Security, for Family and Friends
Written in collaboration with Claude.
Computer passwords date to around 1961, when MIT's Compatible Time-Sharing System needed a way to keep a few dozen researchers out of each other's files. The idea has held up remarkably well for something designed for that setting. It is now asked to protect bank accounts, medical records, and family photos for billions of people, against adversaries with access to some of the most capable software ever written.
But, every so often the defaults have to change. In the early 2000s, most people learned to distrust email attachments. In 2015, American banks moved from magnetic stripes to chip cards, because stripe fraud had become too common to tolerate. In 2018, Google Chrome began labeling unencrypted websites as "not secure," and within a few years nearly every site had switched. Each of these shifts was briefly annoying and then unremarkable.
We are at the start of another one. Over the past year, AI systems have become good at two things that matter for ordinary security. They can find bugs in software faster than people can, and they can imitate people well enough to fool family members on the phone. None of this calls for panic. But it does mean that some habits and settings designed for an earlier period need updating.
This piece is written for my family and friends who have been asking me what they should be doing to keep themselves secure in today's world. It describes what has changed, walks through a few steps that address most of the new risk, and covers what to do if something goes wrong anyway. The steps take a few hours in total, and most only need to be done once.
What changed
On October 21, AI tools found serious flaws in PHP, software that runs a large share of the web, and fixes were released the same day. Node.js, another widely used platform, patched several flaws around the same time. Separately, attackers inserted password-stealing code into LiteLLM, a popular open-source tool for AI developers.
Almost none of this requires anything from us directly. These are problems for the companies that run servers, and they are being fixed. What reaches ordinary people is indirect. Bugs are found and exploited faster than before, so devices that are slow to update are more exposed. More stolen passwords are in circulation, which matters for anyone who reuses them.
The second change is more personal. Voice cloning has become cheap and good. A few seconds of audio from a video or voicemail greeting is enough to produce a voice that can hold a live conversation. Caller ID can be set to display any number. The FBI's most recent Internet Crime Report was the first to track AI-related fraud as its own category, recording 22,364 complaints and about $893 million in losses.
The practical consequence is that a familiar voice on the phone, or a well-written email from your bank, is weaker evidence than it used to be. Scams were once detectable by their poor quality. Increasingly, they have to be detected by their circumstances.
What to do
The steps below are ordered roughly by how much protection they give per minute spent. The first two matter most. If you only do those, you will have addressed the most common ways people lose money.
1. Family safe word
The "grandparent scam" predates AI by decades. This happened to my grandmother while I was still in college (luckily Grandma is extremely savvy and asked a few pointed questions that uncovered the scam). Someone calls an older relative, claims to be a grandchild in trouble, and asks for money to be sent quickly and quietly. It used to depend on a bad phone line and a worried listener filling in the gaps. Voice cloning removes the need for either. The caller can now sound exactly like the person they claim to be, and a second voice often joins to play a lawyer or police officer.
Asking personal questions helps less than you might expect, since a lot of family detail is findable online and current tools respond in real time. Caller ID can show any number, including one saved in your phone.
The simplest defense is a word or phrase that only our family knows. A scammer can copy a voice, but has no way to learn a word that has never been written down online. The FBI recommends this, and it costs nothing.
To set it up:
- Choose the word together in person, or on a call you placed yourself. Don't send it by text or email.
- Avoid anything that could be found or guessed, such as a pet's name, a street, a birthday, or a sports team.
- Don't store it anywhere online, including notes apps on your phone or computer.
To use it:
- If anyone calls about an emergency and asks for money, ask for the word.
- If they don't know it, get it wrong, or say they're too upset to remember, hang up.
- Call the person back on the number saved in your phone. If they don't answer, call someone else in the family.
Taking five minutes to check won't make a real emergency worse. If the word is ever shared outside the family, we'll choose a new one.
2. 1Password
Most account takeovers don't involve anyone guessing a password. Companies are breached regularly, and the stolen lists of emails and passwords are sold and shared. Attackers then try each pair on other sites, such as email, banks, and Amazon. The practice is called credential stuffing. It is fully automated and has been for years.
The weakness it exploits is reuse. If the same password protects a small shopping site and your email, a breach at the shopping site exposes your access to your email. From your email, most other passwords can be reset.
The remedy is a different password for every site. Nobody can remember dozens of random strings, so a password manager does it instead. You remember one master password. The app generates a long random password for each site, stores it, and fills it in when you sign in.
Two side effects are worth knowing about. First, it only fills a password on the website it was saved for, so if you land on a convincing fake of your bank's site, 1Password won't offer to fill in anything. That is often the earliest sign that something is off. Second, its Watchtower feature checks your saved passwords against known breaches and flags any that are weak or reused.
I recommend 1Password because it works on iPhone, Android, Mac, and Windows. My own family plan is full, so you'll need to set up your own account. An individual plan costs a few dollars a month. A Families plan covers up to five people and costs roughly $5 to $8 a month in total, and its organizer can help a member regain access if they forget their master password. I'm happy to walk anyone through setup.
To set it up:
- Sign up at 1password.com and choose Individual or Families.
- Install 1Password on your phone and your computer.
- Create a master password. Four or five unrelated words work well, for example maple-tractor-violin-sunset. Write it on paper and keep it at home.
- Print the Emergency Kit the app offers and store it with your other important documents. On an individual plan, nobody can reset a forgotten master password for you, so this kit is your way back in.
- Add your email, bank, and phone carrier logins first. Most sites send password resets to your email and sign-in codes to your phone, so someone who controls either can get into nearly everything else.
- Turn on autofill when the app prompts you.
- Over the next few weeks, save other logins as you use them. When 1Password's Watchtower flags a reused password, change it.
3. Passkeys
Phishing is the practice of sending someone to a fake copy of a real website in order to collect their password. For a long time it was easy to spot, because the emails were clumsy and the pages looked slightly wrong. AI has largely closed that gap. A phishing email can now be well written, personalized, and sent to millions of people at almost no cost.
The structural problem is that a password is a secret you type into whatever page asks for it. Passkeys were designed to remove that step. They were developed by the FIDO Alliance, a group that includes Apple, Google, and Microsoft, and began appearing widely in 2022.
When you create a passkey, your phone or computer stores a digital key tied to one specific website. To sign in, you confirm with your face, fingerprint, or device PIN, and the device handles the rest. You never see or type the key, so there is nothing to hand over. The key also won't work on any other site, however similar it looks. A fake login page receives nothing useful.
Many companies now treat passkeys as the default way to sign in.
Where to start:
- Google: go to myaccount.google.com, then Security, then Passkeys and security keys, then Create a passkey.
- Microsoft: go to account.microsoft.com, then Security, then Manage how I sign in, then Add a passkey.
- Apple: if two-step sign-in is on for your Apple Account, this is already done.
- Everything else: when a site offers to create a passkey, accept. If 1Password asks to save it, let it, so the passkey works on all your devices.
Keep the old password saved in 1Password. Some sites still ask for it occasionally.
4. Two-step sign-in
Many sites don't support passkeys yet, including some banks and brokerages. For those, two-step sign-in (also called two-factor authentication, or 2FA) is the next best protection. With it turned on, signing in takes your password plus a second confirmation from a device you carry. Someone who has stolen your password still can't get in without that device.
Sites usually offer several methods, and they aren't equally strong. From strongest to weakest:
- A passkey or a physical security key.
- An authenticator app, which generates a six-digit code that changes every 30 seconds. 1Password can do this. The code is created on your phone and never sent over the phone network.
- A notification from the company's own app asking you to approve the sign-in. This is also independent of your phone number. Its weakness is that people approve prompts out of habit, so only tap Approve when you have just started signing in yourself.
- A code sent by text message. This is better than nothing, but texts can be intercepted if someone takes over your phone number (see step 6). Use it only when nothing else is offered.
What each method protects against:
| Method | Fake login page | Stolen phone number |
|---|---|---|
| Passkey or security key | Protected | Protected |
| Authenticator app code | Not protected | Protected |
| App notification | Not protected | Protected |
| Text message code | Not protected | Not protected |
If a site asks when to verify, choose "always" rather than "only on new devices."
Turn two-step sign-in on first for your email, since email is used to reset everything else. Then do your bank, credit cards, and retirement accounts. The setting is usually under Security or Sign-in settings.
One scam is worth knowing in detail. Someone calls claiming to be from your bank's fraud department and says they need to verify your identity. They ask you to read back a code they've just sent. The code is actually a sign-in code for your account, and they are signing in as you while you're on the phone. Your bank will never ask for one of these codes. If anyone does, hang up and call the number on the back of your card.
While you're in the security settings, set up account recovery:
- Apple: add a family member as a Recovery Contact (Settings, your name, Sign-In & Security, Account Recovery).
- Google and Microsoft: check that your recovery phone number and email are current.
- Save any backup codes in 1Password.
5. Automatic updates
This is the step most closely tied to this month's news. When a flaw is found in widely used software, the maker publishes a fix. The fix also tells attackers what was broken, and they start looking for devices and servers that haven't installed it yet. For most of the history of personal computing, that gap lasted weeks or months. AI is making it shorter, both because flaws are found faster and because the work of exploiting them is easier to automate.
The good news is that the defense is unglamorous and already built into every modern device. Updates are how fixes arrive. With automatic updates turned on, you receive them without having to remember.
How to turn them on:
- iPhone and iPad: Settings, General, Software Update, Automatic Updates. Turn every option on.
- Android: Settings, System (or Software update), then enable automatic downloads. In the Google Play Store, turn on auto-update for apps.
- Mac: System Settings, General, Software Update, Automatic Updates. Turn every option on.
- Windows: Settings, Windows Update. Leave updates on and restart when prompted.
- Web browsers: Chrome, Safari, and Edge download updates on their own but only finish installing when restarted. Close and reopen your browser every so often.
- Wi-Fi router: open the maker's app and turn on automatic firmware updates. A router more than about five years old may no longer receive updates and is worth replacing.
Two related habits: use a screen lock on every phone and tablet, and only install apps from the App Store or Google Play.
6. Phone number lock
Phone numbers were never meant to be security credentials. They became one gradually, as companies started texting codes to confirm sign-ins and password resets. As a result, controlling someone's number now gives you access to a surprising number of their accounts.
The usual method is a SIM swap. A scammer contacts your mobile carrier, pretends to be you, and asks to move your number to a new SIM card or a different carrier. They often have personal details from earlier data breaches, which helps them pass the carrier's checks. If it works, your phone loses service and their phone starts receiving your calls and texts, including sign-in codes.
Carriers now offer two settings that prevent this:
- An account PIN or passcode, which the carrier requires before making changes to your account.
- Number lock, sometimes called port-out protection, which blocks any transfer of your number until you turn it off yourself.
Open your carrier's app, or call customer service, and ask for both. Save the PIN in 1Password.
If your phone suddenly shows No Service or SOS while you're somewhere with normal coverage, call your carrier from another phone right away.
7. Credit freeze
A large share of American adults have had their name, address, birthdate, and Social Security number exposed in one breach or another. That information is enough to apply for a credit card or loan in someone else's name. There isn't much any of us can do about the information already being out there. We can make it much less useful.
Before approving new credit, a lender checks your credit report with one or more of the three credit bureaus: Equifax, Experian, and TransUnion. A credit freeze tells the bureaus not to share your report with new lenders, so applications made in your name are denied. Freezes have been free nationwide since 2018.
A freeze has no effect on your credit score or on cards and loans you already have. When you want to apply for credit yourself, you can lift it online, usually within minutes, and put it back afterward.
To set it up:
- Create an account and place a freeze at each bureau: Equifax, Experian, and TransUnion. Each takes about ten minutes.
- Save each login in 1Password.
- Before applying for a loan, a card, or sometimes an apartment, lift the freeze. Put it back once the application is done.
One thing to watch for while signing up. The bureaus also promote a "credit lock," which does nearly the same job as a freeze but is a paid product. Experian and TransUnion charge a monthly fee for theirs. The freeze is free by law and is all you need, so choose it and skip any lock or credit monitoring offer.
Each adult needs to do this separately, including spouses.
Recognizing scams
The steps above handle most technical attacks. Scams that work through conversation are harder, because they rely on persuading a person rather than breaking a system. AI makes the persuasion more convincing, but the underlying structure of a scam has changed very little. Nearly all of them share a few features.
- The contact is unexpected, and it comes from them.
- There is a reason you must act immediately.
- There is often a reason not to tell anyone, such as a family member, your bank, or the police.
- And payment is requested in a form that is hard to reverse: gift cards, wire transfers, cryptocurrency, or cash handed to a courier.
Any one of these is grounds for suspicion. When several appear together, it is almost certainly a scam.
The most reliable response is to end the conversation and start a new one yourself. Hang up, then call back using a number you already have, such as the one saved in your phone or printed on your card. Scammers can fake the number on an incoming call, but they can't intercept a call you make to a number you already trust.
A few specific rules are also worth remembering. No government agency, including the IRS, Social Security, and Medicare, demands payment over the phone. No legitimate company will ask you to move money to a "safe account." And you should never let someone who contacted you take remote control of your computer.
For parents and grandparents
Older adults are targeted more than anyone else. The reasons are mostly practical. You are more likely to answer calls from unknown numbers, and more likely to have savings.
The most useful thing you can do is call someone else in the family before sending money or clicking a link you're unsure about. You won't be bothering anyone. We would much rather take ten calls about things that turn out to be fine than miss the one that wasn't.
Two settings help a lot. On an iPhone, turn on Silence Unknown Callers (Settings > Apps > Phone). On Android, turn on Call Screen. Calls from numbers not in your contacts will go to voicemail, and people who actually need to reach you will leave a message. It is also worth adding one of our family members as a trusted contact at your bank, so the bank has someone to call if it notices something unusual.
If any of the steps in this piece feel like a chore, I would love to do them together. It takes about an hour.
If something goes wrong
Scams succeed against careful, intelligent people every day. If one reaches you, the most important thing is to act quickly, because money and accounts are much easier to recover in the first few hours.
- Stop responding to the scammer. Don't send more money to resolve the problem.
- Call your bank using the number on the back of your card and ask them to stop or reverse the payment. For gift cards, call the number on the back of the card.
- Change your email password, then your bank passwords, and sign out of other devices from your account settings.
- Call me!
- Report it at ReportFraud.ftc.gov and IC3.gov. If your identity was stolen, IdentityTheft.gov provides a step-by-step recovery plan.
A last note
Security advice tends to go stale. Settings move, new methods appear, and scammers adapt. My guess is that in a few years, passkeys and safe words will seem as ordinary as chip cards do now. In the meantime, if a setting has moved or something here is unclear, feel free to text or call me and I'd love to help.