CyberGuard Tips

Smart doorbells and indoor cameras have become one of the most common purchases in home security — useful for catching package thieves, checking in on pets, or seeing who's at the door before opening it. But every one of these devices sends footage somewhere outside your home, and very few owners actually know who can watch that footage besides them. The answer is often more people than you'd expect: the manufacturer, third-party contractors, law enforcement, and sometimes even your neighbors. Where Your Footage Actually Goes Unlike a traditional CCTV system that records to a local hard drive in your house, most smart doorbells and cameras (Ring, Nest, Blink, Wyze, and similar) upload video to the manufacturer's cloud servers by default, especially if you've paid for a cloud storage subscription to access clip history. That footage doesn't just sit there for your eyes only — several categories of people can potentially access it: The company's employees, f...

Password managers exist to solve one problem: remembering dozens of unique, strong passwords is impossible for a human brain, so you put them all in one encrypted vault instead. That design is sound — but it also means a breach at the password manager company itself is one of the worst-case scenarios in personal cybersecurity. It has already happened to major providers, and when it does, knowing exactly what to do in the first 24 hours matters more than almost anything else you'll read on this site. This isn't a reason to stop using a password manager — the alternative (reusing passwords everywhere) is far riskier. It's a guide for the moment your provider sends that breach notification email. What Actually Gets Exposed in a Vault Breach Reputable password managers use zero-knowledge, end-to-end encryption: the company itself cannot read your stored passwords, because your vault is encrypted and decrypted locally using a key derived from your master password, which the...

You check into your Airbnb, unpack your bags, and everything looks normal. But every year, thousands of guests discover they were being watched the entire time by a camera hidden in a smoke detector, an alarm clock, a wall outlet, or a stuffed animal on the shelf. Hidden camera complaints against short-term rental hosts have become common enough that Airbnb now has a dedicated policy banning indoor cameras entirely — yet hosts keep installing them anyway, and hotels aren't immune either. The good news is that finding a hidden camera doesn't require expensive equipment or special training. A few minutes of deliberate checking when you arrive can tell you whether the room is actually private. Why This Keeps Happening Spy cameras are cheap, tiny, and sold openly online disguised as everyday objects: USB chargers, smoke detectors, screws, picture frames, and even fake water bottles. Many run on Wi-Fi and stream footage to an app in real time, or record to a hidden microSD card...

Relationships create shared digital access almost invisibly. A password typed in front of someone, a phone whose passcode both of you know, a streaming account, a shared location, a family plan, a recovery phone number set years ago. None of it feels like a security decision at the time. After a breakup, all of it is still live, and untangling it is not a matter of trust — it is basic account hygiene that most people never do. This is a practical checklist. Work through it in order, because some steps only hold once earlier ones are done. If you are leaving a relationship that involved control, monitoring, or abuse, read the safety note at the end first, because the order changes. Why This Matters More Than People Think The risk is not usually dramatic. It is quiet and persistent: a former partner who still sees your location because a family sharing setting was never turned off, who receives your password reset emails because their address is still your recovery contact, or who c...

Buying second-hand hardware is one of the smartest financial decisions you can make. A two-year-old flagship phone costs a third of its launch price and does everything you need. But a used device is not like a used sofa: it can arrive still carrying the previous owner's account locks, an unpatched operating system that will never receive another security update, or software deliberately installed to watch you. This is a checklist for the security side of that purchase — what to verify before you hand over money, and what to do in the first hour after you get the device home. The Three Real Risks Most guides to buying used devices worry about scratches and battery health. Those matter, but they are not what will hurt you. The device is stolen or account-locked Modern phones and laptops tie themselves to an account. An iPhone still linked to someone's Apple Account is unusable to you. Android devices have Factory Reset Protection. Windows laptops can carry a BIOS or firmw...

Most people know to watch their bank statements and credit reports. Almost nobody checks their medical records. That gap is exactly why medical identity theft is one of the most damaging and least detected forms of fraud: it can drain your insurance benefits, saddle you with bills for treatment you never received, and — uniquely among identity crimes — put false information into the file doctors use to treat you. Health records sell for far more on criminal markets than credit card numbers, because they contain everything needed for sustained fraud: name, date of birth, national insurance or Social Security number, address, insurance policy details, and often financial data. Here is how the fraud works and how to detect and unwind it. What Medical Identity Theft Looks Like Someone uses your identity or insurance details to obtain healthcare. In practice that means one of several patterns: Treatment fraud. An uninsured person uses your insurance card or policy number to get ca...

The single most exploited weakness in home computing is not a clever new hacking technique. It is the "Remind me later" button. Security researchers consistently find that the overwhelming majority of successful attacks use vulnerabilities that were patched months or years earlier — flaws with a fix already sitting on the vendor's server, waiting for someone to click install. Updating is boring, it interrupts your work, and occasionally it breaks something. Here is what is actually happening when you postpone one, how the risk window works, and how to set things up so updates stop being a decision you have to make. What a Security Update Actually Contains Software ships with bugs. Some of those bugs let an attacker do something the developer never intended — read memory they should not see, run code from a file that was supposed to be just data, escalate from a limited account to full administrator. When a researcher finds one, it is assigned a CVE identifier and re...

There is a smart speaker in roughly a third of homes in the US and UK, and a voice assistant on essentially every smartphone. The recurring worry — "is it listening to everything I say?" — has a more interesting answer than either the marketing or the conspiracy theories suggest. The honest version: these devices are always listening in a narrow technical sense, but they are not always recording . The gap between those two things is where the real privacy questions live, and it is a smaller gap than most people assume. How Wake Word Detection Actually Works A smart speaker runs a small model locally that does one job: listen for a specific acoustic pattern — "Alexa," "Hey Google," "Siri." Audio streams continuously through a short buffer on the device and is discarded moment by moment. Nothing leaves the device until that pattern matches. When it matches, the light ring or screen indicator activates and the device opens a connection to t...

You have one email address. It is on your bank account, your medical portal, forty online shops, a gym you left in 2019, and a forum you posted on once. Every one of those companies holds it, and every one of them can be breached. When that happens, the leaked address is not just a spam problem. It is the shared identifier that lets an attacker connect your accounts to one another, and the username half of every credential-stuffing attempt made against you. One address reused everywhere means one breach affects everything. Email aliases — also called masked or forwarding addresses — fix this cheaply. Instead of one address everywhere, you give each service a unique one that forwards to your real inbox. If an alias starts receiving spam, you know exactly which company leaked or sold it, and you can switch that single alias off without touching anything else. How Aliases Work An alias is a distinct address that routes to your real mailbox. The company you gave it to never lear...

Your laptop has a strong password. You assume that means your files are protected if it is ever stolen. It does not. Without disk encryption, a login password is a door on a house with no walls. Anyone who takes the machine can remove the drive, connect it to another computer, and read every file — documents, saved passwords, browser history, photographs, tax records — without ever seeing your login screen. The same is true of booting the laptop from a USB stick, which takes about two minutes and requires no specialist tools. Full-disk encryption closes that gap. It scrambles everything on the drive so that the data is meaningless without a key. It is built into Windows and macOS, it is free, and on modern hardware it costs you essentially nothing in performance. Most people simply never turn it on — or assume, incorrectly, that it is already on. What Encryption Actually Protects You From Being precise about the threat matters, because encryption is often oversold. It prot...

  You need a PDF editor, a video converter, or a copy of a tool you have used for years. You search for it, click one of the first results, download the installer, and run it. The program even works. Weeks later your bank calls about a login from another country. This is malvertising and SEO poisoning — two techniques that place criminal download pages exactly where you look for legitimate software. They do not rely on you clicking a suspicious link in an email. They rely on you searching for something completely reasonable and trusting what appears at the top. The uncomfortable part: the top of a search results page is not a ranking of trustworthiness. Part of it is an auction, and the rest can be manipulated. How the Two Techniques Work Malvertising: buying the top slot Search ads are sold at auction. Anyone with a payment method can bid on a brand name they do not own. Criminals buy ads for terms like the names of popular free tools, then point the ad at a pixel-pe...

You bought a television. What you installed was an advertising sensor that happens to display Netflix. Nearly every smart TV sold in the last decade ships with a technology called Automatic Content Recognition — ACR — that samples what is on your screen many times per second and matches it against a database to identify exactly what you are watching. Not just which streaming app. The specific show, the specific advert, the specific frame. It works on everything: cable, satellite, a games console, a Blu-ray disc, a laptop plugged into the HDMI port, even your home security camera feed if you cast it to the screen. ACR does not care about the source. It reads the pixels. This is not a secret, exactly — it is disclosed somewhere in the setup wizard, in a screen most people accept in under two seconds because it is standing between them and watching something. Here is what is actually happening, and how to switch it off on the major platforms. How ACR Works The TV takes a low-reso...