Passkeys, the sign-in method quietly replacing passwords on Google, Apple, Amazon, PayPal, and more. What they actually are in plain English, why they defeat the two attacks this show covers most (phishing and credential stuffing), the honest fine print, and the ten-minute way to start tonight with the one account that matters most.

Fitness apps like Strava have accidentally revealed secret military bases, an aircraft carrier's position, and the movements of presidents. This all through workouts shared by people trained in secrecy. Today: what that means for the rest of us, why the sensitive data isn't your heart rate but your *routine*, and the fifteen-minute settings audit that lets you keep the app and lose the exposure.

A newly documented Android attack turns a victim's own phone into a card reader for criminals: one convincing "bank" phone call, one sideloaded app, and then the killer move, "tap your card on your phone and enter your PIN to verify." Thirteen minutes, start to finish, including a loan taken out in the victim's name. Today: how tap-to-pay actually works, why the scam needs *you*, and the rules that end it.

Breach notices are arriving at a record pace. Over 471million victim notices in just the first half of 2026 and the letters themselves are quietly getting emptier. Only about a quarter now say what was actually taken, which is down from over ninety percent five years ago. Today: why the letters shrank, and the five-minute skill of reading one anyway, including where to find the details the letter left out.

The FTC said out loud on August 10 what most people assume isn't true. Social media platforms don't always vet the ads they show you, or the advertisers behind them. People reported losing $95 million in 2025 just from ordering something they saw in a social ad, and $2.1 billion to social media scams overall.

Aura, a company whose product is protecting your identity, disclosed that an attacker tricked an employee by phone and accessed roughly 900,000 records from a marketing database. The irony writes the headline, but the useful episode is underneath: what these services really do, what the free version looks like, and how to decide if paying makes sense for your family.

The Canvas breach, the largest education data breach on record, touching roughly 275 million accounts across nearly nine thousand schools and universities. Data lost included private messages between students and teachers. As families log back in this month: what was taken, what the ransom payment did and didn't buy, and what parents and students can actually do about a platform they can't opt out of.

Modern cars quietly record how you drive. Your braking, speed, acceleration, location, timing and a chain of lawsuits and state investigations alleges that data has been flowing to data brokers and on to insurance companies. Some drivers discovering it only when their premiums jumped. What your car collects, where it allegedly goes, and the two concrete things you can do about it.

Weekly Signal, covering what you missed over the last week.

A phishing campaign impersonating Bank of America tricks people into installing "Account Guard". Supposedly protection software, actually a remote-access tool that hands a stranger the keys to your computer, disguises itself as "Windows Security," and resists removal. The rule this episode installs instead: no real company will ever ask to see or control your screen.