TECH TIPS — THURSDAY, AUGUST 27, 2026
Audit the Extensions, Fence the Smart Devices, Run the AI Offline
Three overlooked upgrades that close the gaps passwords and antivirus never touch.
Most security advice concentrates on the front door — the password, the login screen, the two-factor prompt. That advice has largely worked, which is precisely why attackers have moved elsewhere. The soft targets in 2026 sit behind the login: the browser extension that already has your session, the smart plug quietly bridging the internet to your file server, and the cloud service reading documents you never intended to share.
This week's three tips address exactly those blind spots. None involve new hardware. Two are free, the third is optional. All of them are things almost nobody does, which is what makes them worth doing.
🧩 Tip 1 — Audit Your Browser Extensions Like They Are Employees
HIGH PRIORITY
10 MINUTES
A browser extension occupies a position of extraordinary trust. It sits inside the page, after your login, after your two-factor prompt, after your VPN. It sees what you see — decrypted, authenticated, and live. This is why extension compromise has become one of the most productive attack vectors of the decade: it bypasses every control you have carefully configured upstream, without triggering a single alert.
The mechanism is a supply-chain takeover. An extension with a clean multi-year history and thousands of positive reviews changes hands, or its developer account is phished. The next automatic update ships credential-harvesting or cookie-exfiltration logic to every installed browser overnight, with no new permission prompt because the permissions were already granted. In January 2026, researchers documented a coordinated set of Chrome extensions targeting enterprise HR and ERP platforms that stole live session cookies and actively suppressed security administration pages to delay discovery. The pattern echoes the Cyberhaven compromise of December 2024, pushed deliberately on Christmas Eve.
Stolen session cookies and OAuth tokens are the prize here, because they sidestep authentication entirely. An attacker replaying a valid session never sees a password prompt, never triggers an MFA challenge, and never generates the "new login" email you rely on as a warning.
Tip #1: Run the three-question test on every extension you have installed
Open your browser's extensions page and work down the list. First: have I used this in the last month? If not, remove it — dormant extensions carry full risk and deliver nothing. Second: does it request "read and change all your data on all websites"? If yes, and its function does not obviously require that, remove it or restrict its site access to specific domains under its details page. Third: is it still maintained by whoever I originally trusted? A sudden ownership change, a vanished support site, or an unexplained surge in permissions are all reasons to uninstall. Then create a second browser profile with zero extensions and use it for banking and email.
"Every device that had the extension yesterday gets the backdoored build today, often without any user prompt." — Sendwin security analysis, 2026
📡 Tip 2 — Put Your Smart Devices on Their Own Network
HOME NETWORK
15 MINUTES
Count the devices on your home Wi-Fi that run software you cannot update, inspect, or uninstall: the smart plugs, the robot vacuum, the television, the doorbell camera, the printer, the air purifier that inexplicably wanted an account. Each one is a small computer running firmware from a vendor who may have stopped issuing patches years ago — and on a typical flat home network, each one can see your laptop, your network-attached storage, and every other machine in the house.
Network segmentation is the fix, and it is far less intimidating than the terminology suggests. The principle is simple: cheap devices should be able to reach the internet, but not each other and not your computers. When a vendor's cloud service is breached or a device's firmware is compromised, segmentation contains the damage to a subnet full of light bulbs instead of handing an attacker a foothold on your file server.
You almost certainly already have the tool for this. Virtually every router sold in the last decade includes a guest network, and guest networks isolate clients from the main LAN by default — often preventing device-to-device communication as well. Enterprise-style VLANs offer finer control, including per-network firewall rules and separate DNS settings, but for most households the guest network delivers the overwhelming majority of the benefit for a fraction of the effort.
Tip #2: Move the cheap devices, keep the expensive ones
Enable your router's guest network, give it a distinct name and a strong password, and confirm that client isolation is switched on. Then migrate every smart-home gadget, television and printer to it, leaving your phones, laptops and storage on the main network. While you are in the router settings, install any pending firmware update and set the DNS resolver to a filtering service such as Cloudflare's 1.1.1.3, which blocks known malware domains at the network level for every device behind it.
One caveat worth planning around: casting and local device discovery generally do not cross network boundaries. If you stream from your phone to a television, keep the television on the main network and segment everything else, or accept that you will control it through its own remote. That is a modest trade for removing a dozen unpatched computers from the same trust zone as your personal files.
💻 Tip 3 — Keep a Local AI Model for the Documents That Should Not Leave
AI TOOLS
30 MINUTES TO SET UP
Cloud AI assistants are excellent, and for most work they are the right tool. But there is a category of material that simply should not be pasted into a third-party service under any privacy policy: a client contract under NDA, medical correspondence, an unreleased manuscript, financial statements, a colleague's personal data. For that category, the answer is not a better toggle — it is a model that runs on your own machine and never opens a network connection.
This has become genuinely practical. Tools such as Ollama and LM Studio install in minutes and handle the technical work of downloading and running open-weight models locally. Ollama suits anyone comfortable with a command line or wanting a local API to build against; LM Studio offers a conventional graphical interface that will feel familiar to anyone who has used a chat app. Both run the same underlying models, so the choice is purely about workflow.
8 GB
RAM to run a 7B model
7B–14B
Sweet spot for laptops
10×
Speed gain with 8 GB+ VRAM
Hardware expectations should be calibrated honestly. A machine with 8 GB of RAM will run a 7-billion-parameter model in quantized form; 16 GB comfortably handles 13B. On CPU alone, expect five to ten tokens per second — usable for summarising a document, uncomfortable for long conversation. A discrete GPU with 8 GB or more of video memory delivers roughly a tenfold improvement and transforms the experience.
Tip #3: Start small and quantized, not large and ambitious
Install LM Studio, then download a 3B to 8B model in a quantized format rather than reaching for the largest file available. Quantization compresses the model's weights so it fits in less memory at a modest cost in quality — and a small model that runs smoothly is infinitely more useful than a large one that forces your system to swap to disk. Test it on a real task you would otherwise have sent to the cloud: summarise a contract, draft a reply to a sensitive email. You will quickly learn where the local model is sufficient and where it is not.
The practical outcome is a two-tier habit rather than a replacement. Routine work continues in the cloud, where the frontier models are meaningfully stronger. Anything confidential goes to the local model, which produces a merely good answer in exchange for an absolute guarantee that the material never left the machine. For a growing number of professionals bound by confidentiality obligations, that guarantee is the entire point.
✅ This Week's Checklist
Work through these in order. The first two are the highest-value items on the list and cost nothing but attention.
- Open your browser's extensions page and uninstall everything you have not used in a month.
- Restrict remaining extensions to specific sites rather than "all websites" wherever the option exists.
- Create an extension-free browser profile and use it exclusively for banking and email.
- Enable your router's guest network with client isolation, and move every smart-home device onto it.
- Apply the pending router firmware update and switch DNS to a malware-filtering resolver.
- Install a local model runner and download one small quantized model for confidential work.
Each of these closes a gap that stronger passwords cannot reach. That is the recurring lesson of the past two years: the perimeter held, so the pressure moved inward — to the software already running inside it.
.webp)
Comments
Post a Comment