• 🗒️✅ Your Security Checklist
• 🏆🎖️ Test Your Security Skills
• 📰 Your Weekly Security Update
• 🤨 This Should Be on Your Radar 📡
• 🙈 Security Fail of the Week 👎
• 🍎📱 Security Updates from Apple 🍎

If you take nothing else from this newsletter, just do these three things to protect yourself:

1. Lock sensitive apps using Face ID. Your iPhone has a hidden feature that locks apps so that only you can open them by using Face ID or your passcode. 
2. Share passwords using the Passwords app. If you ever need to share a password with a friend or family member, you should use the Passwords app's sharing feature. It's more secure than texting passwords to each other or keeping them in a shared note.
3. Temporarily disable Face ID in a pinch. If you're ever worried that you might be compelled to unlock your iPhone with Face ID, you can temporarily turn it off so that your device can only be unlocked with your passcode.

Which is the best password manager? 🤔

1. Apple Passwords
2. Bitwarden
3. Dashlane
4. 1Password
5. LastPass

Scroll to the bottom to see how you did!

A couple of weeks back, we reported on a story about a journalist who found that Muse, Meta's new AI agent, was able to read his private messages, even though he hadn't given the AI permission to do so. Then, last week, a bug was discovered in the ChatGPT Mac app that could give attackers full access to users' chat history and whatever data the app was storing. Because the app required Full Disk Access to work, that means any sensitive data on your computer could be accessible through ChatGPT. Thankfully, OpenAI pushed a security update to patch the vulnerability. Apple has also decided to update how Full Disk Access works to ensure users understand the permissions they are granting to AI agents. Read more at TechCrunch.

The Bottom Line: AI agents are still a new technology that present many risks to the average user. They require extraordinary access to your personal data in order to work, which inherently presents a privacy risk when the agent is connected to the internet.

Should the Government Dictate Which Websites You Can Visit?

Congress is taking aim at media piracy with a new law that would require internet service providers (ISPs) and VPNs to block access to websites that have been designated as piracy sites. At first glance, this doesn't sound too unreasonable. Piracy is a big problem for the film industry and it's difficult to combat. However, this bill would allow the government to freely designate any site as a piracy site without any sort of due process. Find out more at the Electronic Frontier Foundation.

The Bottom Line: In the US, you are considered innocent until proven guilty, but this bill would mean sites can be labeled as guilty without a chance to defend themselves. Not only that, but allowing the government to determine what constitutes an illegal website without any sort of due process means it could easily deem websites it doesn't agree with as illegal.

AI Shares YouTuber's Home Address with Stranger

A tech YouTuber, Matt Robb, installed Meta's new AI agent Muse only to have it share his home address with a complete stranger. Robb had set up Muse to handle the sale of a keyboard on Facebook Marketplace. However, it did not inform Robb when it accepted a lowball offer for the keyboard on his behalf, told the buyer to come pick it up, and sent them his home address. The buyer showed up at Robb's house, sent him a message to let him know they'd arrived, but eventually left when they received no response. Robb only found out about the entire interaction after it had already happened. Read the full story at Dexerto.

The Bottom Line: This story demonstrates how unreliable AI agents are. As we covered in today's top story, they're still a new technology and will behave in unexpected ways. If you give an AI agent too many permissions, it could end up doing things you never wanted it to do, even things that may be dangerous.

Police Have a New Way to Bypass iPhone Security

GrayKey is a tool used by law enforcement to bypass the passcode on iPhones and Android phones, allowing them to access the data inside. Apple developed a way to combat GrayKey by forcing iPhones to reboot when they haven't been unlocked in 72 hours. When an iPhone is rebooted, the device's storage is encrypted (known as the Before First Unlock or BFU state) until the passcode is entered to decrypt it (known as the After First Unlock or AFU state). An iPhone in its BFU state is much more difficult for tools like GrayKey to break into. However, the creator of GrayKey, Magnet Forensics, has made an updated version of the tool that prevents iPhones from rebooting, as well as preserving the AFU state even if they are rebooted. Read more at 404 Media.

The Bottom Line: We don't know the specifics of how this new version of GrayKey works, other than that it can bypass certain iPhone security features that it could not before. If you're ever in a situation where your iPhone could be confiscated, your best bet is to reboot it before it's taken from you. GrayKey can only keep the phone in its AFU state if it is in that state when it is connected to the tool. If it is already in the BFU state before it can be connected to GrayKey, it will be more difficult to break into.

Data Breach at Popular Online Retailer

Fashion retailer ASOS has been hacked. This past week, ASOS app users were sent a notification with a message from the hackers, demanding that the company respond or they would leak the data. ASOS itself has put out a statement that personal details like names and contact details may have been compromised, but passwords and payment information are safe. Read more at The Independent.

The Bottom Line: While passwords were not revealed in this data breach, we still recommend using a password manager. In the event that passwords are leaked, using a password manager to create unique passwords means that only one account is compromised rather than all of them. You can also freeze your credit to prevent your identity from being stolen in the event that your Social Security number is found in a data breach.

Judge Rules Flock Usage Violates the Fourth Amendment

Judge Sara Hill of Oklahoma recently ruled that police violated a California woman's Fourth Amendment rights when they stopped her and searched her car based on location data from Flock. While police found drugs in her car, Judge Hill found that the justification for searching the car in the first place was flimsy. Judge Hill also suggested that similar cases that ruled that using Flock was not a violation of the Fourth Amendment may have been wrong. Check out the full story at 404 Media.

In other Flock news, a Florida county canceled its contract with the surveillance company and began taking down the 55 cameras it had set up around the city. While doing so, the police department found that there were 11 extra cameras that it had not authorized. The department does not know how or why the cameras were installed without the proper permits. The county has covered the cameras with plastic until they can be removed. Read more at TechSpot.

The Bottom Line: There's not much to say about Flock that hasn't been said already. We believe the company's automated license plate reader cameras present a significant privacy violation for every citizen. If you feel the same (or even feel the opposite), you can contact your local representatives to express your concerns. In some jurisdictions, the thoughts and opinions of citizens can influence decisions on policy.

Florida Woman Arrested After AI Chatbot Tipped Off Police

A woman in Florida was using Claude as her diary, telling it personal details about her life. Then, she decided to tell it about her plans to attack a police station. Claude, like all AI chatbots, will flag messages that it detects could cause harm to the user or others, which means it flagged her message and forwarded it to authorities. She was detained while police investigated the incident. Head over to TechSpot for more.

The Bottom Line: This story is a good reminder that your conversations with AI chatbots are not private. While Anthropic and OpenAI claim your messages are only reviewed by humans if they are flagged for indicating potential harm to yourself or others, a recent story that we reported on found that isn't always the case. If you have a setting enabled to help improve the AI model, all of your messages are subject to review by human employees.

More Surveillance Cameras to Follow Our Every Move

The USPS may soon equip its trucks with surveillance cameras. To start, the USPS will install these cameras on a hundred trucks in Washington, DC, as a pilot program. The cameras do not have automated license plate reader capabilities, though this functionality could be added with a simple software update. Instead, the cameras will collect data on infrastructure, scanning and analyzing roads and signage. Read the full story at 404 Media.

The Bottom Line: Dashcams are pretty normalized these days, and having one is good practice if you're ever in a car accident or witness one. However, a camera connected to the internet, broadcasting its data for government use isn't quite the same as a dashcam for personal use.

Security Breach at Trump Mobile

When we first reported on the announcement of Trump Mobile and the accompanying Trump Phone back in June of 2025, we expressed skepticism. Privacy and security are difficult to get right, especially for tech startups. It would seem we were right to be wary, as it is now being reported that hackers have stolen customer data for all of Trump Mobile's 3,600 customers. At least one customer says that she was unable to successfully register for an account or pre-order the Trump phone but still had her data stolen from the website. Read more at PC Mag.

The Bottom Line: Trump Mobile is not a unique case. Data breaches happen all the time. That's why we always strongly recommend password managers. When you use the same or similar passwords across websites, just having one leaked means every other account is compromised. A password manager lets you create a unique password for every account, so that if one gets leaked in a data breach, it's only the one password that you need to change.

• The most recent iOS and iPadOS is 27.0.1
• The most recent macOS is 27.0.1
• The most recent tvOS is 27
• The most recent watchOS is 27.0.1
• The most recent visionOS is 27.0.1

Read about the latest updates from Apple.

This one was a trick question, because there's not really a wrong answer. While we at iPhone Life prefer either Bitwarden or the Apple Passwords app, that doesn't mean you need to run out and switch to one of those if you're already using LastPass or Dashlane. If you're already using a password manager, just keep using what you're used to. And if you're not already using a password manager, you should start using one!

The one caveat we'll give is that you should not use your browser's built-in password manager. If your computer is ever infected by malware, the first place it will look is your web browser, whether it's Chrome or Firefox. A dedicated password manager app will require a master password or biometrics to open, which is much harder for malware to crack. Most password managers have a browser extension that you can use to autofill usernames and passwords, but will still require the master password to unlock when first opening your browser.

There is far too much security and privacy news for us to cover it all. When building this newsletter, we look for scams, hacks, trouble, and news to illustrate the kinds of problems Apple enthusiasts may encounter in our private lives, and the self-defense we can practice to keep our devices, accounts, and lives secure. Our commentary focuses on practical advice for everyday people. This newsletter was written by Rhett Intriago and edited by August Garry and Cullen Thomas.

Interested in learning more about how to use a password manager? Check out:

• How to Make a Strong Password & Things to Avoid
• How to Manually Add Passwords to Your iPhone