Posts

Use Guided Access for Securely Allowing Others to Use an App on Your iPhone or iPad

/in /by

iPhones and iPads are highly personal devices, but you might want to let someone else use a particular app on yours without letting them poke through Messages, Mail, and Photos. For example, a child could play a game, a volunteer could check in attendees, or a friend could take photos. To allow this, Apple created Guided Access, which you turn on in Settings > Accessibility—give it an easily remembered passcode and decide if you want to let the display auto-lock. Then, to turn on Guided Access, open the app you want to share and triple-click the side or top button. Options let you control buttons, the accelerometer, software keyboards, touch input, and a time limit. To end a Guided Access session, triple-click the side or top button, enter the Guided Access passcode, and tap End.

(Featured image by iStock.com/Userba011d64_201)

Social Media: If you’d like to allow a child, friend, or colleague to enjoy a specific app on your iPhone or iPad while keeping them focused and preventing access to everything else on the device, check out Apple’s Guided Access feature.

Watch Out for PayPal Invoice Phishing Scams

/in /by

We’ve seen an uptick in fake invoices from scammers using PayPal. Because they’re being sent through PayPal itself, spam filters won’t catch them, and they have few of the usual markers of phishing email (but look for sketchy names and email addresses at the top). Some are even forged to appear as if they come from Apple. Never pay a PayPal invoice that you can’t tie directly to something you’ve ordered, and don’t call the number listed—the scammer will try to convince you that the invoice is real. If you receive one of these invoices, click the “Report this invoice” link at the bottom to help protect others who might have received it, and forward the message to phishing@paypal.com. Don’t mark the invoice as spam, though, since that will train your email client to be suspicious of legitimate messages from PayPal.

(Featured image by iStock.com/Moostocker)

Social Media: Beware of PayPal invoice scams that might even appear to come from Apple. Should you receive one, report it to PayPal to help protect other people, but don’t mark the message as spam.

Beware Fake “Sextortion” Scams

/in /by

All those data breaches are coming back to haunt us. Once our phone numbers and addresses began to be leaked, it was only a matter of time before scammers would personalize their attacks to make them seem more real. The latest “sextortion” scams purport to have compromising video of you taken from your computer’s webcam, backing it up with your phone number and a Google Street View-like image that matches your leaked address. They make a lot of claims and dire-sounding threats, but talk is cheap, and there’s nothing behind them. Do not pay the scammers!

(Featured image by iStock.com/Thapana Onphalai)

Social Media: Scams are starting to incorporate personal information stolen in data breaches, so you may get “sextortion” threats that purport to know your phone number, address, and more.

Passwords Becomes a Real App in macOS 15 Sequoia, iOS 18, and iPadOS 18

/in /by

Although we’re still fans of 1Password, and there are plenty of other good password managers out there, like BitWarden and Dashlane, Apple has finally removed the last hurdle to using its built-in password management capabilities.

Starting in macOS 15 Sequoia, iOS 18, iPadOS 18, and visionOS 2, Passwords is now a real app rather than being trapped inside Safari, System Settings, and Settings. If you have resisted using a password manager or don’t wish to continue subscribing to an alternative, give Apple’s Passwords a try. It makes creating, maintaining, and entering passwords faster, easier, and more secure than doing it by hand. Those already using a password manager can export their accounts and import into Passwords.

What You’ll Find in Passwords

We’ll focus on the Mac version here, but the other versions are nearly identical apart from their screen sizes.

The left-hand sidebar, reminiscent of Reminders, provides categories of accounts:

  • All: Select All to see all your accounts, regardless of what shared group they may be in.
  • Passkeys: If you have any passkeys for large websites like Apple, Google, and others, they’ll appear here.
  • Codes: Passwords can create, store, and enter two-factor authentication codes for sites that support them. If you need to look one up manually because Passwords couldn’t autofill it, you’ll find the associated account here.
  • Wi-Fi: This category contains stored passwords for all the known Wi-Fi networks on your device. Because known Wi-Fi networks aren’t synced between devices, the number of these will vary between your devices.
  • Security: If you have any accounts with weak passwords, accounts you previously shared and stopped sharing, or accounts whose passwords were leaked in a security breach, they’ll appear here. Edit these accounts and click the Change Password button to start the process; when the password changes, they’ll disappear from this category.
  • Deleted: Any accounts you delete stay here for 30 days before being deleted for good. You can delete any of these accounts immediately or restore them to their previous group.
  • Shared Groups: If you use Family Sharing, you automatically get a Family Passwords group to simplify sharing important accounts with your family members. But you can also share accounts with other groups of Apple device owners. To move an account to a group, choose it from the Group pop-up menu.

The middle pane lists the accounts in the selected category. You can sort the list using the menu with vertical arrows, search for a specific account, and manually add a new one with the + button. Otherwise, scroll through the list and click an account to view it in the right-hand pane.

At the top of the right-hand pane is an AirDrop button and an Edit button. Click AirDrop to share an account with someone nearby or Edit to make changes or set up a two-factor verification code. If you want to copy information, click the User Name, Password, Verification Code, or Website item to get a Copy menu. The password becomes visible when you mouse over it. Clicking Website also offers an Open Website option and lets you add more sites where the password should autofill.

Setup Requirements

Most people shouldn’t need to do anything to start using Passwords. However, if you have trouble, check the following items:

  • Turn on Password AutoFill: If your device isn’t entering passwords for you, turn on AutoFill Passwords and Passkeys in Settings/System Settings > General > AutoFill & Passwords. Also, ensure that Passwords is enabled in the AutoFill From section if multiple password managers are installed.
  • Turn on iCloud Keychain: If you want your passwords to sync securely among your devices, which makes life a lot easier, go to Settings/System Settings > Your Name > iCloud > Passwords and turn on Sync This Device.
  • Set up iCloud Passwords for other browsers: Apart from Safari, Chromium-based Web browsers (Arc, Brave, Google Chrome, Microsoft Edge, etc.) can access and autofill your saved passwords if you install Apple’s iCloud Passwords Chrome extension. (There’s also now an iCloud Passwords add-on for Firefox.) The overall experience is not as seamless as in Safari, requiring a once-per-launch code, and you have to create new accounts in Safari or manually in Passwords, but it works.
  • Configure settings: Choose Passwords > Settings (or look in Settings > Apps > Passwords for iOS 18 and iPadOS 18) to access options. Generally speaking, it’s fine to keep them all turned on.

If you have additional questions, check Apple’s documentation for detailed instructions for all the platforms on which Passwords runs. But realistically, Passwords is easy to use, and although the app itself is new, the underlying password management features and syncing have been in place for years, so they’re stable and reliable.

(Featured image by iStock.com/designer491)

Social Media: Apple’s new Passwords app in macOS 15, iOS 18, iPadOS 18, and visionOS 2 makes the company’s longstanding password storage and syncing features more straightforward and easy to use. It’s password management for the rest of us!

Set macOS to Require a Password after Screen Saver Start or Display Sleep

/in /by

Although paying attention to online security is of primary importance, don’t forget local security. You don’t want to go out for lunch and let someone wandering by your office poke through your email, messages, photos, and private files. To ensure this doesn’t happen, set your Mac to start the screen saver or sleep the display after a few minutes (on a laptop, just close the lid), and then set “Require password after screen saver begins or display is turned off” to a short duration. We recommend 1 or 5 minutes, though you can adjust to balance inconvenience against security. To eliminate the fuss almost entirely, use Touch ID or an Apple Watch to unlock your Mac without having to type your password.

(Featured image based on an original by iStock.com/Armastas)

Social Media: Don’t forget about local security on your Mac. Make sure to require a password shortly after the screen saver starts or the display sleeps to prevent people from riffling through your email, photos, messages, and more.

No More Ransom Website Offers Ransomware Decryption Tools

/in /by

We’ve written in the past about how Apple-only companies can protect themselves from ransomware (strong security, isolated backups, monitoring software), but realistically, it’s primarily a threat to computers running Windows and Linux. If you, or anyone you know, is targeted by ransomware, look to the No More Ransom website, developed by Europol’s European Cybercrime Centre and the Dutch police, for advice and tools. The advice boils down to: “Don’t pay the ransom because it proves to the criminals that ransomware works, and there’s no guarantee it will solve your problem.” On the tools side, the Crypto Sheriff helps identify the type of ransomware in play, and No More Ransom provides decryption tools for 180 different forms and variants of ransomware. There are no guarantees, but anyone who has fallen prey to ransomware should start with No More Ransom.

(Featured image based on original by iStock.com/Suebsiri)

Social Media: Ransomware primarily affects Windows and Linux computers, but if you, or anyone you know, falls prey to it, visit the No More Ransom website for advice and decryption tools.

Be Careful When Scanning Unknown QR Codes

/in /by

QR codes, those square, blocky codes you scan with your iPhone’s camera to load a Web page, have become ubiquitous. So much so that we seldom pause before scanning any QR code we see. But if you think about it, that’s the same as clicking random links in emails or texts, which is a terrible idea from a security perspective. “Quishing” (QR code phishing) isn’t commonplace yet, but some sources say there are thousands of cases per month. To avoid falling victim to a quishing scam, only scan QR codes from trusted sources, try to verify what a code will do once scanned, and evaluate the yellow URL preview Safari provides (when using other browsers, all you see is Open in Browser Name). Finally, always install iOS security updates promptly because they often address vulnerabilities that could be exploited with malicious data.

(Featured image based on an original by iStock.com/B4LLS)

Social Media: QR codes—those blocky squares you scan with your iPhone camera—are an easy way to open a Web page. Unfortunately, scammers also use them to trick people into visiting malicious websites, so read our tip about scanning these codes safely.

Protect Domains That Don’t Send Email from Email Spoofing

/in /by

We recently wrote an article for those who manage their own Internet domain names about using SPF, DKIM, and DMARC to prevent your domains from being used in phishing attacks and enhance the deliverability of legitimate email. But what about other domains you own but don’t use for email? To make phishing attacks more believable, spammers sometimes forge email so it appears to come from parked domains that aren’t protected. You can use SPF, DKIM, and DMARC to ensure that forged email that seems to come from your unused domains isn’t accepted. The details are too specific to go into here, but Cloudflare has an excellent article outlining what you need to do.

(Featured image based on an original by iStock.com/Igor Kutyaev)

Social Media: If you have parked domains that never send email, it’s important to set up SPF, DKIM, and DMARC so scammers can’t forge legitimate-looking email from those domains.

Understanding the Key Differences Between Personal and Managed Apple IDs

/in /by

In the Apple world, the account that controls access to all your Apple-related online services is the Apple ID. Buying apps from the App Store, putting photos in iCloud Photos, and sharing data between iCloud-enabled apps—all these actions rely on your Apple ID. If you’re a regular Apple user, you have an Apple ID associated with your email address.

Most Apple users set up an Apple ID when they configure their first Apple device, and if you don’t have an email address that you want to use, you can create a free @icloud.com address during the process. (If you need to create a new Apple ID, you can do that at appleid.apple.com.)

There are actually two types of Apple IDs: personal Apple IDs used by individual users and managed Apple IDs given to employees by businesses and other organizations. Managed Apple IDs are popular with companies that give devices to staff members and need to ensure compliance with various usage and security policies. Let’s look at how they differ:

  • Creation, ownership, and control: Individuals set up personal Apple IDs on their own and maintain full ownership over the account and control over the device. Managed Apple IDs are set up by the organization, typically through Apple Business Manager, and the organization retains ownership and control for centralized management. That control is essential when an employee leaves. Otherwise, a company may be unable to reset a returned device and give it to another employee.
  • Access to Apple services: Personal Apple IDs have full access to all Apple services and features. Managed Apple IDs have much more limited access to protect the organization from unauthorized purchases and insecure behavior. Users with managed Apple IDs can’t purchase anything from the App Store, iTunes Store, or Apple Books. Nor can they access Apple Arcade, Apple Fitness+, Apple Music, Apple Music radio, Apple News+, or Apple TV+. The Find My, Health, Home, Journal, and Wallet apps aren’t available or fully functional. Plus, Apple Pay, iCloud Family Sharing, iCloud Mail, and iCloud+ services like Private Relay, Hide My Email, and custom email domains are unavailable.
  • Security and management: When a device relies on a personal Apple ID, that user is responsible for maintaining security and managing apps (which will belong to the user). That’s appropriate for individuals, but for companies that need to protect corporate information, managed Apple IDs allow the IT department to enhance security by requiring passcodes, enforcing password policies, setting role-based permissions, and separating work and personal data. On the management side, managed Apple IDs make it easier to reset devices, revoke access, comply with legal and privacy regulations, integrate with corporate identity systems, and centralize app licensing.

Though some organizations may prevent it, it is technically possible to use both types of Apple IDs on the same device. For instance, you could use a managed Apple ID on an employer-provided device along with a personal ID to access the App Store, Apple Music, Apple News+, and other Apple services. To do that on an iPhone, you’d go to Settings > Your Name > Media & Purchases and either sign in with your personal Apple ID or, if necessary, tap Sign Out and sign back in.

What’s the takeaway? There are three possibilities, depending on who owns the device and the employer’s security and management policies:

  • Personal device not used for work: If you’re a regular user who has purchased your own device and you either don’t use it for work or your employer doesn’t care what you do, all you need is a single personal Apple ID. Although it’s possible to create multiple Apple IDs and use them for different purposes, it’s a recipe for confusion down the road.
  • Personal device used for work: If your employer has a BYOD (Bring Your Own Device) program that lets you use your own device with corporate resources, they will likely ask to use Apple’s User Enrollment to create a profile on the device that separates personal and work data and allows the use of both personal and managed Apple IDs. Although the IT department cannot access your personal data (emails, messages, photos, location, etc.), it can enforce security policies, install and configure work-related apps, and control corporate data on the device. Some people find the privacy implications of this approach troubling and opt for separate work and personal devices.
  • Employer-provided device: If your employer provides a device for your use, they will likely require you to use a managed Apple ID on it. That prevents you from having to worry about security or management, but comes with some restrictions on what you can do. Talk to your IT department if you also want to use your personal Apple ID on the device.

Hopefully, we’ve clarified the situation surrounding personal and managed Apple IDs. Which makes the most sense in any given situation depends on a wide range of variables, so contact us if you need to talk through the possibilities as either an employee or employer.

(Featured image based on an original by iStock.com/dolgachov)

Social Media: There are actually two types of Apple IDs: personal and managed. Regular users have personal Apple IDs; those who use employer-provided devices are often required to use managed Apple IDs. Learn more about both.

Share 2FA Setup for Team Access to a Single Account

/in /by

When your team or family shares access to a single account (such as for banking or social media, which seldom offer multi-user access), using two-factor authentication via SMS is awkward—whose phone receives the 2FA codes? One solution is to use an authentication app. Authentication apps are more secure, and multiple people can add 2FA support to the same account by scanning the QR code at setup or adding the 2FA setup URL later. (In both 1Password and Apple’s iCloud Keychain, edit the login to see and copy the setup URL.) An even better solution is to use a password manager that supports both 2FA codes and password sharing. That way, one person can set up the account with 2FA and add its login to a shared vault or collection. 1Password, Bitwarden, Dashlane, iCloud Keychain, and others provide such features.

(Featured image by iStock.com/May_Chanikran)

Social Media: For better results when a team or family group needs to share 2FA codes to log in to a website, try to use an authentication app instead of SMS, or better yet, use a password manager that can both generate 2FA codes and share logins with a group.