Hackers managed to grab names, account details, and telephone numbers from 553 million Facebook users, and now they’ve published all that data on the web. Yikes. I’m shocked at the scope but not the source.

If you have a Facebook account, now is the time to be on alert for scammy phone calls from people who will try and social engineer their way into your credit card numbers and bank accounts. There is already a scam where they call and claim to be the IRS and need “immediate payment to avoid criminal prosecution”. I’m sure they’ll come up with even more dreadful ways to abuse this treasure trove of data.

We’re getting closer to the release of iOS 14.5, and it’s adding a feature that Apple Watch owners are going to dig. Specifically, if you are wearing a face mask and an Apple Watch, you’ll still be able to unlock your iPhone without using a passcode.

Once you turn the feature on, the iPhone has some new unlock logic:

1. Is the user wearing a face mask?
   No – Go to the usual Face ID unlock.
   Yes – Go to step 2.

2. Does the user have a connected, unlocked Apple Watch very close to the phone?
   Yes – Unlock.
   No – Go to the passcode unlock.

So, if you are wearing a face mask and you have an unlocked Apple Watch in very close proximity (less than 1 meter) to your phone, you get an unlock. In that event, you also get a prompt on your wrist letting you lock the phone back up. Interestingly, that step 1 looks for any person with a face mask. It doesn’t try to figure out if it is specifically you wearing a face mask. John Gruber did all the research on the beta build and reports in further detail.

I plan on turning this feature on once the update ships. I am so tired of tapping in my passcode when using my phone while masked.

I still bump into people that think their Macs are somehow immune from Malware. That just isn’t the case. Mac users are just as able to download malicious code as Windows users are. Historically, however, we’ve had some advantages on the Mac:

A Smaller Target
There just are not as many Macs in the world as there are Windows computers. Moreover, often the targets of malware (business and financial institutions) don’t run Macs.

Apple’s Increasing Emphasis on Security
Apple has been putting the screws down on macOS for years now. They’ve steered users toward the App Store, where they have more control over the apps you install on your Mac. They’ve rebuilt the plugin systems for Apple Mail and Safari so they are much more secure. They’ve implemented a notarization system for apps and they’ve even created a way to disable binaries from Apple Servers.

These two factors have combined to give Mac users a false sense of security. All that said, if you install an app from an untrusted source (or if one of your trusted sources that was unknowingly compromised, which happens), users are fully capable of installing malware on their systems.

That happened over the past few months with a malicious payload known as Silver Sparrow. (Red Canary did an excellent job documenting it.). It looks like this one was caught before it did any real damage (and Apple has now disabled the binary), but the advantage of catching this unexploded bomb was that it gave security researchers an opportunity to study it in detail. Silver Sparrow was designed to launch additional software that would do who knows what. It was also designed to cover its own tracks. It was very sophisticated software designed to run on both Intel and Apple Silicon Macs. Malware is increasingly targeting the Mac at a time when malware is getting increasingly advanced.

You shouldn’t be paranoid, but you also shouldn’t assume you are safe just because you are on a Mac. Don’t install software from unknown developers. Be careful around unknown download links and email attachments. In short, keep your head screwed on.

Whenever this question comes up, I get asked if I’m running virus software on my Mac. Currently, I am not. In my experience, virus software too often comes with its own set of headaches. However, reading about Silver Sparrow has me considering it again.

A while back, Facebook disclosed that thousands of Instagram users’ usernames and passwords were stored in plain text on Facebook servers and exposed to thousands of employees. Last week, coincidentally the same day as the release of the Mueller Report, Facebook updated the post and admitted the problem was more significant than they initially thought. (Kudos to TechCrunch for catching the update.) With this latest update, Facebook states the security lapse affected “millions” of users.

I know these posts are starting to sound like a broken record, but I cannot emphasize enough how important it is that you manage your own passwords. You have to be extra vigilant because the people you trust on those websites are not necessarily worthy of that trust.

Get yourself a good password manager. (My favorite continues to be Mac Power Users’ sponsor 1Password.) Change your most important passwords frequently. Be careful out there.

Wired recently published an article about the discovery of a database containing 809 million total records exposed online. The MongoDB (freely available to hackers for some time now) contains 150 gigabytes of plain-text marketing data, including 763 unique email addresses.

These days it seems I get nearly as much phishing email as regular email. Setting aside the discussion of email being unproductive, at what point does the medium fail just because we stop believing any email we receive is legitimate? I’m already getting that way with nearly all of my vendors.

Every year, Splash Data reveals its list of the year’s most commonly used passwords. This year the usual suspects, like “123456” and “password”, are, again at the top of the list. I had to grin that “starwars” has made its way to the list this year at #16. Funny. I would have that guessed that #diejarjardie would rate higher.

If you’re reading this blog, I’m guessing you already have a good password system and are not using any of these rubish passwords. Your family and friends, however, are most likely using lots of them. If you are spending time with some of the damned over the holidays, send them the Splash Data list and try to get through to them just how dangerous these common passwords are. I’ve been using 1Password since it launched and that’s a good recommendation (use this link for 20% off) but regardless of what system you put them on, put them on something.