TECH TIPS — THURSDAY, AUGUST 13, 2026
Three Privacy Upgrades Worth Making Before the Weekend
Passkeys, AI training opt-outs, and the permission audit almost nobody performs
Digital hygiene has a reputation problem. It sounds like flossing — worthy, tedious, endlessly deferred. But the three adjustments below share a useful property: each takes well under half an hour, each is permanent once done, and each closes a category of risk rather than a single hole. Set aside a coffee break this afternoon and work through them in order.
🔐 Tip One: Move Your Most Important Account to a Passkey
SECURITY
15 MINUTES
A passkey is not a cleverer password. It is a different mechanism entirely. Built on the FIDO2 and WebAuthn standards, a passkey stores a cryptographic private key on your phone, laptop, or hardware security key, and hands the matching public key to the website. Nothing secret is ever transmitted, which means there is nothing for a fraudulent login page to capture and nothing for a breached database to leak. Both the FIDO Alliance and NIST’s digital identity guidelines (SP 800-63B) classify WebAuthn authenticators as phishing-resistant — a tier above app-based one-time codes, and several tiers above SMS.
The industry has stopped treating this as optional. Microsoft has confirmed that from September 1, 2026, passkeys become the default sign-in experience in Entra ID, with Microsoft-provided SMS and voice authentication being retired for users who have those methods enabled. If your organisation runs on Microsoft identity, the migration is happening around you whether or not you participate in it.
Start with the account that can reset all the others — your primary email. Confirm that your platform’s sync layer is switched on first: iCloud Keychain on Apple devices, Google Password Manager on Android, or Microsoft’s password manager on Windows. Then sign in with your existing credentials, open Security settings, and choose Add a passkey. On Google that path is myaccount.google.com → Security → How you sign in → Passkeys. Confirm with your fingerprint or face, and you are done.
One caution that the enthusiastic guides tend to bury: always retain a working backup sign-in method until you have tested the passkey on a second device. A passkey locked inside a phone you have dropped in a canal is a very secure way of never seeing your email again.
Tip #1 in one line
Turn on platform sync, add a passkey to your primary email account, then verify it works on a second device before removing any fallback method.
🤖 Tip Two: Audit What Your AI Assistants Are Learning From You
AI
PRIVACY
There is no master switch. That is the single most important thing to understand about AI data collection in 2026. Every major platform maintains its own policy, its own settings location, and its own definition of what counts as training data — and following the policy shifts of late 2025, most operate on an opt-out basis by default. The burden of refusal sits with you, repeated once per service.
The specific toggles are scattered but findable. In Google’s ecosystem, untick Save Media in Search history and switch off Gemini’s Keep Activity. On LinkedIn, disable Data for Generative AI Improvement. On X, untick the Grok training checkbox under Privacy and safety. Microsoft Copilot now trains on conversations by default — turn off the training toggle in the app’s privacy settings, and separately disable Optional connected experiences in the Office privacy settings for Word and Excel.
“A toggle protects tomorrow’s conversation, while the one you had last week is already out of your hands.” — The Slow AI, 2026
That limitation deserves emphasis. Opting out is forward-looking only; it does not retroactively extract your past prompts from a training corpus. Which makes the behavioural half of this tip more valuable than the settings half — stop pasting client contracts, medical results, unreleased financials, and identifying details into general-purpose chatbots, regardless of what the privacy panel claims.
Readers in the EU and EEA have a stronger instrument available. Article 21 of the GDPR grants a formal right to object to processing for AI training purposes, and a company receiving such an objection must either comply or demonstrate compelling legitimate grounds for continuing. That is a materially different proposition from a checkbox.
Tip #2 in one line
Work through the privacy panel of every AI tool you use regularly, disable training and prompt history, and treat the opt-out as protection for future conversations only.
📱 Tip Three: Run the Ten-Minute Permission Audit
DEVICES
MOBILE
Most permission creep is granted absent-mindedly, one dialog at a time, and never revisited. The fix is a single pass through your device settings with a deliberately sceptical question in mind: does this application have any legitimate reason to need this, ever?
Set microphone and precise location access to Only While Using the App across the board. There is no plausible justification for a game, a flashlight, or a shopping app holding permanent access to your microphone or your exact GPS coordinates. Then disable Background App Refresh for anything you rarely open — this is what stops applications from quietly talking to tracking servers while the device sits locked on your desk. Combined with disabling cross-app tracking, these two changes sharply reduce the volume of behavioural data flowing to advertising networks.
3
Settings that matter most
eSIM
Best anti-SIM-swap move
Android users have two additional levers worth pulling. Advanced Protection Mode, found under Security & Privacy, restricts installations to the Play Store, strengthens malware scanning, and blocks unauthorised downloads. Identity Check adds biometric gating to sensitive account actions when you are away from trusted locations — a meaningful defence if your phone is ever stolen while unlocked.
Finally, consider switching to an eSIM if your carrier and handset support it. Because the SIM is embedded digitally rather than sitting on a removable card, it cannot be transferred to another device without going through the carrier’s verification process. That closes off SIM-swapping, which remains one of the most effective ways an attacker converts a stolen phone number into access to your bank.
Tip #3 in one line
Restrict microphone and precise location to “while using”, kill background refresh for dormant apps, enable Advanced Protection on Android, and move to an eSIM if you can.
None of this makes you invisible, and anyone promising otherwise is selling something. What it does is remove you from the category of easy target — which, for the overwhelming majority of threats, is the entire game. Thirty minutes, three settings panels, and you are finished until something meaningful changes.
.webp)
Comments
Post a Comment