frequently in the name of privacy. But that could also mean that users have to log into their accounts more often as well.

The change, which is built into the underlying WebKit browser engine and implemented as part of the recent Safari 16.4 release, isn't specifically mentioned in Apple's release notes. But it's been spotted by WebKit experts and shared on Twitter.

WebKit developers say that the change is designed to prevent third-party cookies from masquerading as first-party ones — something some websites and services appear to have been doing to help them track users across the web.

Security matters

The change is detailed in a WebKit pull request on GitHub.

The request says that while Safari already caps the lifetime of cookies to seven days if it suspects them to be third-party cookies pretending to be first-party ones, this new change goes a step further.

The explanation is a complicated one, but the gist is that some cookies have been using "CNAME cloaking" to confuse Safari into thinking they're from the website's owner, not a third party. That party could be some sort of analytics company for example.

With Safari 16.4 installed, the browser will look for more telltale signs that something isn't as it should be with the cookie in question. If it's deemed not to be a first-party one at all, it'll be set to time out after just a week.

Some have suggested that Google Tag Manager is the target of such a change, although there are likely other implications for other services. Tag Manager is a tool that allows website analytics and more.

This is all being done in the name of privacy and will likely help prevent people from being tracked when browsing the web. But it could also have an unintended impact on logins as well.

Experts worry that login sessions could be caught in the crossfire, with their session cookies also forced to time out after seven days. The result would mean users have to log back into websites after a week unless they visit the site and obtain a new cookie sooner.

Critics are already suggesting that this move in particular goes against the idea of an open web, although Apple will no doubt see things very differently.

As always, the best iPhone, Mac, and iPad is one that's safe and secure. But it could well make life difficult for website and service builders who rely on the tools and analytics that this cookie change will impact.

Popular web browser Opera is rolling out a huge new security feature for everyone who uses its app on the iPhone and iPad.

The importance of using a VPN can't be overstated and while there are plenty of options out there, Opera's is completely free. What's more, like all the best VPN options, this is available on every platform you're likely to use.

Today's announcement comes with Opera already offering the same VPN functionality via its other platforms including the Mac.

Safety first

Opera had already made the iPhone and iPad VPN available to some people as part of an early access program, but now it's rolling it out to everyone who wants it.

"When users browse the internet, they can be subject to data collection from websites and online services, many of which are not always transparent about how they store and use this data," an Opera press release reads. "Meanwhile, unsecure networks, such as some public Wi-Fi are vulnerable to attacks from bad actors, which can compromise sensitive personal data like web banking information or credit card details."

A VPN helps to protect against that, and by putting one right into the web browser Opera makes it easier than ever to stay protected. Users don't have to log into any services or other apps and just have to press a button.

Just as importantly, Opera says that it doesn't collect your browsing history either.

"A no-log service, the VPN does not collect any personal data or information related to users’ browsing history or originating network address, ensuring anonymity," the statement reads. Not all VPN providers can boast that.

Anyone who wants to take the free VPN for a spin can download Opera now. It's free, although we're told that users should expect the VPN to become available "within the coming weeks." Keep that in mind if you don't see the VPN button just yet.

Apple has released four new software updates designed to help make older devices more secure following a pair of exploits that are said to have been used in the wild.

The updates, which followed similar ones for more modern devices including the iPhone 14 and the latest M2 MacBook Air, are built with something much more classic in mind. The iPhone 6s is the oldest phone supported by the iOS 15.7.5 update. MacBooks all the way back to 2013 get the macOS Big Sur and macOS Monterey releases as well.

It's of course vitally important for Apple to make sure that its latest and greatest hardware is all up to code. But it's arguably true that the oldest device in use today could also be the most important to update.

New updates for old phones

Whether you're using the best iPhone you can buy today or are holding onto that iPhone 6s like your life depends on it, you need to be confident that you're using software that is as safe and secure as possible. This round of software updates ensures that's possible.

We don't need to look very far to see phones that don't get the same level of love and care from their software provider, and while Google and Android have gotten better over the years they still have a ways to go. The iPhone 6s went on sale on September 25, 2015. That means that it's coming up to eight years old.

How many eight-year-old Android phones are still getting security updates?

It's vitally important that phones of that age remain secure. They're often used by people who are less likely to follow good technology hygiene which could make them the most susceptible to falling foul of security flaws in the first place.

Your iPhone 14 Pro might be all up to date and secure, but is your grandparent's almost decade-old Android phone? Probably not. But an iPhone 6s? You betcha.

And these updates are important ones as well. Apple says that an "IOSurfaceAccelerator" flaw could leave an app able to run code with kernel privileges, which is bad. A WebKit bug also means that "maliciously crafted web content may lead to arbitrary code execution." That's also bad.

Both are fixed in iOS 15.7.5 and iPadOS 15.7.5. 

Macs aren't left out

It's a similar story on the Mac. The macOS Monterey and macOS Big Sur updates are both compatible with MacBooks that go all the way back to 2013 which is, according to my calendar, a whole ten years ago. The iMac from 2014 is covered as well. None of those machines support macOS Ventura, so they'd be left defenseless if it wasn't for macOS Monterey 12.6.5 and macOS Big Sur 11.7.6.

Apple says the two updates deal with the same IOSurfaceAccelerator issue as those iOS and iPadOS updates, but there's no mention of a WebKit issue. That's because Apple already released a standalone Safari update that fixes the WebKit issue on the Mac. Because of course it did.

The Apple silicon security conundrum

Apple maintaining security updates for at least a decade could become more important than ever thanks to Apple silicon.

That might sound strange, but bear with me on this.

With Apple silicon being such a huge boost for Mac performance it's entirely possible that people will hold onto their machines for even longer than they already do. And that's bad for security.

People have often justified the Mac's relatively high price because they keep their machines for longer than they might a Windows PC. But imagine a world where those Macs stay performant for even longer. Where an older Mac doesn't need to be replaced because it's beyond its best. All because Apple silicon is so darned capable.

In that case, Apple's insistence on shipping security updates for so long will be huge, and it's something that should be lauded more than it is. Especially when the company is so often accused of "planned obsolescence" and such.

In reality, it couldn't be further from the truth.

Apple's newly-released macOS Ventura 13.2.1 and iOS 16.3.1 didn't add any new features, but that doesn't mean you shouldn't install them. Information gleaned from their release notes shows quite the opposite.

Apple says that both new software updates include security fixes that are absolutely worth installing. One of the fixes relates to a WebKit issue that the company notes could already have been actively exploited by bad actors.

Update time

The release notes for macOS Ventura 13.2.1 and iOS 16.3.1 mention a WebKit vulnerability alongside other issues relating to the Kernel and, in the case of the Mac, Shortcuts. But it's that WebKit issue that is most concerning.

"Processing maliciously crafted web content may lead to arbitrary code execution," Apple's release notes start out before adding the kicker — "Apple is aware of a report that this issue may have been actively exploited."

That's a vitally important part because it means that someone somewhere is already using this exploit to run arbitrary code. And while it's unlikely that most people reading this are targets for those kinds of people, an abundance of caution is always wise when it comes to iPhone and Mac security.

Apple notes that anyone with a compatible iPhone (or iPad, for that matter) should update now, whether that's an iPhone 8 or Apple's latest and best iPhones, including the iPhone 14 Pro. The same goes for the Mac, too.

We'd always suggest installing Apple's new updates regardless of whether security fixes are included, but in this case, it really is a no-brainer. Those with an iPhone can head into the Settings app to begin the update process, while the macOS Ventura update mechanism can be found in the System Settings app.

Apple has begun selling a Kensington lock designed specifically for the Mac Studio priced at $64.99.

The snappily-named Kensington Locking Kit for Mac Studio isn't available right away, unfortunately, with buyers left hoping that nobody steals their Mac in the four to six weeks they'll have to wait for the lock to arrive.

A fully-specced Mac Studio can be the best Mac for a ton of people. But it can cost a small fortune — even the cheapest costs $1,999 — which makes it a tempting mark for would-be thieves. That's why using something like the Kensington lock can be so handy.

Safety first

Kensington's blurb says that the lock was designed specifically for the Mac Studio and can be installed in minutes without the need for any tools or modifications. " It won’t get in the way, and is designed to perfectly complement Mac Studio," the blurb continues.

"Verified and tested for industry-leading standards in torque/pull, foreign implements, lock lifecycle, corrosion, and other environmental conditions, this locking kit comes with a five-year limited warranty," the product listing says before getting into the highlights.

Those highlights include the fact that the lock won't get in the way of any of those lovely Mac Studio ports. There's also a shout-out for the "carbon steel cable with protective nylon sheathing" as well as another reminder that buyers don't need tools to get started.

Kensington is of course a company that has been making locking kits like this for years, although it made its name finding ways to stop office desktop PCs from being stolen by disgruntled workers back in the day.

Hopefully, the chances of your own Mac Studio going missing are slim, but if you're at all worried you can order your Kensington lock today. If that potential six-week wait puts you off, perhaps try your luck at a local Apple Store instead.

Advanced Data Protection is one of the most important new features to arrive on iCloud. Available with iOS 16.2, it adds further encryption to its cloud computing service. It comes at a similar time to Lockdown Mode, which you can find out more about in our how to enable Lockdown Mode on iPhone and iPad guide.

Here's a close look at how the new service works and how to set it up on the iPhone 14 Pro and other supported devices, including all the best iPhones and best iPads. 

What is Advanced Data Protection?

For years, Apple has been committed to providing industry-leading data security for its products and services. Much of this focus has been on iCloud, Cupertino's cloud computing and backup service. With Advanced Data Protection activated, Apple brings to 23 the number of sensitive data categories that use end-to-end encryption. In addition, it now includes iCloud Backup, Notes, and Photos. 

With the change, only iCloud Mail, Contacts, and Calendar are not covered by end-to-end encryption. Apple says this is because of "the need to interoperate with the global email, contacts, and calendar systems."

Advanced Data Protection is not turned on by default; e.g., it's an optional setting. When activated, iCloud data access is restricted to your trusted devices only. This means Apple and hackers alike can't decrypt your data.

What happens after activating Advanced Data Protection?

Apple explains in its Advanced Data Protection support document that your trusted device performs two actions once the service is turned on. First, communication is made between it and your other supported devices, indicating you want end-to-end encryption on iCloud. This process involves writing code into the iCloud Keychain. 

Second, it removes the previously installed iCloud authentication tools from Apple data centers. Apple notes this "deletion is immediate, permanent, and irrevocable." Once the removal, Apple can no longer access your iCloud data that are protected by end-to-end encryption. 

Finally, Apple contends, "After the service key rotation is successful, new data written to the service can't be decrypted with the old service key. It's protected with the new key which is controlled solely by the user's trusted devices, and was never available to Apple."

Advanced Data Protection requirements

There are important requirements for using Advanced Data Protection. These include: 

• Two-factor authentication must already be activated.
• You must be signed in to your Apple ID devices.
• Each of your devices must be updated to at least iOS 16.2, iPadOS 16.2, macOS 13.1, tvOS 16.2, watchOS 9.2, and the latest version of iCloud for Windows.
• Finally, you must set up at least one alternative recovery method. One or more recovery contacts or a recovery key. These are required to recover iCloud data if access is lost for whatever reason. 

Activating Advanced Data Protection

The optimal way to activate Advanced Data Protection is through an iPhone with iOS 16.2 or later installed. Here are the steps:

1. Tap on the Settings app on your iPhone. 
2. Choose your name at the top of the page. 
3. Select iCloud.

Next:

4. Scroll down, and select Advanced Data Protection.
5. Tap Turn On Advanced Data Protection.
6. Choose Set Up Account Recovery.

You can either assign a recovery contact or create a recovery key. You'll need to keep track of your selection if you can no longer access your iCloud connection. 

To add a recovery contact on the active page: 

7. Tap Add Recovery Contact.
8. Choose Add Recovery Contact a second time.
9. You can select a contact from your existing Apple Family list or add someone else. 

From there: 

10. Tap Next at the top right.
11. Choose Send. Once you do, the person on the other end will receive a text for which they must accept to become your recovery person. They too need to have a supported device to make the acceptance. 

If you rather create a recovery key, go back to Step 3 above, then: 

1. Tap Recovery Key.
2. Toggle on Recovery Key.
3. Confirm your selection by tapping Use Recovery Key. 

From there: 

4. Type your iPhone passcode.
5. Make a note of the recovery key on the next screen and KEEP A PHYSICAL COPY SOMEWHERE SAFE. 
6. Tap Continue.
7. Manually type in the recovery key. 
8. Tap Next.

That's it; your recovery key has been activated. Again, keep a physical copy of this key somewhere. Apple DOES NOT have a record of this. From now on, 23 sensitive data categories in iCloud will be protected through end-to-end encryption.

Turning off Advanced Data Protection

You can turn Advanced Data Protection off at any time by:

1. Tap on the Settings app on your iPhone. 
2. Choose your name at the top of the page. 
3. Select iCloud.
4. Scroll down, and select Advanced Data Protection.
5. Tap Turn Off Advanced Data Protection. Follow the additional instructions. 

A good beginning

Advanced Data Protection is launching in the United States at the end of 2022. It will arrive in the rest of the world in early 2023. We'll update this post for whatever changes that may come between now and when Apple releases iOS 16.2 and other software updates in the coming weeks. 

Password management company 1Password has today announced that it would begin to support passkeys starting next year. The company also confirmed that it had joined the FIDO Alliance board after being part of the setup for some time.

With 1Password now sitting on the FIDO Alliance board, the company will have a more significant say in how passkeys are rolled out across the internet, saying that it hopes to "deliver on the promise of making this future accessible to everyone, everywhere. It goes on to say that it sees its "appointment to the FIDO Alliance board as an important opportunity to strengthen our commitment to the cause."

1Passkey

1Password announced it's sitting on the FIDO Alliance board via a blog post, but it's a new demo page that is the most exciting thing the company shared today. A new webpage allows people to create their passkey and save it in 1Password, as long as they're already customers. Of course, you'll also need to be using Chrome for now, but that's a limitation that will surely change.

The webpage guides people through creating their passkey and saving it while listing several companies that already support passkeys in a new directory.

Passkey support was added to Apple's devices with the release of iOS 16, iPadOS 16, tvOS 16, and macOS Ventura. The idea is simple — people suck at creating passwords, so passkeys replace them. No more passwords or usernames and authentication is handled on-device using biometrics like Face ID or Touch ID. You can also scan a QR code, too.

You can learn more about passkeys and how 1Password will keep them safe on the company's website. 1Password was already one of the best password managers; could it also be the best passkey manager?

A strong password is vital to making sure that you keep your online accounts and data safe, but some people seem to really struggle with choosing the right one — as this list of the 200 most common passwords of 2022 clearly shows.

A report by NordPass shows that there are some truly awful passwords in use, with the most common being the ubiquitous "password." That's shortly followed by "123456" but things get worse when you scroll down the list.

Much, much worse. And you won't believe what some people use to keep their stuff safe.

Password madness

If we scroll down the list of the most common passwords of the year we see a number of variations on the "123456" we mentioned earlier, including the always popular "123123." In fact, the first use of actual real words beyond "password," "guest," and "qwerty" comes at number 21 with "D1lakiss."

Other terrible passwords include "qwertyuiop" and "qwerty123" which is mildly better but will still be cracked in less than a second. But hey, you folks get a mark for using numbers and letters.

Scroll all the way down to the 88th most common password and things start to get interesting, although not actually any better. That password is "fuckyou" which seems a little harsh — they could at least have put a number or two in there, right?

Other popular passwords include the usual smattering of names like "daniel" and "thomas" but if there's one thing this all tells us is that Apple Passkeys can't come soon enough. The sooner we don't have to make passwords at all, the better.

Until then, make sure to check out our list of the best password managers for your iPhone and beyond. And check out that NordPass list to see which passwords you should absolutely avoid, too.

As with most tech companies, Apple is very protective about its intellectual property. In March 2021, we saw the company sue its former materials lead Simon Lancaster. The lawsuit alleged that Lancaster sold Apple’s trade secrets to the media, in exchange for favorable coverage for his startup.

Apple has now reportedly settled that lawsuit, says a new report from The Verge. A judge approved the settlement order this week. According to the settlement, Lancaster has to pay an undisclosed sum to the company, and agree to not deal with any confidential information related to Apple without the company’s permission.

The settlement (as we know it)

The original lawsuit accused Lancaster of accessing information that was not related to his job at Apple. He had access to that information because of his seniority. He allegedly used this information to leverage coverage for a startup called Arris Composites, which he was employed with after leaving Apple. 

The original complaint from Apple said:

“Despite over a decade of employment at Apple, Lancaster abused his position and trust within the company to systematically disseminate Apple's sensitive trade secret information in an effort to obtain personal benefits. He used his seniority to gain access to internal meetings and documents outside the scope of his job's responsibilities containing Apple's trade secrets, and he provided these trade secrets to his outside media correspondent.”

The settlement order doesn’t specify how much money Lancaster has to pay Apple, but it does mention that he’s “enjoined from disclosing, communicating, transferring, discussing, or using any Confidential Information, in any form, without Apple’s express prior written authorization”.

Apple also has another similar lawsuit ongoing, where a former Apple engineer who was working on the Apple Car has pleaded guilty to trade secret theft. With major leaks happening around popular Apple products including the best iPhones and best iPads, we might see more such lawsuits in the coming times.

A VPN is a “virtual private network” that can hide and encrypt your data connection on a device, such as the iPhone, by redirecting it through specially configured remote servers that are run by a VPN host. While there are plenty of third-party VPN apps on the App Store, they may not be working as intended because not all traffic is encrypted, according to Michael Horowitz, a self-proclaimed independent computer consultant and blogger, who has published a lengthy post about this specific problem. He also claims that Apple is aware of the issue but has yet to do anything about it since it was first discovered in 2020.

iOS has had this VPN security vulnerability since 2020

According to AppleInsider, this iOS VPN vulnerability was originally discovered in March 2020 by a VPN firm called ProtonVPN. Typically, when a user turns a VPN on, the operating system should then terminate all active internet connections and then automatically re-establish the connections through the VPN, preventing any kind of data leakage from occurring. But since iOS 13.3.1 and later, a bug was found where the active connection wasn’t actually terminated before establishing a new connection through the VPN. In short, the user would continue to use the insecure connection that they were on before connecting through the VPN.

This is a major security risk because those who may use a VPN may be in countries that have strict surveillance and civil rights abuse, according to ProtonVPN.

iOS VPNs could be leaking your data

With the new report from Horowitz, he looked at a data stream on an iPad while using a variety of different VPNs. It is demonstrated numerous times that the data leak vulnerability still exists, and the leaks can be quite significant. It appears that though Apple was made aware of this issue back in 2020, the company has done nothing to address it.

Further in the report, Horowitz says he stopped observing after repeatedly getting the same results. For him, he said that he is just interested in whether or not there is a problem, and he isn’t interested in being the one to define or debug the vulnerability. “That’s for Apple,” Horowitz said.

Horowitz has attempted to discuss this vulnerability with Apple and the government’s Cybersecurity and Infrastructure Security Agency (CISA), but those attempts have failed.

“At this point, I see no reason to trust any VPN on iOS,” Horowitz said. Instead, he suggests making direct VPN connections in a router through VPN client software, rather than use a VPN app on your current iPhone or iPad.

It should be noted that the research Horowitz conducted focused solely on VPN apps from third-party developers. His research was not on Apple’s own Private Relay feature in iCloud+. However, Apple has continuously said that Private Relay is different from a VPN and should not be looked at as the same thing.

If you've seen your fair share of accidents or want always to be prepared when you're on the road, then a dashcam is a great way to capture things as they happen. Some will even work with your iPhone, though not all. With the Thinkware F800 PRO Dash Cam you can feel good knowing you have a dashcam that will get the job done. Here are the best dash cams you can get right now!

Best Overall: Thinkware F800 PRO Dash Cam

The Thinkware F800 PRO Dash Cam has a few more bells and whistles than your standard dashcam. It brings many high-end features, including red light camera and speed camera alert, super night vision, forward collision and lane departure warning systems, built-in Wi-Fi, parking surveillance, a rearview camera, and more.

Simply stick the 140-degree camera to your windshield, and after a few simple installation steps, you're good to start recording! Some other funky features include the red light camera and speed camera alert. These will even save you a bit of cash if you like to pretend you're in the Fast and Furious movies. You'll also like the lane departure warning system. It informs the driver when they're veering into another person's lane.

Plus, with the built-in Wi-Fi, you can easily playback your footage directly from your iPhone. No downloads or hassle required. This dashcam, with hard wire included, also comes with a rear camera, just in case you get rear-ended or smacked in a parking lot. Unfortunately, a dashcam with all this additional glitz and glam is going to cost you a bit more.

This camera comes with a lot of bells and whistles, like super night vision, 32GB MicroSD card, and more.

Best Value: Transcend DrivePro 200 Car Video Recorder

If you like recording seamless, sharp, full HD video, instantaneous playback footage, and quick installation without any additional migraines, the Transcend DrivePro 200 Car Video Recorder is bound to be your car dash's new BFF.

One of the coolest things about the Transcend DrivePro 200 Car Video Recorder is the emergency recording feature. The camera, using its hyper-sensitive G-sensor, will sense the impact and trigger emergency recording mode, which will lock down and protect the current recording from being overwritten, including the critical seconds before an accident.

To install the dashcam, all you must do is mount it onto your windshield and connect it to your car's lighter socket. Then you enter the time, and you're good to start recording the open road ahead of you.

This compact dash camera covers some impressive 160-degree viewing angles.

Best Affordability: AUKEY 1080p Dash Cam

Aukey's dashcam is the most affordably priced camera on this list, which is a breath of fresh air for those out there more price conscientious. However, don't let the low price fool you, as this cam packs many of the same features found in more expensive options in its category.

For starters, this cam records in 1080p resolution, while also maintaining a strong performance in low-light conditions for nighttime driving. This camera has an emergency recording mode that incorporates a time-lapse video of your journey. Furthermore, this dash cam even carries a spare port to charge your phone.

Aukey's cam offers 1080p resolution, a super-wide 170-degree field of view, and time-lapse recording for an affordable price.

Best Aesthetics: Garmin Dash Cam 56

Garmin's been making car tech for ages, and wouldn't you know it; it makes a dashcam with built-in GPS! For real, though, the Dash Cam 56 is an excellent standalone GPS dashcam, as it comes with a 140-degree field of view, a dual 12V charger, and Garmin Clarity HDR.

With the Dash Cam 56, you can record location, direction, speeds, data, and time, so you'll be able to provide details as to where exactly crashes happen (hopefully not at all) and the conditions under which they occur. You'll also get handy safety measures like forward-collision warnings and red-light speed camera warnings. Once you plug this one in, it's recording — it's that easy. This is a wonderful dashcam for everyone. Unlike previous models, it also includes support for Bluetooth and Wi-Fi.

Garmin's camera packs a lot of features in a small frame under two inches. Its Garmin Clarity HDR delivers a crisp 1440p video.

Best Bundle Pack: VIOFO Dash Cam A129

Dash cameras can be expensive, that's why most people usually buy just one for the front. Thankfully, VIOFO puts an end to that by offering a bundle pack that doesn't only include the camera for the front, but the rear of your car as well. What's cool about this is you get two cameras that both offer a stunning 1080p resolution, recording at 30fps.

Along with the 1080p resolution, the VIOFO Dash Cam A129 delivers in some other categories seen in most premium offerings, including Super Night Vision, 2.5GHZ and 5GHZ Wi-Fi support, and it comes with a 64GB MicroSD card, which is the most storage given on the list.

VIOFO Dash Cam outdoes itself with its high-end features and dual camera package.

Bottom line

Finding the right option for such a niche product like a dash camera can be a drag. With that thought in mind, this type of product isn't typically owned by many people, which leaves a huge learning curve for anyone interested in owning a dash cam one day.

That's why our best choice the Thinkware F800 PRO Dash Cam relieves some of that anxiety. It's an excellent camera that brings many welcomed features such as a 140-degree wide-angle view at 30fps, super night vision, and it even comes with a 32GB MicroSD, which is more than enough data to save your recordings.

We believe one of the main things you should look at in purchasing your new dash camera is not just crisp video quality, but its concealability. Some of the best designed camera's are hardly noticeable when in the car. Lucky for you, our list has options that checks that box.

This Black Friday, there's no need to spend more than $60 on a great set of home security cameras, video doorbells, or alarm systems. These Wyze Black Friday deals will save you a ton of money compared to other smart home security systems and still deliver a brilliant experience every time.

Before we begin, note that Wyze doesn't support Apple HomeKit. If you need a HomeKit-compatible home security system, video doorbell, or camera, check out the best Black Friday HomeKit deals.

Both the Wyze Video Doorbell and Wyze Cam Outdoor deliver quality 1080p video via Wi-Fi, packed inside an IP65 water and dust resistant shell, making it easy to place these absolutely anywhere you need.

Wyze packs a chime in with its Video Doorbell, which means you won't need to wire into an existing doorbell system just to hear the ding when someone rings your doorbell. You'll also find that the 1080p video on Wyze Video Doorbell is more useful than some other video doorbells thanks to the 4:3 aspect ratio — which Wyze calls head-to-toe video — as it sees more of the person at your door than 16:9 widescreen video would.

Both Wyze Video Doorbell and Wyze Cam Outdoor can last up to 6 months on a single battery charge, too, making them ideal solutions for remote outdoor cameras.

Everything comes together under the Wize Home Security System, which can utilize any other Wyze cameras you might have on your home's network to create a more complete home security system. This Core Kit will cover any apartment or small home with two contact sensors, either of which can be placed on any window or door you want to be covered.

Larger homes can pick up any extra sensors needed to cover the windows and doors in your home, and up to 100 sensors can be used on a single system.

Wyze's easy-to-use keypad can be used to arm or disarm the system, or you could tap into the Wyze app to get the job done instead. Since Wyze doesn't tap into HomeKit, you'll need to use the Wyze app to program any automations you desire. Another reason to buy a bunch of Wyze products instead of trying to hodgepodge together a system with many other brands.

Lastly, if you'd rather have professional monitoring, Wyze offers a 24/7 professional monitoring service for a minor monthly fee. That way, you don't have to DIY to ensure your home is protected all day and night.

What you need to know

• Apple is suing the NSO Group.
• Apple says the lawsuit is to "hold it accountable for the surveillance and targeting of Apple users."
• They aren't the only company to sue NSO Group.

Apple may be heading to court again, but this time it won't be to defend itself from Epic Games but rather to sue the NSO Group, the Israeli surveillance company.

Apple claims that the NSO Group has surveilled and targeted Apple users with no accountability long enough. Apple is seeking to no longer allow NSO to use any Apple software in the future. Apple's senior vice president of Software Engineering, Craig Federighi, says while Apple devices are every secure state-sponsored spyware has become dangerous.

Apple is also seeking damages, an unspecified amount, for the costs associated with dealing with, what Apple calls, abuse of its products. Apple has committed to donating the proceeds to organizations that help uncover spyware.

Apple isn't the first company to sue the NSO Group over similar allegations. Facebook sued the NSO Group back in 2019 for targeting WhatsApp users.

Still, it's pretty odd for Apple to announce they are suing a company. Lawsuits happen all the time in tech without Apple or other companies making a news release. It could be that Apple is deeply passionate about this specific issue, or it could also be a good way to drum up some public support for the cause. In any case, Apple hasn't issued a news release about suing a company since 2010, when it sued HTC for patent infringement.

What you need to know

• Video conferencing company Zoom has agreed to pay $85 million to settle a privacy lawsuit.
• Zoom will bolster its security after the suit claimed it violated people's privacy by sharing data and failing to prevent Zoombombing.

Video conferencing company Zoom has agreed to pay $85 million to settle a privacy lawsuit relating to its lax security practices and the way it shared data with companies like Facebook, Google, and LinkedIn.

According to a Reuters report, the lawsuit settlement was filed over the weekend and still requires approval by U.S. District Judge Lucy Koh in San Jose, California.

As part of the agreement, Zoom promises to work on improving its security measures — including alerting hosts when a person in a meeting uses a third-party app. Employees will also be given training on privacy and data handling, the company says.

As Zoom grew during last year's pandemic situation, users found that it was often trivially easy to get into meetings that they shouldn't be part of. That led to Zoombombing becoming a thing — the process where people join meetings anonymously and share inappropriate content. Zoom came in for a ton of criticism over the practice and its inability to prevent it last year.

Zoom's popularity exploded at a time where people needed to work from home en masse, and it seemed to take the company by surprise. It seems to have learned a lot from its early mistakes — and losing $85 million will no doubt help it learn some more, too.

Are you working from home? These are the best headphones for Zoom right now — now you'll be able to hear the panic in your boss's voice when they realize they can't watch your every move anymore!

What you need to know

• Apple's App Tracking Transparency is starting to have an affect on the advertising industry.
• As more users update to iOS 14.6, more are turning off app tracking.
• That is impacting advertising revenue by as much as 20%, according to Brian Bowman.

Brian Bowman really hates Apple's App Tracking Transparency.

The CEO of Consumer Acquisition, a social ad agency, sat down recently for an interview with Gamesbeat (part of Venture Beat) that touched on the effects that Apple's new App Tracking Transparency feature was having on the advertising industry. When Gamesbeat asked Bowman what life after Apple's IDFA changes is like so far, the CEO said that some clients are seeing revenue being impacted as much as 40%.

Bowman had even stronger words when asked about Apple's stance that its new anti-tracking measures were a step forward for user privacy, calling it "absurd."

While it's not surprising to hear an advertising excecutive lambast Apple for hurting an advertising method, the simple fact is that advertising companies enjoyed the luxury of collection plenty of user data without people's knowledge for years.

However "absurd" it may be, App Tracking Transparency is a great step forward for user privacy and a win for Apple's continued efforts in the area. It gives each and every user a choice on what they want to do with their data.

What you need to know

• Brave's new privacy-first search engine is available in beta.
• The search engine is available at search.brave.com.

Brace's privacy-first and tracker-free search engine is now available in public beta, meaning anyone can take it for a spin right now. You don't need to be using the Brave web browser either – just point your app of choice to search.brave.com and be on your way.

As shared by Brave, the new search engine is based on an independent index of the web which means you won't be seeing the same results as you might on Google or Bing – this is all-new. It's also a step in the right direction for the ultimate goal of complete iPhone privacy.

The new search engine has been tested by more than 100,000 early beta testers and feedback appears to have been positive. My early testing has iMore search results working as expected and a quick vanity search returns my various online profiles and places of work, so that's good. The knowledge that none of that search data is going to be used against me helps as well.

Brave's web browser is already one of the best iPhone apps in terms of browsing the web on the go and now we have a new search engine that'll back our privacy, too. Throw Brave's VPN service and the outfit has pretty much every corner of your internet life covered – all without tracking you across it, too.

What you need to know

• 1Password has released a major update to its browser app.
• The update adds support for Touch ID and Dark Mode.

1Password has finally released some stellar updates for its browser extension.

In a blog post, 1Password has announced that it is bringing Touch ID support to its Mac app.

The company is also rolling out Dark Mode support to its browser experience.

Another important update to the browser is an improved way to create, edit, and save, your login information.

1Password says that the update includes 55 (holy crap) other fixes and improvements. The company says that, if you are already using 1Password in the browser, you'll automatically be updated to the latest version.

If 1Password isn't your cup of tea, check out our list of the Best Password Manager Apps for Mac in 2021.

What you need to know

• Craig Federighi sat down with Joanna Stern for a new interview.
• The two talked about App Tracking Transparency, privacy in general, and if Craig could take over as CEO when Tim Cook leaves.

With the release of iOS 14.5 earlier today, iPhone users can now decide if they want apps to track them or not.

The feature is called App Tracking Transparency, and the feature has received backlash from advertising companies like Facebook who want that user data to help it sell more targeted advertisements to advertisers. On the other hand, it is a huge leap in privacy for iPhone users, who can now tell an app not to track them at all, giving them much more control over what data they share with all of the apps on their iPhone.

In order to get into this privacy topic further Craig Federighi, Apple's Senior Vice President of Software Engineering sat down with The Wall Street Journal's Joanna Stern for an interview about App Tracking Transparency and privacy in general.

Federighi says that, while they expected a negative response from some about the new feature, they believe that users deserve the choice of whether an app tracks them or not.

What you need to know

• Security researcher Jack Dates discovered a zero-day exploit with Safari.
• The researcher earned $100,000 for the discovery.
• The Zero Day Initiative pays security researchers to responsibly uncover vulnerabilities.

A security researcher has earned $100,000 for discovering a Safari exploit at the Zero Day hackathon event.

As reported by MacRumors, security researcher Jack Dates discovered a Safari to kernel zero-day exploit during the event, earning Dates $100,00.

The Zero Day Initiative, as it explains on the website, encourages security researchers to find zero-day vulnerabilities by compensating them for their discoveries.

You can check out an overview of the Zero Day Initiative below:

When LastPass nerfed its free tier last month there was plenty of wincing among its users. The removal of features from the free LastPass offering meant that some could no longer is the way they previously had. And, it seems, people upped sticks and went elsewhere.

The removal of email support and the limiting of devices for LastPass users who didn't pay meant that they needed to switch to either LastPass Premium or LastPass Families. The changes begin to kick in next week.

The announcement was made on February 16. What happened afterward? According to the folks at 1Password, people jumped ship, At least, the numbers suggest that they did. CEO Jeff Shiner says the company saw its paid family account signups double after the LastPass news broke.

What's particularly interesting about that is the fact LastPass Families has never been free. It's priced at $4 per month when billed annually. 1Password Families runs $4.99 per month. So why did people move to 1Password?

Or, in fact, did they move at all? It's possible that 1Password has data on the number of people who imported password data from LastPass to back this up, but that isn't what Shiner's statement says. But assuming there is a link, I'd be very curious to know why people moved to 1Password when they could have just upgraded a free account without dealing with the hassle of moving apps and syncing services.

Did people simply want to stick it to LastPass for the perceived slight of losing free access to their password manager? That wouldn't be a huge surprise based on the vitriol LastPass suffered when it made its announcement last month. But whatever the reason, 1Password won't care. Picking up new customers without having to spend a cent on acquisition is the kind of thing business dreams are made of.

Secure remote connectivity The first and perhaps most important thing to make sure your smart security camera offers is a secure connection to the internet. A home security camera will be far less useful if you're not able to check in on it when you're away from the home. And, since the camera will be providing a view into your private spaces, you want to make sure the camera is transmitting its data securely. That means connecting to a password-protected Wi-Fi network and encrypting the video data for transmission.

A wide field-of-view Your security camera is only going to be as good as how much it can see. To that end, a security camera with a wide field-of-view is what you should look for. This way, you can set up a single camera in a corner and see almost the entirety of a room. You'll avoid cluttering your space with cameras and save by needing fewer devices.

Flexible placement Just as the camera's field of view is important, so too is its placement. Having the flexibility to put your camera where you need will help you get your money's worth. Sticky or magnetic stands help, as do flexible mounts that let you adjust the camera's angle once placed. This can let you more easily set up a camera to watch a door, observe a room from high up, keep an eye on pets, or serve as a baby monitor near a crib.

Night Vision A security camera's job is to watch over your house when you can't. That means it needs to be able to see what's going on just as much when you're out of the house and when you're asleep. Some degree of night vision is a must so that your security camera can keep on working even without the lights on. It's all the better if the camera supports color night vision, which will let you get more detail out of your footage.

Two-way audio Plenty of security cameras have a microphone to record what's happening around them, but fewer have a speaker. Those that do offer a convenient extra feature that adds to the flexible utility of the camera. With a speaker, you can use two-way audio, allowing you to communicate through the camera. This feature can let you check in with babysitters, house keepers, or even your pets.

360 Smart Life

What you need to know

• New language was discovered in iOS 14.5 beta 2
• It focuses on zero-click or 0-click hacking.
• These are sophisticated attacks.

Apple's about to make it much harder for hackers to take control of unsuspecting iPhones. The company's second iOS 14.5 beta includes language that focuses on a hacking technique known as zero-click, or 0-click, according to Motherboard.

With zero-click attacks, hackers can break into a device without the end-user performing a task. Because no interaction is required, these "sophisticated" attacks are harder for the targeted user to detect.

The change in iOS 14.5 beta 2 centers around ISA pointers and how they relate to an Apple technology called Pointer Authentication Codes, or PAC. As Motherboard explains, PAC protects iPhone users from exploits that inject malicious code by preventing attackers from leveraging corrupted memory.

Adam Donenfeld, who works for security firm Zimperium, explains, "Nowadays, since the pointer is signed, it is harder to corrupt these pointers to manipulate objects in the system. These objects were used mostly in sandbox escapes and 0clicks." Meanwhile, CENSUS' Patroklos Argyroudis says the change "raised the bar."

The current iOS 14.5 beta was released to developers on February 16. A final version should be released to the public in the coming months. The update includes new emoji, Apple Watch iPhone unlocking, changes to the Music app, and more.

What you need to know

• Corellium is making its iOS virtualization tool available for individuals.

In a blog post, iOS virtualization company Corellium has announced that it is not offering virtual iOS-based devices for individual accounts. The company had previously only supported virtual iPhone and iPad devices for its Enterprise customers.

The company says that individual pricing will be the same as enterprise, charging per CPU cores required to run the virtual device. Corellium says that iOS devices can require up to 6 CPU cores to run.

Individual customers can choose either a monthly subscription model or a usage-based model to fit their specific needs.

The company has also stated that all individual accounts will go through the same vetting process as its enterprise clients to ensure their virtualization tools are not used for malicious purposes.

Corellium is the security research firm that just won a lawsuit filed by Apple this past December. Apple had claimed Corellium's virtualization tool violated its copyright, but the court ruled it did not, affirming it as a tool for security researchers.

What you need to know

• Apple has lost its lawsuit against security research firm Corellium.
• The software that virtualizes iPhones will continue to be allowed.

Reported by The Washington Post, Apple has lost its legal battle with Corellium, the security research firm that created virtual iPhones that Apple had filed a copyright claim against.

Apple had claimed that flaws discovered by Correllium could fall into hackers' hands because the company sold its product "indiscriminately," but Judge Rodney Smith called those claims "Puzzling, if not disingenuous."

Will Strafach, a security researcher, says that the decision will lead to Apple devices being even safer for consumers.

Apple has also just launched its own Security Research Device Program that ships special iPhones to security researchers to help them discover potential vulnerabilities that can earn researchers as much as $1.5 million depending on the severity of the bug.

Amazon has been running Cyber Monday sales all day and has plenty of deals to make your home a lot smarter. One of the most popular items to upgrade is the door lock, and the deal on August's 3rd generation Smart Lock Pro makes it a no brainer to get your smart home started.

The Smart Lock Pro allows you to control your door lock from anywhere, watch your door automatically unlock when you approach it, and even use Siri to lock/unlock your home. It is 50% off at Amazon right now but the deal only lasts for the next few hours.

The 3rd generation Smart Lock Pro from August allows you to control and monitor your door from anywhere. With the August app and voice assistants, you'll be able to lock and unlock your door, control keyless access, and keep track of who comes and goes with an activity feed that tracks things 24/7.

With the August app, the Smart Lock Pro will unlock automatically as you approach it and lock automatically when you walk away. August's Doorsense will also be able to assure you that your door is securely closed and locked.

The August Door Lock Pro installs in about 10 minutes and attaches to your existing deadbolt, so you'll be able to continue to use your existing lock and keys. It does require connection to a 2.4GHz Wi-Fi network through the Connect Hub which is included with the sale.

For those who are trying to build a HomeKit empire, the August Smart Lock Pro can be added to HomeKit and controlled through the Home app on iPhone, iPad, Mac, and Apple Watch. You can also use Siri to control the lock.

This is a Lightning deal and going fast so if you miss out check out Best Buy's sale on the 4th generation Smart Lock that also includes a Lenovo Smart Clock for free.

If you're trying to build out your smart home and want to know what other smart accessories to pick up, check out our list of the best HomeKit devices of 2020. Want to find out what other kinds of deals are going on with everything Apple? Check out our list of the Best Apple Cyber Monday deals.

Your Apple Watch isn't only useful for tracking your fitness or using Apple Pay: If you have a compatible Mac, you can also use Auto Unlock: The feature (which requires macOS Sierra or later and watchOS 3 or later) lets you pair your watch to your Mac; once you've done so, you can automatically unlock your computer just by sitting down in front of it, no password required — if your Apple Watch is unlocked and on your wrist when you sit down. Here's how.

Before you start using Auto Unlock

Before you start using Auto Unlock, you'll need to make sure your Mac and Apple Watch are compatible and that you've set up two-factor (not two-step) authentication for your iCloud account.

To use Auto Unlock, you'll need:

• Any Mac manufactured mid-2013 and later (sorry, early 2013 Mac owners)
• An Apple Watch Series 0, 1, 2, 3, 4, 5, 6, and SE

If you own an Apple Watch Series 0, 1, or 2, you'll need to be running watchOS 3 or later on your smartwatch; additionally, your compatible Mac needs to be running macOS Sierra or later. Newer Apple Watches need watchOS 4 or higher.

Note: Your Mac must have Wi-Fi and Bluetooth turned on.

Because you can use Auto Unlock to bypass your Mac's login password, Apple wants to make sure your computer is as safe as can be by enabling two-factor authentication on your iCloud account.

• How to set up two-factor authentication for Auto Unlock

Note that we said two-factor, not two-step — the latter was Apple's older enhanced security protocol, while the former is the company's most secure version. If you already use two-step verification, you'll have to disable it to start using two-factor authentication.

To enable two-factor authentication, your iPhone will also need to be running iOS 9 or higher.

To use Auto Unlock, your Apple Watch and Mac must be using the same iCloud account. Make sure you've signed in on both devices with the same Apple ID.

• How to log in and manage your iCloud account

You may not have thought it necessary to use a passcode with your Apple Watch when you first set it up, but if you want to use Auto Unlock, you'll need one.

• How to create or remove a passcode on your Apple Watch

You also need to set up a login password on your Mac.

• How to add or change your Mac's login password

If your Apple Watch isn't unlocked and on your wrist, you won't be able to connect it with your Mac. If it is on your wrist and unlocked, your Mac will register the device and allow you to turn on Auto Unlock.

How to enable Auto Unlock on your Mac

Once you've prepared your devices, enabling Auto Unlock is a breeze.

1. Click on the Apple icon in the upper left corner of your screen.
2. Select System Preferences from the drop-down menu.

3. Click on Security & Privacy.
4. Click on General.
5. Tick the box to Use your Apple Watch to unlock apps and your Mac.Auto Unlock will activate; this will take a few seconds.

Note: If you don't see the box to allow your Apple Watch to unlock your Mac, there's an issue. Review your preparatory steps above; if you still see a problem, check out our troubleshooting guide.

Troubleshooting Auto Unlock: Why can't I see Auto Unlock on my Mac?

There are a few additional steps you may have to take if you can't enable Auto Unlock. We've got a full guide below:

• Can't unlock your Mac with your Apple Watch? Here's how to fix it!

What time is it?

Are you in the market for a new Apple Watch? Check out our favorites of the year.

Any questions?

Let us know in the comments!

Updated November 2020: Updated for the new devices.