• 🗒️✅ Your Security Checklist
• 🏆🎖️ Test Your Security Skills
• 📰 Your Weekly Security Update
• 🤨 This Should Be on Your Radar 📡
• 🙈 Security Fail of the Week 👎
• 🍎📱 Security Updates from Apple 🍎

If you take nothing else from this newsletter, just do these three things to protect yourself:

1. Be on the lookout for suspicious emails. Scammers use phishing emails as a way to steal credentials or financial information. Luckily there are some signs you can use to identify phishing emails.
2. Use multi-factor authentication for any accounts that support it. Multi-factor (or two-factor) authentication prevents hackers from accessing your accounts even if they discover your password. The Passwords app on your iPhone has a built-in 2FA code generator.
3. Do not allow apps to track you. Some apps will request to track your activity both in and out of the app. You should never allow apps to track you. You can turn off app tracking completely so that apps can never request it in the first place.

What should you do in the following scenario?

You receive an email saying your Apple Account has been compromised and that you need to verify it by clicking a link or calling a phone number. What do you do? 🤔

1. Click the link.
2. Call the number in the email.
3. Visit Apple.com and contact customer support.
4. Double-check the sender to see if the email is from Apple.

Scroll to the bottom to see how you did!

This week, Apple announced a whole lineup of new devices, including some smart home devices. Apple has partnered with LG Electronics and Schneider Electric to produce these devices, which include security cameras, a video doorbell, and a smart thermostat. While Apple has always valued user privacy, its partnership with LG was enough for us to raise our eyebrows at this announcement. You may remember, just a few weeks ago, we reported on a story about how LG had been found to be recording people's voices through their smart TVs and using those audio recordings for advertising purposes. However, in its announcement, Apple has been adamant that all camera footage and personal data is end-to-end encrypted and not accessible by LG, Schneider, or Apple itself. You can check out our coverage of the new Apple Home Collection, or read Apple's press release directly.

The Bottom Line: Apple has a proven track record of doing its best to protect our privacy. If the company says that the data captured by its smart home devices is safe and only accessible to us, I'm inclined to believe it. If you've been wanting to upgrade to a smart home but haven't been sure where to start, Apple's new Home Collection is a great option.

Why You Should Think Twice About Posting Images of Your Home Online

An AI-powered tool called Raven allows law enforcement to pinpoint the exact home where a particular photo was taken. The tool works by scanning sites like Zillow and Airbnb for interior photos of homes and matching them to any photo fed to Raven. Police can pull photos from social media and use them to locate the user in a matter of seconds. Read more at 404 Media.

The Bottom Line: Be careful what you post to social media. Avoid sharing photos of the inside of your home, and never share your location in real time. This information could be used against you.

YouTuber Builds His Own Version of Flock

YouTuber Anthony Sistilli built an automated license plate reader (ALPR) camera that works very similarly to those used by Flock Safety, a company that provides ALPR technology to law enforcement agencies. The big difference is that Sistilli's camera only tracks and logs police cars. Needless to say, law enforcement officers soon showed up at Sistilli's home with some questions about how he planned to use the data he was collecting. Check out the full story at Tom's Hardware or check out Sistilli's YouTube video.

The Bottom Line: There is some irony in law enforcement expressing privacy concerns about their vehicles being tracked when many law enforcement agencies use the exact same technology to track citizens' vehicles.

AI Agent Shares CEO's Personal Financial Details with His Company

The CEO of XMTP Labs, Shane Mac, created a team of executives composed of AI agents using GrokBot. He gave his CFO agent read-only permissions to his financial data. Mac wanted the CFO agent to send monthly audits of his personal finances and send it to group chat with his other AI agents. However, the agent generated a financial report and sent it to his employees at XMTP. Check out the full story at Business Insider.

The Bottom Line: As we've said before, AI agents are a new frontier. When an AI agent has access to your personal information, you run the risk of having that information used in ways you don't intend. The agent can behave in unexpected ways if not configured properly.

Woman Sues Flock & Local Police After Being Falsely Accused of Crime

A woman in Colorado, Chrisanna Elser, is suing surveillance company Flock and the local police after she was served a criminal summons accusing her of a package theft. Police Sgt. Jamie Milliman reported tracking Elser's car using Flock cameras after a package was reported stolen. He determined Elser to be the thief since her car had been seen in the area around the time of the theft. However, Elser provided evidence that she was nowhere near the house that the package had been stolen from, and door camera footage of the theft showed that the thief did not resemble Elser. Read the full story at ABC News.

The Bottom Line: Flock's automated license plate readers are not infallible. Even if they weren't already a massive violation of privacy, they can lead to false arrests. If you feel strongly one way or the other about Flock, you can voice your opinions to your local representatives. In some jurisdictions, the thoughts and concerns of citizens can affect policy.

Is "123456" a Safe Password?

Did you know one bad password used by an IT Company compromised the security of over 8 million people? A data breach at Denmark's Central Register of Persons (CPR) exposed the personal information of over 8 million people. The person responsible for the hack claims they accessed the data through the account of an IT company servicing the CPR, whose password was "123456." The person says that the CPR's administrator account uses the same password. The hacker says they have no intention of selling or leaking the data that was stolen. Head over to The Register for the full story.

The Bottom Line: This story is yet another example demonstrating the importance of using a password manager. Using a password as simple as "123456" almost sounds like a good password since it's so obvious that no one would ever think to check it, but it's actually one of the most common passwords and any password cracking program can guess it in seconds. A password manager can create a unique, secure password and will even remember it for you so that you don't have to. If you need help picking a password manager, we've got you covered. If you're already using a password manager, keep on using it, whether it's Apple Passwords, Bitwarden, 1Password, LastPass, NordPass, or another one that I haven't named here!

OpenAI Employee Consults with Chatbot to Spy on Executives

An engineer at OpenAI hid a recording device in an executive meeting room. The employee planned his surveillance sting over the course of several weeks with assistance from an AI agent. The device was supposedly placed behind a monitor back in September. OpenAI alerted the FBI upon discovering the device, and the employee is now facing up to five years in prison as a result of this stunt. FBI director Kash Patel says that the employee was attempting to record information about how the company's AI technology works. Beyond that, no motive has been made public. Check out the full story at Wired.

The Bottom Line: Consulting with AI for planning a data heist is maybe not the smartest move. Not only can artificial intelligence make mistakes, but also, it leaves a paper trail. AI is not private and the vast majority of AI companies will hand your records over to law enforcement willingly.

• The most recent iOS and iPadOS is 27.0.1
• The most recent macOS is 27.0.1
• The most recent tvOS is 27
• The most recent watchOS is 27.0.1
• The most recent visionOS is 27.0.1

Read about the latest updates from Apple.

The correct answer is B. Double-check the sender to see if the email is from Apple. More than likely, this is a scammer trying to steal your login information for your Apple Account and if you check the sender's email, you're likely to find that the email address is not one associated with Apple (emails from Apple originate from an @email.apple.com address), in which case you can just delete the email and report it as spam. Clicking the link will probably send you to a malicious website, while calling the phone number connects you to a scammer who will try to convince you to hand over your login or banking details. If you're worried that your account might actually be compromised, you can go to Apple.com and chat with a support agent to verify the security of your account.

There is far too much security and privacy news for us to cover it all. When building this newsletter, we look for scams, hacks, trouble, and news to illustrate the kinds of problems Apple enthusiasts may encounter in our private lives, and the self-defense we can practice to keep our devices, accounts, and lives secure. Our commentary focuses on practical advice for everyday people. This newsletter was written by Rhett Intriago and edited by August Garry and Cullen Thomas.

Worried about your iPhone being infected with a virus? Check out:

• Answered: Can iPhones Get Viruses?
• Protect an iPhone with Lockdown Mode