After “Mother of All Breaches,” Update Passwords on Compromised Sites

/in , , , , , /by

January’s big security news was the Mother of All Breaches, the release of a massive database containing 26 billion records built from previous breaches across numerous websites, including Adobe, Dropbox, LinkedIn, and Twitter. It’s unclear how much of the leaked data is new, but it’s a good reminder to update your passwords for accounts on compromised sites, especially those you reused on another site. Cybernews has a leak checker that reports which breached sites include your data. More generally, password managers often have a feature that checks your passwords against the Have I Been Pwned database of breaches and helps you change compromised passwords—1Password’s is called Watchtower, shown below. You can also search Have I Been Pwned directly. Don’t panic if your email address appears in numerous breaches because some of the theoretically compromised accounts may be defunct sites, trivial sites you used once 10 years ago, or duplicate password manager entries for a site whose password you already updated.

(Featured image by iStock.com/Prae_Studio)

Annoyed by Inline Predictive Text Suggestions? Here’s How to Turn Them Off

/in , , , , , /by

In a slight nod to the hype surrounding generative AI, Apple added inline text prediction capabilities to the iPhone, iPad, and Mac. They can be helpful, particularly on the iPhone and iPad, where it’s often much easier to tap the Space bar than to finish typing a word or sentence. But that’s less true on the Mac, where a fast typist can be slowed down or derailed by the suggestions, and some people dislike having an AI finish their thoughts. The feature is easily turned off. On the iPhone and iPad running at least iOS/iPadOS 17.2, go to Settings > General > Keyboard and switch off Show Predictions Inline. (Leave Predictive Text on to continue to get suggestions above the keyboard.) On the Mac running macOS 14.2 Sonoma or later, open System Settings > Keyboard, click Edit under the Text Input header, turn off “Show inline predictive text,” and click Done.

(Featured image based on an original by iStock.com/Armastas)

Use iOS 17.3’s Stolen Device Protection to Reduce Harm from iPhone Passcode Thefts

/in , , , , , /by

Last year, a series of articles by Wall Street Journal reporters Joanna Stern and Nicole Nguyen highlighted a troubling form of crime targeting iPhone users. A thief would discover the victim’s iPhone passcode, swipe the iPhone, and run. With just the passcode, the thief could quickly change the victim’s Apple ID password, lock them out of their iCloud account, and use apps and data on the iPhone to steal money, buy things, and wreak digital havoc.

In essence, Apple allowed the passcode, which could be determined by shoulder surfing, surreptitious filming, or social engineering, to be too powerful, and criminals took advantage of the vulnerability. It’s best to use Face ID or Touch ID, especially in public, but some people continue to rely solely on the passcode.

Apple has now addressed the problem for iPhone users with the new Stolen Device Protection feature in iOS 17.3. It protects critical security and financial actions by requiring biometric authentication—Face ID or Touch ID—when you’re not in a familiar location like home or work. The most critical actions also trigger an hour-long security delay before a second biometric authentication. We recommend everyone who uses Face ID and Touch ID turn on Stolen Device Protection. The feature is not available for the iPad or Mac, but neither is as likely to be used in places like the crowded bars where many iPhones have been snatched.

How Stolen Device Protection Works

The location aspect of Stolen Device Protection is key. When you’re in a “significant location,” a place your iPhone has determined you frequent, you can do everything related to security and financial details just as you have been able to in the past, including using the passcode as an alternative or fallback.

However, when you’re in an unfamiliar location, as you would likely be if you were out in public where someone might steal your iPhone, Stolen Device Protection requires biometric authentication to:

  • Use passwords or passkeys saved in Keychain
  • Use payment methods saved in Safari (autofill)
  • Turn off Lost Mode
  • Erase all content and settings
  • Apply for a new Apple Card
  • View an Apple Card virtual card number
  • Take certain Apple Cash and Savings actions in Wallet (for example, Apple Cash or Savings transfers)
  • Use your iPhone to set up a new device (for example, Quick Start)

Some actions have even more serious consequences, so for them, Stolen Device Protection requires biometric authentication, an hour security delay—shown with a countdown timer—and then a second biometric authentication. The delay reduces the chances of an attacker forcing you to authenticate with the threat of violence. You’ll need to go through the double authentication plus delay when you want to:

  • Change your Apple ID password (Apple notes this may prevent the location of your devices from appearing on iCloud.com for a while)
  • Sign out of your Apple ID
  • Update Apple ID account security settings (such as adding or removing a trusted device, Recovery Key, or Recovery Contact)
  • Add or remove Face ID or Touch ID
  • Change your iPhone passcode
  • Reset All Settings
  • Turn off Find My
  • Turn off Stolen Device Protection

There are a few caveats to keep in mind:

  • The iPhone passcode still works for purchases made with Apple Pay, so a thief could steal your passcode and iPhone and buy things.
  • Although Apple says it’s required, you can turn off Significant Locations to require the extra biometric authentication and security delay everywhere. That would eliminate the worry about a thief using Significant Locations to go to your most recent familiar spot in an attempt to sidestep the extra authentication.
  • If you plan to sell, give away, or trade in your iPhone, make sure to turn off Stolen Device Protection first. Once it’s out of your physical control, no one else will be able to reset it.

Turn On Stolen Device Protection

Before you get started, note that Apple says you must be using two-factor authentication for your Apple ID (everyone should be anyway), have a passcode set up for your iPhone (ditto), turn on Face ID or Touch ID, enable Find My, and turn on Significant Locations (Settings > Privacy & Security > Location Services > System Services > Significant Locations), although this last one doesn’t actually seem to be required.

Then, go to Settings > Face ID/Touch ID & Passcode, enter your passcode, and tap Turn On Protection. (If it’s enabled, tap Turn Off Protection to remove its additional safeguards.)

Once Stolen Device Protection is on and you’re in an unfamiliar location, the actions listed above will require either biometric authentication or two biometric authentications separated by the hour-long security delay.

There is one group of people who should not turn on Stolen Device Protection: those for whom Face ID or Touch ID don’t work. Most people have no trouble with Apple’s biometric technologies, but some people have worn off their fingerprints or have other physical features that confuse Touch ID or, less commonly, Face ID.

If that’s you, stick with our general recommendation for discouraging possible iPhone thefts: Never enter your iPhone passcode in public where it could be observed.

(Featured image by iStock.com/AntonioGuillem)

You Can Now Have Zoom Meetings on an Apple TV

/in , , , , , /by

When Apple introduced tvOS 17 last September, an eagerly awaited feature was its support for FaceTime calls, using Continuity Camera on an iPhone or iPad to equip an Apple TV with the necessary camera and microphone. FaceTime on the Apple TV requires a second-generation Apple TV 4K or later and an iPhone running iOS 17 or an iPad running iPadOS 17.

The feature works pretty well. Setting up Continuity Camera is simple—you launch the FaceTime app on the Apple TV, select your user profile, confirm on the iPhone or iPad, and then position the iPhone or iPad in landscape orientation so the rear camera faces you. You can start FaceTime calls from the Apple TV or move a call in progress from an iPhone or iPad to the Apple TV. The video quality is excellent, the audio is surprisingly good even across the room, and Center Stage zooms and pans to keep you in the picture. You can also add reactions like hearts and fireworks with hand gestures. Or not.

But that’s not what we’re here to talk about today. Apple also said that other videoconferencing apps like Zoom and Webex would be coming to the Apple TV, which could make the Apple TV a compelling addition to offices and conference rooms everywhere. It’s also perfect for joining Zoom-based exercise classes or community meetings from the comfort of your living room. In December 2023, Zoom was the first out of the gate, shipping its Zoom for Home TV app for tvOS 17.

With Zoom available, the Apple TV becomes an interesting option for businesses and organizations that want to display video meetings on a large screen. In the past, it was possible to use AirPlay to share an iPhone or iPad screen to an Apple TV, but it was difficult to position the iPhone or iPad effectively, and there was no way to use the higher-quality rear-facing camera.

To get started, launch the Zoom app on the Apple TV. It first prompts you to connect your iPhone via Continuity Camera. Select the Apple ID account that matches the one logged in on the iPhone, bring the iPhone close, tap the notification that appears, and tap Accept. Then, turn the iPhone around and set it down on the base of the TV with the rear camera facing you.

Next, you’ll be prompted to pair it with your account, which you can do most easily by navigating to https://zoom.us/pair on another device and entering a code.

Once you’re connected to your account, you can create a new meeting or join an existing meeting.

Here’s where things get tricky. It’s easy to start a meeting—select New Meeting on the main screen—but inviting people is more arduous. Starting from the Contacts screen or choosing Invite from the More pop-up menu requires that you laboriously enter an email address to invite someone via email. Instead, we recommend that you first add people on the Personal Contacts screen in your account on the Zoom website. After that, you can select several people and invite them to the meeting. Unfortunately, in our testing, the email invitations didn’t always arrive.

The remaining option is to swipe up on the clickpad during a meeting to select the green shield button in the upper-left corner. That displays the meeting details, and a Join by Laptop button (the second screenshot below) shows the necessary URL, meeting ID, and passcode to share in another channel, like Messages or the phone. There’s no other way to share a link to a meeting that we could find.

Joining someone else’s meeting is difficult. Most Zoom meetings are shared via a link, and once you click or tap it in email, Messages, a calendar event, or on a website, the meeting starts. The Apple TV breaks that model—there’s no apparent way to load a Zoom link. FaceTime sidesteps this limitation by making it easy to move a call from the iPhone to the Apple TV—just put the iPhone close to the Apple TV, and a notification will suggest the move. Zoom offers no such option.

Instead, to join a Zoom call, you must manually enter the meeting ID and passcode. If you’ve been sent only the link, you’ll have to request the passcode separately (the numeric meeting ID can be extracted from the URL). Entering characters with the Siri Remote is slow and awkward, so we recommend using Siri, which recognizes spoken numbers well (hold down the Siri button on the side of the remote). You could also use an iPhone or iPad as a remote control for the Apple TV since you can type more effectively or use copy and paste on those devices. But if you’re already using your iPhone for Continuity Camera, for instance, you’ll need another device. Zoom does provide a Meeting History, which is helpful for recurring meetings, but you must still enter the passcode each time.

Once you start a call, touch the clickpad on the Siri Remote to display the Zoom menu at the bottom of the screen. You can then navigate using the clickpad (press the center to activate the selected command) and the Back button. Available options let you mute yourself, turn your video off and on, switch between the usual Zoom views, display Zoom reactions, manage participants, invite more people, turn on captions, and control the Continuity Camera video effects (Center Stage, Portrait Mode, and Apple’s gestural Reactions). Center Stage does an excellent job of following you around as you move. Portrait Mode just makes the background a little fuzzy; it’s not a strong effect. If you press the Back button to leave the Zoom app, your video pauses for others on the call.

Two common Zoom actions don’t translate fully to the Apple TV: chat and screen sharing. Incoming chat messages appear on the Apple TV in the corner, but only for 6 seconds, and longer messages are truncated after a handful of lines. There’s no way to keep them onscreen longer or get back to them. There’s no way to reply to chat messages. Zoom on the Apple TV does provide an option to share the screen, but that’s the screen of another device—there’s no app or desktop to share on the Apple TV, and no, you can’t share video.

Overall, the Zoom app for Apple TV feels like a 1.0. Most of the features that make sense are present, but fully adapting to a platform that lacks a keyboard or any way to follow links will take Zoom some time. If the company could add the capability to move an in-progress call from an iPhone or iPad to an Apple TV as FaceTime can, that would help a lot. Another possible concern is the need to have the Apple ID on the Apple TV match the one on the iPhone—all the possible logins could get confusing in a larger office.

Regardless, Zoom on the Apple TV works well enough to try out. Just make sure to run through the initial setup well before your meeting is due to start.

(Featured image based on an original by iStock.com/gorodenkoff)

Help! My Account Has Been Hacked—What Should I Do?

/in , , , , , /by

How would you realize that one or more of your Internet accounts—email, social media, financial—have been hacked? (Some prefer the terms “compromised” or “breached”—you may hear them from support techs.) Unfortunately, there’s no telltale warning sign because “hacked” could mean any number of things. Here are some possible indications:

  • People you trust report receiving email that you didn’t send.
  • Social media friend requests are made to people you don’t know, or messages you don’t recognize are sent from your account.
  • Although you’re certain you have the correct password, you can’t log in to an account.
  • You become aware of your personal data appearing in places it shouldn’t.
  • Unknown charges or transfers appear in a bank or credit card account.

However, attackers will also try to fool you into thinking an account has been compromised to get you to enter passwords or financial information on a website designed to steal data. Don’t assume you’ve been hacked just because you received a phishing email saying so or because you see unexpected notifications claiming your computer is infected. No legitimate entity will ever send such email, and the only notification about malware you should ever see would come from anti-malware software you installed.

(Speaking of malware, dealing with that is a topic for another day—we’re focusing on online accounts in this article. Nonetheless, if one of your accounts has been compromised, it’s also worth scanning your Mac with the free version of Malwarebytes or VirusBarrier Scanner, just in case.)

First off, don’t panic. It’s important to take a deep breath, document everything you see with screenshots (press Command-Shift-5), and move quickly to regain control over whatever accounts were hacked and prevent others from falling prey to the attacker.

When you suspect an account has been compromised, try to verify the problem. Do the following:

  • Alert techs: If the account in question is for work, immediately alert your IT department and follow their instructions. If it’s a personal account, contact us. Tell whoever is helping you that you have screenshots you can send and be ready to forward any suspicious messages you have as well.
  • Gather evidence: Ask the person who told you about the problem to forward the message they received to another of your email addresses, or to a close friend or family member so you can see what’s being said in your name. Scrutiny of the fake message may reveal information about what has happened, though you may need help from someone with more technical experience.
  • Examine email: Since email account breaches are the most concerning (because they can be used to reset passwords elsewhere), scan your email for messages you didn’t send or replies to such messages. Along with the Inbox, look in the Sent mailbox and the Trash. Also, check your settings and filters to ensure incoming messages aren’t being forwarded elsewhere and then deleted.
  • Check social media: Connect to all your social media accounts—even those you don’t use regularly—and look for posts, friend requests, messages, or anything else that suggests an attacker has been impersonating you.
  • Audit accounts: Log in to important accounts and look for suspicious activity, such as login attempts from unfamiliar locations or IP addresses or changes to account settings.

If you find evidence to suggest that one or more of your accounts have been compromised, follow these steps:

  • Immediately change the passwords for any affected accounts. We always recommend using a password manager like 1Password to generate strong, random passwords.
  • Whenever possible, turn on two-factor authentication.
  • If available for the account in question, follow advice from the service. Apple, Facebook, Google, Instagram, Microsoft, and Twitter all have advice on how to respond, as will many other companies.
  • Review account settings for unauthorized changes, especially recovery options like backup phone numbers and email addresses.
  • Look through your accounts in your password manager and change the passwords for the most important ones and any that might be related.
  • If you can’t get into an account because the password has been changed, make sure you have sole control of your email account and then trigger a password reset.
  • For affected financial accounts, along with changing the password, immediately call the institution and ask for their help locking the account to prevent any transfers.
  • If your email account was used to send phishing messages to contacts, you should alert any friends, family, and colleagues who might have received the messages that your account was hacked and that the previous message wasn’t from you.

Security breaches are stressful, we know, but it’s imperative that you deal with them right away. The longer you wait, the more damage the attacker can cause, including stealing your money, impersonating you, scamming your friends and family, and compromising your employer’s systems. We’re here to help.

(Featured image by iStock.com/PUGUN SJ)