Algorithms suck: a brief history

Brace yourselves, I’m feeling salty about this.

There’s a great quote going around the socials right now, about how the internet used to be a library, and now it’s a store.

This hits me like the loss of the Library of Alexandria. Because it’s true. The internet used to be this giant repository of pretty much everything you ever wanted to know. I’m pretty sure it’s obvious to our readers that I am one of those nerds who read the Encyclopedia Britannica while eating breakfast every morning. It was a sheer source of delight for me, knowing that I could open the pages and facts would spill out into my brain. The world was fascinating and complex and rich with ideas and knowledge and people wanting to explore.

Fast forward a bit to the existence of smartphones. Holy cats, all that knowledge, but in my pocket!!!!!!! The sheer amazingness of having access to whatever I needed to know, without having to head to the library and dig through the stacks, or waiting for interlibrary loan. Boom, it was just… there.

Then came greed. OK, greed largely in the form of algorithms.

The original algorithms were step-by-step instructions we wrote down to help computers help us. Ada Lovelace wrote what is now widely considered the first one, back in 1843, for a machine that never even got built. To me, though, everything really went wrong in 1998, when Google published PageRank, the formula behind its search engine. It wasn’t the first ranking algorithm, but it’s the one that took over the world. Someone had decided what counted as “important,” and that call decided what you saw first (and what you never saw at all). Your access to information was now steered by a corporation, and it all went downhill on greased rails from there.

I mean, there’s more to it, I’m oversimplifying a bit because we all have stuff to do with our day.

But then, RSS

RSS, or Really Simple Syndication (the name came a few years in, after some drama), was also built in 1999, although it didn’t really get its legs under it until like 2005-ish. Built by a bunch of heckin’ smart people including the late great and hugely lamented Aaron Swartz (who helped write RSS 1.0 at fourteen, which is a flex), it went through all the normal tech wrangles, with different organizations claiming ownership of the creation of different bits of the backend. The RSS Wikipedia page is great, if you want more details.

How it works, the plain-English version

The really cool thing about RSS is, it’s, well, really simple.

1. You select an aggregator or feed reader, which is the tool you use to collect and read your RSS feeds in. I personally am using the native Vivaldi reader right now, and I’m REALLY hoping they get mobile functionality someday soon. (You hear me out there, Vivaldi Team?) I also really like the Readwise reader, although it’s for people who really love annotations and highlighters, and I’m not that girl.

2. You populate it with the content you care about. My feed looks a lot like those encyclopedias I used to love. My favorite weather creators (hey there, Eyewall!), my favorite tech creators (big shout out to 404 Media), and all kinds of other trusted sources of information about the world we’re living in.

3. Then, you read it.

Is it really that simple?

Yes. Read away to your heart’s content, without ads except any inline ads your creators choose. Without some corporation watching over your shoulder to see who and what you’re reading, and using it to manipulate you. Without comment sections, unless your creators have them hosted on their own blog sites. Without being psychologically manipulated so you keep scrolling long after you should.

You get the information you select. You curate your feeds for high quality and thoughtfulness, instead of likes and follows and subscribes and whatever else social media tells us matters. And you get to use actual words, instead of funny made-up words about really serious stuff out of fear the algorithm will suppress you (looking at you, “unalive”).

What about the echo chamber?

One of the things I love best about using RSS is that you have the option of selecting individual sources outside “your bubble,” and reading them, without it generating a torrent of more content like it. You can read diverse points of view, without also ending up with a feed full of bobbleheads that the algorithm chooses for you when it senses you like something that you don’t. Stay informed, without the algorithm deciding it’s your whole personality.

Content consumption as a lifestyle

Using RSS means taking a pull, rather than push, approach to your information (you go get it, instead of having it shoved at you). We’ve all gotten super used to popping open our social media of choice, and assuming it will give us everything. Or, some things. Maybe. Or perhaps the algorithm thought it detected you slowing your scroll over an ad for gutter cleaning, and now your whole feed is gutters. Because feeds are monetized, content creators get money from your eyeballs and your clicks.

RSS means none of that happens, so you have to be more intentional in supporting the content creators you enjoy. Never was the phrase “if you aren’t paying, you’re the product” more true than in the content world. So if you’re going to move to RSS as a way of life (and a way of cutting out all the hideous downsides of manipulation at the hand of tech oligarchs), please also have a plan for chipping in, so your creators can keep creating.

The bedrock of the internet

It turns out, social media is simply a layer of nonsense on top of an old internet that still exists, but is a lot less about self-aggrandizement. We can have the old library internet back. We just have to choose to spend our time there, instead of staring at the bright, whirly, commercially and politically manipulative version of the internet.

Won’t you join me there?

P.S.

Of course this newsletter has a feed. It’s here: https://rss.beehiiv.com/feeds/2z0aUwSTAK.xml

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

This article was originally published on September 17, 2025.
(oh, how things haven’t really changed…)

UPDATE: October 12, 2026

Here at the ‘Tea, we have one job: helping non-technical people sidestep the harms technology can bring. That means teaching you to put yourself first in every human-versus-screen standoff (spoiler: the screen does not have your best interests at heart).

That’s why we’re reposting an updated version of our 2025 issue, “Stop Letting Platforms Hijack Your Eyeballs.” We wrote it about what happens when something terrible hits the news and the footage hits your feed before you have a chance to look away.

On October 8, the Pentagon announced that it will livestream a military execution by firing squad, scheduled for December 3. It’s believed to be the first time a U.S. execution has ever been broadcast to the public.

If the idea of watching someone be killed on camera makes you physically ill, please, for the love of all things, turn off autoplay on every platform you use. Today. I can promise you clips will show up in your feed, likely for weeks afterward. I cannot imagine anything more upsetting than having that sprung on you when you aren’t mentally or emotionally ready.

If you choose to watch it, that’s your right, and we’re firmly against censorship. But that choice should happen on your terms, at a time and place where you’re prepared for what it might do to you. As we said the first time around, platforms make more money the more outraged, rattled, or upset you are. Autoplay is how they make sure you don’t get a vote.

So please, don’t put this off. Set aside ten minutes today and flip the switch everywhere (and while you’re in there, add a few keyword filters; “execution” and “firing squad” are a good start). Already did this back in 2025? Check anyway. App updates have a habit of quietly flipping settings back to the default, and the default serves their business model, not your peace of mind.

You can’t control what gets broadcast. You can absolutely control whether it ambushes you.

Once upon a time, before today’s giant platforms, you had real control over what you saw online. You chose the blogs and writers you trusted, and they acted as a buffer between you and anything disturbing. There were trigger warnings, content labels, even plain old redactions. You had a chance to pause, decide if you wanted to engage, and keep your peace of mind intact. In short: you had both choice and control. And everyone was a whole lot less stressed out.

Then came the platforms

Facebook, Instagram, Threads, X, Bluesky, their business model is simple: harvest data, serve ads, maximize profit. Your attention is the product.

The catch? Platforms make more money the more upset, outraged, or rattled you are. So they strip away your control, hand the keys to algorithms, and push you toward content that will keep you scrolling, even when it hurts. That’s why when terrible events happen, you’re likely to get video shoved in your face before you can even look away.

And here’s the thing: even the professionals hired to moderate harmful content often develop long-term trauma. If it’s not good for them, it’s not good for you either.

It’s time to take your attention back.

The fix: turn off autoplay

Here’s the good news: every platform (though they hide it deep in settings) gives you the option to shut off video autoplay. Once you do, you get to choose when you hit play, and when you don’t.

You can still watch any video if you want to. But this one change keeps you from being ambushed by disturbing footage before you’re ready. It’s a small adjustment that can make a big difference in your mental health.

Steps for turning off autoplay or blocking sensitive content

^{Table: The Conversation, CC-BY-ND + Source: Annie Margaret}

If a platform you use isn’t listed in the table, you can google “turn off autoplay (name of your platform)” for instructions. 

But What About “Censorship”?

Let’s be clear: personally curating what you see is not censorship. Staying informed doesn’t require you to watch every brutal clip that surfaces. Protecting your mental health doesn’t mean you’re naive — it means you’re better equipped to respond thoughtfully when it matters.

The truth is, outrage burns energy fast. Redirecting that energy into improving your community, or simply caring for yourself, is always the smarter move.

This is what CybersecuriTea is about: removing overwhelm in favor of small, sustainable steps that leave you calmer, safer, and more in control.

So don’t let anyone talk you out of flipping that switch. Protecting your attention is protecting yourself.

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Here at the 'Tea, we like easy, straightforward, unglamorous ways to keep yourself safer. This might be the easiest and most important cybersecurity practice of them all: once a week, power down all your devices. Every single one.

We'll send social media reminders, but feel free to set your own calendar alert or alarm (whatever system you've cobbled together to keep yourself on top of things). Power it all down. Next time you need it, power it back on. Easy peasy.

If you want to just take our word for it, you can stop reading now, and we won't be offended. But if you'd like to know why this is a thing, keep going.

Power cycle, reboot, restart: what's the difference?

These three terms get used interchangeably, which drives precision-minded people (like me, hi!) a little bit up the wall. They actually mean different things, depending on whether you're talking hardware or software. Let's sort it out.

Power cycle

This is a hardware concept. There is no power going to the device at all. Fully shut down (not "restarted"), and unplugged. This is the thing we want you doing once a week, to everything you own.

Reboot

This one straddles hardware and software, and it comes with a genuinely delightful bit of computing history.

Rebooting just means restarting a running system, either on purpose or because something went sideways. A cold (or hard) reboot cuts the power entirely and brings the machine back from nothing. A warm (or soft) reboot restarts the system without ever losing power in the first place. "Restart," as a menu option, usually means the soft version: the operating system closes everything out and wraps up its business before starting over.

Here's the fun part. Early computers like the IBM 1401 had no operating system and barely any memory to speak of. You'd feed it a stack of punch cards, hit a button, and the machine would read exactly one instruction: "read a card." That first card would then tell it to read more cards, which eventually loaded up whatever program you actually wanted to run. Engineers thought this looked a lot like the old saying about pulling yourself up by your own bootstraps, and the name stuck. Starting a computer from cold became "booting it up." If it crashed, you rebooted it. The term outlived the punch cards by several decades. (Wikipedia has the full history, if you want to satisfy your inner nerd.)

Despite how often you'll hear it used for the physical act, "reboot" is really a software concept.

Restart (reset)

A soft reset comes from the software itself. Think Ctrl-Alt-Delete, or hitting "restart" in your Windows menu.

A hard reset is the one you reach for when software stops responding altogether, usually via a dedicated reset button. On some devices (the PlayStation 2, memorably), a quick tap of the power button triggers a hard reset, while holding it down turns the whole thing off. Fair warning: hard resets can occasionally corrupt data, since nothing gets a chance to shut down cleanly first. (Wikipedia again, for the deep dive.)

This is a software concept too (unless the software's being especially stubborn, in which case it edges back toward hardware, in roughly the same spirit as "get a bigger hammer").

All clear? Wonderful. Now let's talk about what a good power cycle actually does for your stuff.

Your devices

Router

Routers used to be simple little boxes. Then "smart" devices happened (yes, we're putting that in quotes forever), and suddenly your router is the front door to your entire home network.

Routers run on volatile memory (the kind that clears itself out the moment power's gone, unlike your laptop's hard drive), which means power cycling does real work:

• Memory-resident malware gets wiped out (the kind hiding in RAM, not on your hard drive)

• Active malicious processes get shut down (say, your router secretly sending spam or joining a botnet attack without you knowing)

• Temporary exploit states get reset (the sneaky back door an attacker slipped in through, closed)

In other words, you're evicting any freeloading bad actors from your system. If they've already spread to other devices in your home, you might get reinfected, which is exactly why you're power cycling everything else too, not just the router.

For this practice, all we're asking: unplug the router, wait 30 seconds to a minute, plug it back in. If you've also got a modem, the order matters: power down the router, then the modem, wait 30 seconds to a minute, power on the modem, then the router. (If they're both on the same power strip, flipping the strip off and on at the same moment skips that order, and the router can come up before the modem's finished reconnecting to your provider, which sometimes means doing it all over again. Worth the extra 30 seconds to do them one at a time.)

Laptop

Choose "shut down," not "restart." Unplug it, wait 30 seconds to a minute until everything's dark, plug it back in, then power on.

Phone

Close out your apps first. Power the phone all the way off. Let it sit for a minute. Turn it back on.

Everything else

Anything else riding on your home network (tablets, smart speakers, the refrigerator that reminds you when you are out of milk) needs a full off-and-back-on, at minimum monthly, weekly if you can manage it. Bonus effect: this practice is a great reminder of exactly how much tech is quietly running in your home, so the next time you hear about some new exploit, you'll actually know whether it applies to you.

Why is the answer always "maintenance"?

Once Power Cycle Sundays become a habit, you'll wonder why you ever thought it was a big deal. It's basic upkeep, the digital equivalent of vacuuming or cleaning out the coffeepot. Skip the maintenance, and the gunk builds up quietly until your carpet feels gross, and your coffee tastes awful.

So let's not do that. Five minutes, once a week. We’ll keep reminding you.

SPONSORED
Every sponsor here is something we actually use or genuinely believe in. Click through if something resonates - it means the world to us and helps keep CybersecuriTea coming your way.

Daily news for curious minds.

Be the smartest person in the room. 1440 navigates 100+ sources to deliver a comprehensive, unbiased news roundup — politics, business, culture, and more — in a quick, 5-minute read. Completely free, completely factual.

Sign up now!

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

3.7 million people just found out their medical records got stolen. Not "might have." Did.

CareCloud confirms 3.7M patients had their medical records stolen in data breach

There is not a clearer sign that you need to take the steps necessary to protect your own data than this.

It is wild how, year after year, breach after breach, the problem doesn't get fixed. Or prioritized. Or anything. Third-party risk management still isn't treated like the critical-path security practice it is. In the year of Our Lord 2026, we're still watching breaches of this size happen that were entirely preventable (if the companies involved had the will to prevent them, that is).

I'm not saying software can be made breach-proof. It can't. Not possible. But you can absolutely close the known vulnerabilities in your architecture, and then actually go fix them. A cybersecurity pundit I respect pointed out that stuffing that many records into one bucket is a design choice (a bad one). Those buckets could have been structured to limit the damage. Harm reduction. It's a thing companies could choose to do. Or, apparently, not. Repeatedly. Hurrah for yet another year where shareholder value beats basic protection of customer data.

So it's on us to start teaching people (the actual victims of these breaches) how to protect themselves, since the industry is clearly too busy navel-gazing to do it for them. It's time to make compromise survivable. It's time to give people's data the level of concern it deserves.

What do the 3.7 million people in this breach do next? Do they know how to freeze their credit and lock down their accounts? Switch to real passphrases with MFA? Know whether they're on the hook for IoMT (Internet of Medical Things) exposure, or how to double-check and back up their own medical records before something changes? Because this breach makes it painfully clear: industry can't even manage bare-minimum harm reduction for you and yours. You're on your own here.

So what do you do with that?

Kind of excellent of CareCloud to make our point for us, honestly. Because 3.7 million people are, right now, scrambling to put in place exactly the safeguards we teach you to build before anything goes wrong. 

That's the whole idea behind Digital Caregiving: get ahead of the breach that hasn't happened yet, instead of cleaning up after the one that has. Come build your safety net with us before you need it, not after.

Signups end tonight. Class starts tomorrow. 

Enroll now →

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

This is the final installment in our Digital Caregiving series. If you're just catching up, you can find the whole series here. Short version: for the last month, I've been walking you through exactly what I wish I'd had in place before that hospital call came in. This is the last stop.

But I didn't want to just tell my story and leave you to piece together your own plan from it. So Digital Caregiving, the course, opens its doors Monday, August 24 (same framework, but live, with me and J.B. walking you through it step by step, before your version of that 2am phone call happens). This is the Beta version of this program and seats will be limited, so if you want the best shot at a spot, get on the waitlist now.

Okay. Let's get to it.

Part 5: all the other details

Surprise! Bonus content. In putting this series together, J.B. and I did a bunch of talking, brainstorming, and generally thinking through all the things I did but didn't think to mention (caregiving is no joke, and I'm running on about half a mental battery over here). So think of this as a roundup of all the "oh yeah, that thing too!" we collected along the way.

Backups

Hospitals can be high-theft locations, and your person may not always be alert enough to stop someone from walking off with their tech. That's a top-five sucky disaster, but it doesn't have to be fatal if you've got backups.

Back devices up to a local location (an external hard drive works fine), and then also to a secure cloud provider (something like Proton Drive, not iCloud, not Google, mkay?). Make sure you and your person both know how to restore from backup before you need to.

Backing up a smartphone is nothing like backing up your reading device, which is nothing like backing up your tablet, which is nothing like backing up your laptop. Get an agreed-upon, tested strategy in place before it's needed.

Calendars

A synced-up family calendar makes life so much easier, especially if your person is in for a lot of follow-ups. I spent days scheduling all of Mom's appointments, and being able to tell her "it's all on the calendar" let her go check for herself that everything was in order. It also makes communicating the inevitable reschedules a lot cleaner (and a lot more definitive).

Securing devices

You need to make sure the device itself is secure. We've covered that in past issues, but it's not a set-it-and-forget-it job (settings and operating systems change). Stay on top of this one.

Assistive access

Turns out I could've made my life easier this whole time with a feature that's been sitting on iPhones for years: Assistive Access. With a passcode, it locks a phone down to only six preselected apps. Jeremy White made a great video on how it works (here), and there's a thorough writeup on setting it up and personalizing it (here). Android users, this one's for you.

The win: your person can still get to, say, their music, without being able to wander into shopping sites or whatever other trouble is a tap away. They keep the ability to reach friends and family, but lose most of the ability to accidentally cause a catastrophe.

TIL, right? Wish I'd known about it a few months back. Now I do, for next time, and for the rest of you.

The doors to the Digital Caregiving course open Monday

This is where the story turns into the tool. Everything in this series (this post included) is the stuff I wish I'd had executed and ready to go, before I needed it. The course is that, live: five 60-minute sessions, twice a week, for about three weeks, walking you through building your own person’s digital safety net (accounts, passwords, devices, all of it) before your version of that hospital call comes in.

Beta doors open Monday, August 24, and seats are limited on purpose. Get on the waitlist now for the best shot at a spot.

Save my spot on the waitlist →

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Over the first two weeks of August in Las Vegas, when BlackHat, DefCon, and BSides Vegas all happen back to back, most of the industry shows up for the run, or some piece of the run, or whatever their calendar allows.

And yes, I know "hacker" sounds like a word you're supposed to be scared of. It's been doing a lot of unfair work in headlines for decades. But the people filling these rooms aren't the ones you need to worry about. They're the ones finding the problems before the people who should worry about you get the chance to.

One of my favorite things to do every year, once the conferences wrap, is go back and watch the talks. You can find the Black Hat talks here, and the Def Con ones here (the BSides ones aren't up yet, but give it a few weeks).

This? Is where the magic happens.

I do not understand all of these talks. I suspect no one does. There are so many specialty areas that it's highly likely three quarters of any given talk is incomprehensible to anyone outside that niche.

But if you let your eyes go a little soft and stop needing to catch every word, there are some genuinely amazing, inspiring, intriguing talks in the mix. Zoom out far enough and you start to get a real sense of where cybersecurity is heading, what threats are coming down the pipe, and who's actually doing the work to stop them. That's where a lot of the ideas for this newsletter (and for our courses) come from.

Case in point: BSidesLV has a talk from eight months ago about securing American water processing plants. Timely, hey? It's a fabulous talk, and genuinely important information if you want to actually understand the water plant hack stories making the rounds right now (instead of just doom-scrolling past them).

Your best interest

Most consumers of technology have bought in (literally, this is a facet of capitalism) to the idea that tech exists for our greater good, our convenience, our health. The hackers presenting at these conferences are the ones pulling back the curtain to show you the man isn't actually a wizard. They cut past the marketing and the PR spin to hand you the data you need to figure out which tech is actually working for you, and which one isn't.

There's no way I can keep up with the torrent (see what I did there?) of ideas, findings, and dots being connected across the industry. I lean on this huge, mostly anonymous group of people I've never met, and likely never will, to help me understand what the rest of us need to know.

Built this way

Recognizing (and knowing how to navigate) the line between technology and humanity should honestly be taught the way media literacy is. You should be able to spot propaganda and tell it apart from fact. You should understand how technology-for-profit has quietly replaced technology-for-advancement. And most of all, you need to stop treating tech as a consumer good and start treating it like a tool, the kind that gets maintained and handed down, not the kind that gets thrown out.

But if you're living the Sandwich Generation life, you have exactly zero time for any of that. So this is part of what we're here for: a subscription to the way my brain pulls all of this together, so you don't have to.

Tip of the spear

Especially at Black Hat (I mean, just look at the name), you see presentations about people hacking purely for the love of hacking. Some of it is amazing, sometimes mind-blowingly clever, purely for its own sake. But you also see people going public with exploits because they've run out of other ways to get an industry's attention. Eleven years ago, Charlie Miller and Chris Valasek couldn't get the auto industry to take remote hacking of automobiles seriously, so they took it to the Black Hat stage instead. Watching those talks (still live on the Black Hat YouTube channel, linked above) is what first told me there was a very real threat that nobody else was talking about.

Straight up: hacking was being used to keep us safer.

What's genuinely fabulous about the work coming out of these conferences is that these are people pointing their genius at human empowerment, not shareholder value. Their gift is seeing the error nobody else caught and thinking sideways about it, and that gift is legitimately changing the world and how we see it.

Straight up: hacking is one of the clearest paths to the greater good in tech.

What's in it for you?

I spend a lot of time (a lot of time) talking about technology in terms of doom. All the ways it gets used for crime, for harm, or just generally as something you need to protect yourself from. I know plenty of tech people who've seriously considered going fully analog and raising goats instead (I'm one of them, honestly, who doesn't love baby goats?).

But here's the thing I actually wanted to get across: for a couple of weeks every August, technology becomes something I love again. Something that inspires, motivates, and is worth the time and attention it takes. Something that can genuinely help the world get a little better.

And you, dear reader, get to hear all about it over the coming months. I can't wait.

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Laureen's mom went into the hospital over a month ago. Then a few weeks of rehab after that. She's home now, and (amazingly) doing well.

Laureen's taking this week off from the newsletter. Not because there's nothing to say, but because after a month and change like that, she's earned a moment to catch her breath and get her mom settled in.

Here's a detail she'd probably want you to know, though: even Laureen — the person who writes the cybersecurity newsletter — had cleanup to do. Remember the spam situation from earlier in this series? That wasn't hypothetical. She was the one wading through her mom's inbox at the hospital, doing the exact unsubscribe-and-block routine she told you to do. The expert still had a mess to deal with. She just also had a system for dealing with it.

That's the part worth sitting with: the panic was manageable, because the accounts were already sorted. The passwords were already found. She wasn't searching "how do I get into Mom's email" at 2am, because she'd already done that work months before anyone needed her to.

Having that squared away didn't make any of the hospital stuff easier. What it did was make it possible for her to actually be there, present with her mom, instead of frantically reverse-engineering a digital life from a waiting room chair. The system she'd already built gave her the space to handle everything new that showed up, because everything old was already accounted for.

That's the whole idea. Not that you'll never be overwhelmed. You will. Caregiving is overwhelming, full stop, no newsletter fixes that. But you get to choose what you're overwhelmed by. The scheduling and the symptoms and the sitting with someone you love while they heal — that's going to take everything you've got. "Wait, does Dad even have a password manager?" shouldn't be competing for the same bandwidth.

Introducing Digital Caregiving, from Laureen & J.B.

You didn't sign up to be tech support for your whole family. But if you're anything like Laureen, or me, or most of the people who read this newsletter — you probably already are.

Digital Caregiving is the course we built for exactly this. Five live sessions, step by step, to get your parents' accounts, passwords, and devices in order — before you're doing it from a hospital waiting room instead of your home office.

Laureen's experience is proof it works. We'd like it to work for your family too.

Save your spot on the list — and thank you, genuinely, for being part of this newsletter's community. We built it because more people needed a Laureen. This is us trying to give you one.

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Last month, my mom ended up unexpectedly in the hospital. It was a rollercoaster of all the Greatest Hits of the American Medical System, including supporting the Residents striking in the hour before Mom was due for surgery, because they're paid too little and work too many hours. No joke.

But this is a cybersecurity newsletter, so let's talk about the part I actually know something about. As I went through this process, I wanted to help prepare anyone else who might go through a similar thing. You think the annual ritual of "fixing a few things" around Thanksgiving is rough for the average tech person? This is rougher.

And by the way, Mom's out and doing fine, thanks for asking!

Let's get to it.

(One more thing before we dive in: stick around to the end. If this series has hit close to home, we’ve got something for you.)

Part 4: Delirium and Bargains

I've put this piece last, because emotionally and morally, it's a tougher thing to write about. There's a bunch of questions here you're going to have to face about autonomy and respect and responsibility, and they take a lot more thought than "freeze your credit," which is about as no-brainer as this series gets. So get your goggles on, and let's do this.

Hospital delirium

I had no idea this was a thing, but it absolutely is. Simply being in the hospital puts your person at risk, especially if they're elderly. And watching it happen is devastating. Suddenly, your person is no longer your person — hostile when they used to be happy, angry when they used to be peaceful. A whole lot of weird personality things pop up. It's… super stressful, and I can't overstate the need for mental support for you, the caregiver, so you have the ability to help your person get through this.

But this is a cybersecurity newsletter, and we're here to talk about digital security.

Shop 'til you drop

I'm pretty sure I don't have to explain that delirium and access to the internet can be a desperately bad combination. As much as I could use Mom's phone to play her favorite music for her, which was soothing, she also had the ability to access… anything. My mom is not a shopper, but I watched her try to purchase something on Amazon. Couldn't tell me what, couldn't tell me why, couldn't tell me what for, but was determined to hit that Buy Now button.

I suspect it was a dopamine thing, but it was terrifying. If you're not fully cognizant, you can do a lot of damage with unfettered internet access.

Why this is hard

In any other context, controlling someone's access to information is a form of abuse. As someone whose entire career has had "information wants to be free" and "the people's right to access information will not be abridged" (that's a Lois McMaster Bujold quote) as its basic ethical underpinning, the idea of restricting access makes me instantly nauseous.

I never did access control with my kids. We had hours and hours of conversations, where I explained to them how to navigate an internet that doesn't always have your best interests at heart. We played together, I watched them use their devices, I made myself available to them for their (endless) questions about how it all worked and what it all meant.

The idea of restricting Mom's access was… impossible. And yet.

Access control software

There are plenty of access control programs out there, with various pros and cons to them. We at the 'Tea haven't fully evaluated them — there will be a blog when we do. But for now, dear reader, just know that there are options, and this is a thing you can set up.

Deleting apps

Rather than putting down software I hadn't validated, I went ahead and deleted apps. Because of the delirium, navigating by website and reinstalling apps were not on the table as doable tasks. Simply deleting the apps solved our problem, without restricting her access to the things that were helping her get back to herself, like her music, and YouTube, where she watches Josh Johnson's monologue every Tuesday.

We were lucky; the delirium was short-lived, and I was able to reinstall everything and get her all logged back in. I was lucky, too, in that I have a few friends involved with elder care who were able to talk me through all this, and help me find a middle path that felt ethically OK to me.

Digital curling

You know that Winter Olympics sport where half the team frantically sweeps the ice in front of the stone? That's what this felt like to me. I was trying to keep out ahead of the digital bumps that would send the stone of her healing awry. And as I thought about this, I realized that's what weighs on the caregiver: the idea that you didn't get them all, the idea that there's more sweeping to be done. It's freaking endless.

This series is my gift to you, to allow you to get those bumps swept away, so that even if you and your people are hit by the unexpected, you have a solid foundation behind you that provides some confidence and security when you need it most.

And this is what I teased at the beginning of the newsletter:

Introducing Digital Caregiving

I know this has all been a lot. And I know most of us aren't exactly eager to dwell on our people being incapacitated. So here's the good news: we've built something to help.

It's called Digital Caregiving, and it's the step-by-step version of everything we've walked through in this series (and more) — except live, with J.B. and me actually there, so you're not piecing it together alone at 2am.

If any part of this series made you think "oh no, I have no idea where Dad's passwords are," this is for you. Save your spot on the list. You've done the hard part already. You decided to deal with this before it became an emergency. Let us help you with the rest.

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Last month, my mom ended up unexpectedly in the hospital. It was a rollercoaster of all the Greatest Hits of the American Medical System, including supporting the Residents striking in the hour before Mom was due for surgery, because they're paid too little and work too many hours. No joke.

But this is a cybersecurity newsletter, so let's talk about the part I actually know something about. As I went through this process, I wanted to help prepare anyone else who might go through a similar thing. You think the annual ritual of "fixing a few things" around Thanksgiving is rough for the average tech person? This is rougher.

And by the way, Mom's out and doing fine, thanks for asking!

Let's get to it.

Part 3: Final Jeopardy: Digital Finances

Fraud is a huge problem in the world generally, but it's a specific nightmare for seniors. A medical crisis means reduced capacity to fight back — and fraudsters know it, which is exactly why financial fraud spikes against people admitted to hospitals. The numbers on fraud are nauseating, but important to wrap your head around. Simply being admitted to a hospital increases your financial fraud risk.

I got my Mom onto YNAB years ago, so I had the details of her financial life at my fingertips. I knew which bills were coming, and which accounts needed transferring to and from. But most importantly, I could spot fraudulent transactions in a heartbeat. I cannot overstate how reassuring it is to know that if something went sideways, I'd notice it, and be able to handle it, immediately.

Track their bills

There are so many different phishing attacks focused on fraudulent billing — invoice scams, traffic ticket scams, yada yada yada. If you use a financial management tool, it's pretty easy to figure out what's a legit bill and what's garbage. Having that history makes it easier on you.

Balance their accounts

Especially for seniors and folks on fixed incomes, expenses month-to-month are pretty standard. So a big change in balance is a big red flag for further investigation. If you know, generally, what your person's monthly spend looks like, balancing their account can tell you a lot.

Reduce their digital footprint

I talked about this in the second issue in this series, but the lower your noise-to-signal ratio is, the easier it is to spot irregularities. Anything you can do to reduce your person's digital footprint, do it before they're incapacitated. Consider it a gift to future-you.

Credit cards

If you know your person has autopays on a credit card, keep an eye on that account directly — or in YNAB, if that's your setup. But if they have cards with no autopays attached, consider freezing those outright.

Freeze their credit

Mom's credit accounts were frozen about a million data breaches ago, so that wasn't a concern. But if your person's aren’t, that's something worth doing for them. It's a critical piece of protection, given how huge identity theft is in Personal Health Information (PHI) breaches. The hassle of unfreezing your credit if you need to use it is nothing compared to the hassle of someone opening a line of credit in your person's name.

Learn how to do this here.

The timeliness of basic housekeeping

I know everyone's busier than they should be. I know we're all out here fighting off exhaustion and mayhem. IMO, and IME, not all stress is created equal. Because of things that have happened in my life, I know for a fact that when a loved one is ill, I want my entire focus on them. I want to be able to pay attention to care providers, understand treatment options, support and offer comfort. And I also know the last thing I'd want to do is deal with identity theft or bank account drainage during that time, instead of hanging out bedside with my person.

It is absolutely worth it to find the time — soon, sooner, soonest — to get your person's digital life in order well in advance of need, so that if disaster strikes, you have the reassurance that other things are on track, and you can focus on helping your person.

Nobody notices a frozen credit report or a balanced budget. That's the point. The whole goal here is to make your person's finances boring — so boring that if disaster hits, "boring" is one less thing you have to worry about.

Next issue:

We’ll talk about hospital delirium and online shopping. Because it’s a thing.

SPONSORED
Every sponsor here is something we actually use or genuinely believe in. Click through if something resonates - it means the world to us and helps keep CybersecuriTea coming your way.

Free email without sacrificing your privacy

Gmail tracks you. Proton doesn’t. Get private email that puts your data — and your privacy — first.

Ditch the Gmail data grab

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Last month, my mom ended up unexpectedly in the hospital. It was a rollercoaster of all the Greatest Hits of the American Medical System, including supporting the Residents striking in the hour before Mom was due for surgery, because they're paid too little and work too many hours. No joke.

But this is a cybersecurity newsletter, so let's talk about the part I actually know something about. As I went through this process, I wanted to help prepare anyone else who might go through a similar thing. You think the annual ritual of "fixing a few things" around Thanksgiving is rough for the average tech person? This is rougher.

And by the way, Mom's out and doing fine, thanks for asking!

Let's get to it.

Part 2: The Fourth Circle of Hell: Spam

I spent an hour or two or five every day with Mom as she recovered, or waiting for her outside the operating room, or just sitting there while she napped. As much as there were moments of intense activity, there were also moments of quiet. In those moments, I'd often grab Mom's phone and start wading through her email to make sure she wasn't missing something important, or through her texts, for the same reason.

The amount of spam in there was absolutely catastrophic.

Apparently, one political donation, and you're on every spam list across the entire country. We'll get into how disgusting it is that candidates are trying to manipulate people on fixed incomes out of their cash some other time. For right now, what all the spam did was make it harder for me to sort the actionable from the ignorable. And when you've got a person facing a critical health challenge, you simply don't have the spoons to make those choices. More than once I put the phone back down and closed my eyes too, because I just. freakin'. couldn't. A crisis combined with caregiving depletes your neurochemistry in ways you can't foresee, and unless things are really simple and straightforward, you're going to miss things because you're depleted.

So let's clean things up ahead of time.

Remove your person's phone number from lists

According to our friends from LegalClarity:

Registering your phone number on the National Do Not Call Registry at donotcall.gov is the single most effective first step to reduce spam calls, and it's free. But that registry only stops legitimate telemarketers. Cutting spam down to a manageable level takes a combination of federal registration, phone settings, carrier-level filtering, opt-out requests, and data broker removal. None of these steps works perfectly alone, but layered together they make a real difference.

The layering bit is really, really important. There is no off switch, there is no set-and-forget. Make this part of your monthly routine. The Do Not Call Registry is a great place to start, and then keep going with one of our recommended lists.

While this is a start, it's a two-part process — you also have to stop putting your data in things to begin with. Flag their accounts, and then when you have more time, start transferring:

• From their real email address, to an alias.

• From regular unmasked credit card numbers, to masked credit card numbers. Many cards offer this; Capital One's system is fantastic.

• From the actual phone number, to a masked number. I get mine from DeleteMe, but there are other ways to go about it.

We wrote a whole post about this…

Stop replying to texts with STOP

If you're dealing with a legit organization, the STOP reply text works. But! If you're not, it tells spammers they've reached a real, responsive number — and that's the trigger for scams to come flooding in.

Instead, block the incoming spam number.

• How to block on Android

• How to block on iOS

Not gonna lie; blocking spammers is very satisfying while you're waiting for test results or whatever.

Update your person's passwords

A lot of people are still using combinations of birthdays and grandchildren's initials to "protect" their accounts. If you have access to your person's password manager, now is a fabulous time to update their passwords to meet current standards. And while you're at it …

2FA everywhere

You may need to help your person with this when they get out and get back up to speed, but now's as good a time as ever to implement 2FA everywhere that it can be. And as I mentioned in the first article in this series, make sure your number is on every account as a backup, so you can handle verification requests from your own phone and not theirs.

Signs (of the apocalypse)

You need to stay alert across all media for signs that your person's identity has been stolen. If you're still drowning in the torrent of unsolicited spam texts, calls, and emails that most of us are, it's much, much harder to pick up the signs.

Clear the spam now, so future-you has one less thing fighting for your attention later.

Next issue:

Digital finance hygiene for your person while they're in the hospital. Because bills don't pause for surgery.

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Last month, my mom ended up unexpectedly in the hospital. It was a rollercoaster of all the Greatest Hits of the American Medical System, including supporting the Residents striking in the hour before Mom was due for surgery, because they're paid too little and work too many hours. No joke.

But this is a cybersecurity newsletter, so let's talk about the part I actually know something about. As I went through this process, I wanted to help prepare anyone else who might go through a similar thing. You think the annual ritual of "fixing a few things" around Thanksgiving is rough for the average tech person? This is rougher.

And by the way, Mom's out and doing fine, thanks for asking!

Let's get to it.

Part 1: Preparation is a path to peace of mind

When Mom went to the hospital, I had no idea she'd be there through several surgeries and over a month of recovery. Needless to say, her health and wellbeing ate my calendar whole. And at the same time, the switch from her being completely independent to me suddenly needing to take over everything happened in a blink.

We got lucky. We were prepared. I cannot imagine how much harder this whole thing would've been if we weren't.

Consider this me begging you, dear readers: make this kind of preparation a top priority. We buy health insurance because we take health risks (and costs!) seriously. We need to take the risks and costs of someone's cyber existence just as seriously.

Simply put: clean digital habits now equal a lot less cybersecurity chaos later.

What are the risks?

On the small scale, there are the fairly mundane risks: spam filling up, bills going unpaid, important notices getting missed.

On the giant scale, there's the ginormous risk of identity theft. Healthcare data is incredibly valuable, but it's also time-sensitive. While your person is in the hospital, if that hospital has a data breach or someone's actively siphoning data out the back door (fancy term: exfiltration), your person's data can end up in a whole range of identity theft scams. Which means coming home from the hospital to a host of financial and other troubles.

These are the tradeoffs we make so hospitals can share your medical records with each other easily (the fancier term is interoperability). And if you already know hospitals aren't paying their medical staff enough, I can pretty much guarantee their cybersecurity program is held together with duct tape and hope.

Assume your person's personal (PII) and healthcare (PHI) data is for sale within 48 hours of them being checked in.

Everything rests on access

Simply put: your person's whole digital life falls apart unless somebody's holding the pieces together. You must know your person's access passwords for their phones and their computers. Without this... lots of awfulness is possible. Make sure you can open their phone, and log into their computer.

Equally importantly, make sure your phone number is on everything as a backup for two-factor authentication (2FA) — that little code text your bank sends you. There will come a moment where you need that verification but don't have physical access to their phone.

Password managers

Whether your person uses a digital password manager like Proton, or writes everything down in a paper binder, you have to be able to access those passwords. Get clarity on this now. Do a quarterly check-in to make sure everything's still current.

In enterprise tech, we joke that a cold backup nobody's tested isn't a backup, it's just expensive storage. Family tech is no different. Test your access to literally everything while your person can still walk you through it. Ask them now: where'd you write down that new password when the account forced a change and you forgot to update the password manager?

I thought I had this dialed in. Then I went to pay one of Mom's bills and discovered that, despite being literally on the account, I didn't have the right password. My attempts to get in locked the account down — which is one way of protecting it, but sucks when bills start bouncing.

What do I do first?

Getting ahead of this matters more than you think. Luckily, I'd already been working with Mom to protect her online space, but this is such an easy thing to overlook "until later." I'm here to tell you: sometimes you run out of time more abruptly than you could imagine.

1. Get your person on a password manager. We at the 'Tea recommend Proton, but there are plenty of other options. (There’s an ad for Proton below. Signing up for a free email account will also get you access to their free password manager.) Make sure you have the main password so you can get into necessary accounts.

2. Understand your person's financial picture. Do they have bills to attend to? What are their autodeposits and deductions? Make sure you have the access you need to keep the cash flowing.

3. Monitor their digital life carefully. Check for all the signs of identity theft on at least a weekly basis. More frequent is better.

The good news

Mom's fine. The bills got paid. The accounts stayed locked down tight instead of locked out. None of that was luck — it was prep, done months before anyone needed it.

Next issue

What to do once your person is actually admitted, and how to keep their digital life intact while they're too busy healing to worry about it.

SPONSORED
Every sponsor here is something we actually use or genuinely believe in. Click through if something resonates - it means the world to us and helps keep CybersecuriTea coming your way.

Privacy-first email. Built for real protection.

End-to-end encrypted, ad-free, and open-source. Proton Mail protects your inbox with zero data tracking.

Explore Proton’s benefits

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

We here at the 'Tea spend a lot of time thinking about cybersecurity trends so you don't have to. Every morning I trawl my favorite cyber news sources and try to connect the dots, then turn that into a newsletter that actually fits the moment we're living in.

Honestly, I could write this thing twice a day right now. Things in the cybersecurity world are escalating fast, and you deserve explanations for all of it. But here's the thing: as much as I want to nerd out about the cool, scary stuff, what matters more right now is harm reduction. Boring? Maybe. Important? Extremely.

I've talked to a lot of you in person, and the story's always the same: you fully intend to do the thing, you're just busy. I get it. But people are getting hurt right now because of how volatile the cyber world has gotten, and "I'll get to it" isn't a safety plan. You need to take steps today to keep you and yours safe. I know it's about as fun as doing your taxes. It is also, unlike your taxes, something you can't put off until April.

Change your browser

This should take you about two hours. (Grab a cup of your favorite comfort caffeine, and do the thing.)

1. Download Vivaldi.

2. Migrate everything from your old browser (Vivaldi gives you the tools to do this — it's easier than you think).

3. Delete Chrome from your life and never look back.

Vivaldi has a learning curve — there are a lot of customization options, and you will get a little lost at first. That's fine. As I mentioned in The Old Internet Isn't Gone, we all need to make better choices about our technology, and stop quietly funding companies whose entire business model runs on harvesting your data and selling your attention to the highest bidder. Vivaldi is one of the better choices you can make — it's a browser that's actually on your side, instead of just pretending to be.

Reduce your data footprint

This is a maintenance activity. Consider adding it to your monthly Internet Hygiene Date. (Yes, that's a thing. Yes, you should have one.)

We posted this excellent piece from our friends at 404 Media the other day: ICE Appears to Be Buying Immigrants' Tax Identifiers from a Data Broker.

Chilling, right? That's not a hypothetical. That's what happens when your data sits around in a broker's database, for sale to literally anyone with a credit card.

Drop everything. Read this: They're going to keep selling it. Here's how to keep deleting it.

Then pick one thing off that list, and do it. Two weeks from now, do another. Chip away at the mountain of your own data until there's nothing left but dust. Getting your data out of the hands of people who profit off it at your expense isn't a nice-to-have. It's digital safety and physical safety, and right now, those are the same thing.

Build the habit

Set calendar reminders. Block off time. Call a friend and body-double the activity — it works better than you'd think to have someone else just be there while you do the thing. There are a million hacks for getting yourself to actually follow through. This newsletter's shorter than most because I genuinely just need you to focus: get those two things done. Then keep that same level of vigilance going for the rest of your digital life.

It's not glamorous work. Nobody's writing thrillers about the person who finally deleted themselves from Spokeo. But the people doing the boring, unsexy work of locking down their digital lives right now? They're the ones who'll be fine later. Be one of them.

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

I recently came across this gorgeous piece of writing: The Boring Internet, by Terry Godier.

It's worth every moment of your time, and then some. I've been musing over it for a while now, and wanted to talk it through with all of you.

I'm in a Facebook group that's pretty much the only location of its kind — incredibly valuable, genuinely irreplaceable information lives there. Two years ago, when Facebook got really, really squirrely from a UX perspective, I begged the group moderators to let me set up a forum, completely offsite. They agreed. A few of us pitched in and built it.

And then a really, really weird thing happened. Most people didn't understand how forums work, despite the fact that the entire social internet started in forum frameworks. Platforms have trained us to be passive consumers of the feed, so thoroughly that people have forgotten what it's like to go out and curate their own content. I found myself coaching grown adults on the old ways of being on the internet. It was a deeply weird feeling.

Reading Godier's post, I'm pretty sure he gets me.

Enshittification

Since the lovely Cory Doctorow coined the term, we've all gotten better at naming the phenomenon: software that used to be a solid product you bought once has become a constantly shifting, not-always-for-the-better subscription. Nobody's happy about it. But somehow, nobody remembers that there's a whole other internet underneath the cruft and the venture capital; one where the actual spirit of the thing still exists, still making good stuff for the betterment of everyone.

The layer where every human activity became a venture-backed destination, every destination became a feed, every feed became ad inventory, and every ad market became a machine for producing more things to interrupt you with.

Underneath that layer is another internet: older, slower, less polished, harder to monetize, and much harder to kill.

Ownership

Our right to own our own technology has been getting chipped away at for a really, really long time. Digital Rights Management (DRM). Software as a Service (SaaS). Terms of Service so dense and one-sided no mere mortal could reasonably agree to them with full understanding. And don't even get me started on the shitshow that is Right to Repair — people buy things, from computers to tractors, and then discover they can't fix them without voiding the warranty and eating a penalty for the trouble.

Not that long ago, Amazon decided not to support really old Kindles, and bricked them. The outcry was predictable.

So was Amazon's reasoning: profit, not sustainability or customer loyalty. So they made a bunch of genuinely sturdy devices obsolete on purpose. If we'd been listening to Cory Doctorow and EFF.org's rants against DRM all along, we'd have seen it coming, and we'd have made different choices. (Like keeping our libraries in Calibre, a lovely piece of software that's been quietly doing the needful, with zero fanfare, this whole time.)

Turns out the old internet was built by enthusiasts, for other enthusiasts — and it's still here. You don't actually need platforms, techbros, or a monetization strategy. The old internet is still within reach of all of us.

The self-curated world

When you press play on a SomaFM stream, your browser does not ask a social graph whether the song is relevant. No algorithm decides what plays next because it predicts you are likely to remain engaged for another seven minutes. No advertiser shapes the rotation. No platform tries to convert the moment into a growth loop.

Things made for joy feel different from things made for profit. I think we all know that, instinctively. And I think we can all feel the slide from shiny to enshittified picking up speed. That's part of why Europe is moving away from American SaaS altogether.

Psychologically, though, especially where platforms are concerned, we've become the people on the ships in Wall-E. And passive consumption of content is a very different animal from intentional consumption. Social media just throws a stream of stuff at you, and you passively absorb whatever rolls through. We at the 'Tea have argued strongly against letting it do that to you. Intentional consumption means reaching for what you actually care about and letting the noise fall away. It makes room for deep focus. It lets you build nuanced thinking about the things that matter to you — the exact thing social media is designed to erode.

The learning curve

Part of why the world moved to the new shiny is that it's designed to be easy. There's not much of a learning curve to Facebook, the way there is to IRC (Internet Relay Chat: basically a very old-school, very unglamorous way to chat in real time, with none of the bells and whistles). But is dodging that learning curve worth the price of your autonomy, your data, your privacy, your ownership, all the other costs of platform life?

A learning curve can feel like gatekeeping. It's actually the opposite. When you put in the work to understand how something really works, nobody can take that from you. And — this is the part that matters — nobody can monetize your ignorance, manipulate you with propaganda, or profit off data you never meant to hand over.

Right here, right now

You don't have to wait for someone to save you. Godier's point is that the boring internet is right there, sitting beside all the platformery you use every day. The difference between the enshittified internet and the boring one is just the choices we make. And we get that chance daily.

So next time you catch yourself doom-scrolling a feed you didn't choose, remember: there's a door right next to you, and it's not even locked.

SPONSORED
Every sponsor here is something we actually use or genuinely believe in. Click through if something resonates - it means the world to us and helps keep CybersecuriTea coming your way.

Free email without sacrificing your privacy

Gmail tracks you. Proton doesn’t. Get private email that puts your data — and your privacy — first.

Ditch the Gmail data grab

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Earlier this week, CybersecuriTea hit a milestone: one year old.

Along the way, we've talked about your digital footprint and why it's worth cleaning up. We showed you how to help your parents dodge text scams and how to build passwords that don't rely on your pet's name. We've tried to educate without talking down, without tech jargon, and without scaring you — because we talk a lot around here about FUD (fear, uncertainty, and doubt), and we refuse to traffic in it. Everyone should be able to understand cybersecurity. You don't need a degree. Just a willingness to dig in.

You might have noticed a different name in the byline this week. I'm the other half of CybersecuriTea.

My background isn't cybersecurity — it's TV and film: production, post-production, visual effects. My thing is communicating ideas. I'm mostly the one behind the scenes: the words are all Laureen, but the visuals and the website are me. She tracks every development in the security landscape; I make sure we have somewhere to put it. I'm the gadget nerd. The one with the 3D printer. The one downloading the new apps before anyone asks me to.

I wasn't the cybersecurity expert. But here's the thing — I didn't have to be.

Over the years, just working alongside Laureen and being her friend, I absorbed more than I realized. We'd talk; I'd look up the terms I didn't know. She'd send links; I'd read them. She'd explain something in the news and it would actually stick. And at some point we both looked around and thought: more people need a Laureen.

So a little over a year ago, we launched this newsletter. So everyone could have one.

And now here we are, starting year two. We're going to keep doing what we do — educating with a healthy side of sarcasm. But we're also ready to grow a little, and we want your input before we do.

We're thinking about expanding what CybersecuriTea offers beyond the newsletter. But instead of guessing what would actually be useful to you, we figured we'd just ask.

Thank you for being here. Thank you for digging in. Year one was just the warmup.

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

A few weeks ago I flew to a business meeting and back, and I am freaking appalled at how many things that make you less secure are being marketed as things that make you more secure.

As Sports Team says, it's all just lies, lies, lies, lies.

Let's start with...

Clear

A young salesman literally leapt out into the walkway, grabbed my arm, and tried to herd me over to the Clear station. "Tired of long TSA lines?" he asked. "Just stand here!" — and then he tried to take my picture.

I dodged, choked out "no thank you!", and channeled my inner Bilbo Baggins. There was no explanation of what Clear actually does. No mention of what I'd be exchanging for the convenience. Just a quick flash of a camera, and my biometric data (the measurements of your physical features — your face, your fingerprints — that are unique to you and, critically, can never be changed) would've been theirs.

Now, Clear will tell you they don't sell your biometric data. And technically, that's their policy. But here's what they do: they operate a fast-growing commercial identity platform now used by Docusign, T-Mobile, Medicare, and others — built entirely on the biometric profiles of their members. Your face isn't being sold like a mailing list. It's being used to build and power a commercial network that went public at a $4.5 billion valuation. The question isn't just "who buys it." It's: what gets built with it, who controls it, and what happens when things go wrong?

(For the record: Clear has had three notable security incidents, if that helps make the case.)

TSA

The line really wasn't all that bad, for the record. I got to the front, where they check your passport and ticket. "Stand here please," the agent said — and I realized, a split second later, that she'd moved me directly in front of a camera.

"No thank you!" I said again. She looked puzzled, said "fine," and that was that.

(They tried the exact same thing after the bag scan. Twice in one trip. Cool, cool.)

The TSA says photos taken during these screenings are deleted within 24 hours. Maybe! But why does the TSA need to take my picture when they literally just looked at my passport photo? Because every scan helps normalize the infrastructure — and systems built for convenience have a way of expanding their mandate over time.

What the heck is going on?

Here's the deal: your biometric data is being collected to build out surveillance infrastructure. That's it. That's the whole thing.

Is some of this data used for legitimate purposes? Sure. But given how many verifiably awful people are involved in building tools with your data, the right move is to block biometric collection wherever and however you can. And unlike a stolen password, you can't reset your face.

What can I do?

Opt out. Every time. Always.

For a deeper dive, YK Hong's "Opt Out of Biometric Theft, Facial Recognition Tech, and Data Scraping" is an excellent resource — practical, thorough, and free.

There is no reason anyone needs your photo or your fingerprint to let you catch a flight. You don't have to comply just because someone points a camera at you. You just have to say, politely, "no thank you." That's it. That's the whole move.

SPONSORED
Every sponsor here is something we actually use or genuinely believe in. Click through if something resonates - it means the world to us and helps keep CybersecuriTea coming your way.

Take control of your chaotic inbox

Stop drowning in spam. Proton Mail keeps your inbox clean, private, and focused—without ads or filters.

Take control of your inbox

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Issue # 39

Sip previous brews. (Newsletter archive)

Recommend CybersecuriTea.

Give us feedback! We love to hear it.

We have talked about getting your data out of the hands of data brokers a lot. We did it here, and here, and here, and a few other places as well.

With Mythos (the breach-industrial complex we covered here) doing what it does, there are going to be more breaches — purely on the mathematics of the thing. Which means the cycle where data brokers have your data > you delete your data > you input your data on a different website > that site gets breached > your data gets sold again > brokers have your data > you delete your data keeps happening, but at an accelerated rate.

It's time to actually do something about it.

So, here are a few tricks beyond everything we've covered before. The goal is to come at this from every angle — so you can stop them from frisbeeing your data back and forth between them.

The Gmail trick

This works well if 1) you have Gmail (which we don't recommend — it's Google's data collection apparatus dressed up as email), or 2) you haven't started masking your email everywhere yet (which we do recommend, and covered here).

If you need to put your email down for any website, add a + and the name of the site to your address. So, fred @gmail.com becomes fred+BestBuy @gmail.com. You type it in that way, and you'll still get the email. When junk mail and phishing start rolling into the fred+BestBuy address, you'll know exactly who sold your data — and you can take it up with them.

Pre-screened credit offers

Getting one of these, in the mail, by email, or by text, is a little flag that your data has been sold. This Instagram post breaks down exactly how that works. Then head to OptOutPreScreen and get yourself opted out.

Here's the part people skip: go to the FTC's Bureau of Consumer Protection site, and your state's equivalent, and report each company that opted you in without asking. It feels like a lot the first time. It isn't. And it actually matters.

Biometric data gathering

Companies are quietly collecting biometric data — think facial recognition, voiceprints, even how you walk — and most people have no idea they've agreed to it. Keep Beyond has an opt-out specifically for this. Worth a few minutes.

The endless de-Googling

Google is... everywhere. In your search bar, your browser, your Maps app, your email, your kid's school Chromebook. Peeling it back takes some effort, but it's worth it. Vice has a good explainer on how Google has (somewhat) made this easier. And Liberation Toolbox has a practical guide for actually doing it.

But Google can be useful here, too

Before you de-Google, use Google's own tools to see what they have on you. Results About You shows you what personal information appears in Google Search, and lets you request removal. Might as well make them do some of the work.

The big ass data broker opt-out list

This is one of my favorites. Maintained by the very thorough Yael Grauer, it's exactly what it sounds like: a comprehensive, regularly updated list of data brokers and instructions for opting out of each one. Bookmark it. Use it. Find it here.

In the end…

It doesn't matter what you do first, or whether you do these in order. Just pick one. Do that. Then pick another. Every opt-out is one less company with your information, one less door left unlocked. You're not trying to be perfect. You're trying to be harder to mess with than the next person. And that? That's very doable.

Read more:

• This Instagram post on pre-screened credit offers

• OptOutPreScreen

• Keep Beyond biometric opt-out

• Vice: Google made it easier to remove info about you

• Results About You (Google)

• Liberation Toolbox: De-Google your life

• The Big-Ass Data Broker Opt-Out List

SPONSORED
Every sponsor here is something we actually use or genuinely believe in. Click through if something resonates - it means the world to us and helps keep CybersecuriTea coming your way.

Free email without sacrificing your privacy

Gmail tracks you. Proton doesn’t. Get private email that puts your data — and your privacy — first.

Ditch the Gmail data grab

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Issue # 39

Sip previous brews. (Newsletter archive)

Recommend CybersecuriTea.

Give us feedback! We love to hear it.

The thing about scams that's fascinating, from a research point of view, is that they're the flavor of digital nastiness that targets individuals rather than corporations.

The thing about scams that sucks is that they are hoovering up significant amounts of cash from everyday people, resulting in serious life consequences.

The thing about scams that's awesome is that the vast majority of them can be utterly stopped by cultivating this one, weird habit…

Don't click on the link

That's it. If you're a normal person living a normal life — and not, like, an investigative reporter or spy or something — you can eliminate the vast majority of scam exposure by just not clicking on incoming links. (But wait, aren't the links in this newsletter coming into your inbox? Well, yes. I’m talking about the text with the “OMG CLICK THIS URGENTLY!!!!!” link. Those folks are scammers.)

Incoming links are sneaky little data packages, and we've gone deep on that before.

We've been trained and conditioned to respond to emails and texts like they're all legitimate. But we know not to respond to junk mail, right? We have the skills. We have the discernment. Keeping yourself safe from scams is simply leveling this up.

This is especially true for the Offline Generation that came of age before the internet — the folks for whom messages from machines are still somewhat magical.

Enchanted by email

Back at the turn of the prior century, mail was a big deal. It was precious, hard to come by, and when it showed up, it meant something. My great grandmother, who lived on a ranch in rural Montana, spoke in glowing, reverent terms about the first time she got a Sears-Roebuck catalog in the mail. For those folks, mail never really lost that Christmas-like surprise-and-joy effect.

A generation or two later, mail wasn't really a thing, but phone calls were still amazing.

And then computers happened. And for the generations that were adults when that happened, email never really lost that Christmas-like surprise-and-joy effect.

You see where I'm going with this, right? Media that existed when I was a child isn't interesting, it's ubiquitous. Media that was created during my lifetime is amazing. So you can't really blame the people who grew up before the internet for being a little awestruck by technology. To them, receiving an email with a link in it is still a magical thing. Convincing them otherwise is hard — but it's one of the most important digital safety conversations you can have with someone you love.

Why this is so important right now

Eight billion reasons

The 2025 FBI IC3 report just came out, and the elder fraud statistic is $8 billion lost by elderly people due to scams.

Eight. Billion.

Makes me angry. Makes me want to teach everyone to not click on links. Heyyyyy, that's what I'm doing.

But what about actual hacking?

As I was writing this piece, this came across my feed. A leaked government hacking tool that can compromise iPhones. Sounds terrifying — and I want you to keep reading, because the punchline is genuinely satisfying.

It all hinges on this one line: "when it visits a website containing the exploitation code."

There you are. The tool does not work unless you click on a compromised link. Yes, it's more work and more hassle to type in URLs and navigate to necessary content directly — but it's also way more secure. Even the scary government stuff requires the click.

What can I do about it?

Help your elders understand that there is a literal zero chance that something important to their life arrives by way of a random text. Teach them to always go directly to the source to confirm anything. Teach them to screencap and send. Teach them to be scam-resilient. Send them a copy of this newsletter.

But most importantly? Never click on links in email or in texts. As we've written before, links are sneaky. If you click on a link with a bunch of junk after a ? (like, say, every Amazon link ever), you're broadcasting all kinds of information to all kinds of places.

Every one of the scams that built that $8 billion number started with someone clicking a link.

The people you love don't have to be part of that number. And honestly? You're probably the only person in their life who's going to tell them so. That's not a burden — that's a superpower. Use it.

SPONSORED
Every sponsor here is something we actually use or genuinely believe in. Click through if something resonates - it means the world to us and helps keep CybersecuriTea coming your way.

Tired of news that feels like noise?

Every day, 4.5 million readers turn to 1440 for their factual news fix. We sift through 100+ sources to bring you a complete summary of politics, global events, business, and culture — all in a brief 5-minute email. No spin. No slant. Just clarity.

Join for free today!

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Issue # 37

Sip previous brews. (Newsletter archive)

Recommend CybersecuriTea.

Give us feedback! We love to hear it.

Recently, a friend of mine changed her Facebook profile picture from something abstract to a really pretty picture of herself. I complimented the change, and then sat back and watched the bots descend.

(The screenshot above is what landed in her inbox within 24 hours. She'd been using an avatar for years. Now you know why.)

What the research says

Here's the thing about the beauty industry: it has spent decades and billions of dollars convincing people — women, specifically — that they are not enough. And one measurable side effect of all that damage? When a woman changes her profile picture to show her actual face, algorithms and scammers alike read it as a signal. She's feeling herself today. She might be lonely. She might be vulnerable.

There have been quite a few studies on this. And bad actors have clearly done their homework, because romance scams are specifically engineered to show up in that moment.

What I say

This newsletter is about cybersecurity, not psychology, so I'm going to spare you the full spiral on influencer culture and the attention economy. TL;DR: they make money by damaging you, and are to be avoided at all costs.

What I will say, from a human-centered cybersecurity perspective, is this: there is an entire industry that has figured out how to monetize human pain — and built automated tools to scale it. I have thoughts about that. None of them are printable.

What can you do?

Glad you asked. Here's how to fight back:

• Reach out publicly. Comment directly on the thread with a link to this article. Roaches, meet sunlight.

• Check in privately. Make sure the person being targeted knows this is a scam — not a compliment, not a coincidence.

• Block and report. Will the platform do anything? Probably not. Will it feel satisfying? Genuinely, yes. Do it anyway.

• Clean your data footprint. This one matters more than people realize. Scammers can follow you across platforms — if they can find you. Make it hard. You can use DeleteMe (affiliate link), or DIY it with the epic Big-Ass Data Broker Opt-Out List — created and maintained by the amazing Yael Grauer. Seriously. Clean your data footprint.

A final thought

Scams target people who are alone or lonely. That's not an accident — that's the business model.

And it's something we can actually fight, directly, in the real world. Compliment people. Build people up. Remind them they're not invisible. Speak up, in every space you're in, about what it looks like when capitalism profits off of human misery.

Maybe even log off and go be with actual humans in 3D space? Radical, I know. But it just might work.

SPONSORED
Every sponsor here is something we actually use or genuinely believe in. Click through if something resonates - it means the world to us and helps keep CybersecuriTea coming your way.

Free email without sacrificing your privacy

Gmail tracks you. Proton doesn’t. Get private email that puts your data — and your privacy — first.

Ditch the Gmail data grab

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Issue # 37

Sip previous brews. (Newsletter archive)

Recommend CybersecuriTea.

Give us feedback! We love to hear it.

Last time, we talked about what Mythos is and why the security world is losing its mind. Today: what actually happened after it launched, what it means for regular people, and what you can do about it.

Enter Glasswing

Right about the same time as everyone figured out exactly how much of a big deal Mythos was going to be, Anthropic announced Project Glasswing:

"Today we're announcing Project Glasswing, a new initiative that brings together Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks in an effort to secure the world's most critical software."

Sounds great, right? Except it isn't really security. It's marketing.

As William Henderson put it: "Project Glasswing is an enterprise marketing program posing as a socially responsible research breakthrough. Whether the threats are real or not, I don't buy the intentions for a minute."

And then, in the week between when I wrote this and when it was published, we discovered that Mythos was leaked on the same day it was "carefully released" to Glasswing.

The whole point of Glasswing was to use the same big corporations that allowed tech debt to accumulate in the first place to protect us from the consequences of that accumulation. That positioning is now void. The genie is out of the bottle. You can't put the toothpaste back in the tube. You can't un-ring the bell.  None of that is getting undone.

Things to think about

Part of the reason we felt we had to write this piece right now is because the New York Times published "It's the End of the Internet as We Know It" this week, and we wanted to make sure you had something to read that wasn't designed to send you spiraling.

Here's the thing: Mythos doesn't just expose vulnerabilities — it also opens up exploits. It flags that something is broken, but thanks to the rise of Vibe Scamming (also brought to you by AI, naturally), companies now have two jobs: fix the vulnerabilities, and block attempts to exploit them while the fixing is happening. That's a programmer problem and a cybersecurity team problem, simultaneously, at scale.

That's an enormous amount of work that produces zero shareholder value, which is exactly why it's been ignored for so long. Nobody wants to be the one to tell the Board there won't be profits for a while because the teams are doing cleanup in aisle 4. I genuinely have no idea how this shakes out — and neither does anyone else. Glasswing suggests some level of accountability, but the docs I've seen don't touch the part where someone has to explain this to the CFO anywhere.

Everyone's talking about how organizations are going to need to overhaul their processes (and oh, are they ever). What nobody's asking is what a software ecosystem that's suddenly wall-to-wall with vulnerabilities means for the people who use that software. You know — you and me.

That's what we do here at the 'Tea. So here we go.

What'cha gonna do?

Update everything, all the time

The era of updating your stuff once a week, once a month, or whenever you feel like it is over. Teams are going to be pushing patches at increasing frequency, and you need to keep up.

• Turn on auto-updates wherever you can. If you're not sure something has auto-update, go look it up. Seriously.

• Check for updates across everything you use. Phone apps, browser, operating system, desktop applications. Also any smart devices — your Roomba, your fridge, your smart home setup. Also your car. Software. Firmware. Everything.

• Don't put off updates. If you see an "update available" notification on anything, drop what you're doing and do it now.

• Restart your devices daily. The easiest way to stay clean is to shut everything down at the end of the day and turn it back on in the morning.

• Figure out your workarounds. What's your plan if your smart coffeemaker goes down? It sounds silly until it isn't.

Back up, back up, back up some more

With Mythos in the picture, you will never know which vulnerabilities got announced in which software you use, or which ones will get fixed when. Or, to put it another way, not everyone announces patches in a timely manner. There is literally no way to track it, and right now there's no legislation forcing companies to disclose anything. You should assume that anything you use could go down at any moment, experience data loss, or be unrecoverable.

Back up anything that matters to you.

• If you can sync to your desktop, do that.

• If you can't, set a recurring calendar reminder to download your files from the cloud — iCloud, Google Drive, OneDrive, your password manager, all of it.

Passwords, MFA, the usual

We've been talking about this for a while. Consider this your klaxon.

• Password manager. Proton Pass is our current favorite.

• MFA (multifactor authentication) everywhere. No exceptions.

• Freeze your credit.

• Reduce your data footprint. Especially: delete every account you possibly can. Do you really need that Tumblr from the 90s? Download the data, then delete the account.

Death, or renaissance? You decide.

It's going to be chaotic for a while. Existing tech culture suggests that boards aren't suddenly going to do an about-face and get serious about eliminating their tech debt. But then again, that tech debt has never been exposed this thoroughly, this publicly, at this speed before.

From the cybersecurity and consumer side of things, it's possible that Mythos — and the adversarial AIs that follow it — will finally be the forcing function that makes technology slow down and fix its stuff, the way it should have been doing all along.

Want to learn more?

A few of our favorite writers on this topic, so far. We'll update this list as more emerge.

• Vulnapalooza: Why Anthropic's Mythos Is the Loudest Headliner Nobody Bought Tickets To — Katie Moussouris explains why this is just going to keep being a thing. Spectacular piece.
  

• Mythos, Memory Loss, and the Part InfoSec Keeps Missing — Justin Elze reminds us that panic isn't helpful, but underreaction hasn't done much good either.
  

• Project Glasswing Is Impressive. The Questions Nobody Asked Are More Interesting — Michael Reichstein: "The cybersecurity industry has a structural problem that predates AI, predates Glasswing, and will outlast both if nobody addresses it directly. It is the gap between knowing about a vulnerability and actually fixing it." He's absolutely right.

SPONSORED
Every sponsor here is something we actually use or genuinely believe in. Click through if something resonates - it means the world to us and helps keep CybersecuriTea coming your way.

Free email without sacrificing your privacy

Gmail tracks you. Proton doesn’t. Get private email that puts your data — and your privacy — first.

Ditch the Gmail data grab

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Issue # 36

Sip previous brews. (Newsletter archive)

Recommend CybersecuriTea.

Give us feedback! We love to hear it.

Mythos is about to become incredibly relevant to the digital world we live in, so I wanted to take some time to break it down for everyone. There's enough here to cover that we're doing it in two parts — Tuesday and Thursday.

Let's get into it.

I've been sitting on this one for a few days. Waiting for the hot takes to die down a bit, same as plenty of other cybersecurity writers. There's a whole lot here to unpack, and I wanted to make sure everyone had had time to read what they were going to read before I added to the pile.

What is Mythos, anyway?

So glad you asked.

Mythos is an AI built by Anthropic. It just happens to have a particular talent for cybersecurity. Which means it is capable of poking holes in everything. We'll get to the full implications in a bit — but first, to understand why Mythos is flipping so many people out, we need to take a quick side quest into how the internet and software were actually built.

(Spoiler: it's not reassuring.)

The way the internet is built

We've seen this cartoon a lot lately, blessings to XKCD. Read through the explainer; it makes the whole problem with Mythos make a lot more sense.

The thankless thing

Nobody's dug down to the data on this, as far as I know — but pretty much the entire software industry runs on bits of open-source software that have been thanklessly maintained by individual contributors since the internet was new. (See above, re: the cartoon.) The industry loves these programs, because they're free.

Here's the catch: companies don't necessarily check back to make sure those sources are still okay. So if something changes in the world of programming but the original source never gets patched to account for it, you end up with a lot of quiet breakage that isn't on anyone's radar.

Technical debt

Here's the other big piece of the puzzle.

You ever hear a film director say, "We'll fix it in post"? It's what they say on set when a take is nearly perfect but there's a rogue coffee cup on the table that shouldn't be there — like this one. Fixing it would mean another take, so they tell the production team to have visual effects remove it later. We all do this in our daily lives. The repair that's good enough to "make do" but not good enough to be permanent. The thing that gets forgotten. And then those things accumulate.

It's like when you're moving and you shove a bunch of random stuff into a box and label it "for later." You never get back to it before the next move. And before you know it, you've got a whole stack of "for later" boxes, full of things that might be nothing — or might be important.

We don't circle back because we're busy people in a culture where "move fast and break things" is somehow an acceptable philosophy. We're exhausted. We're on deadline. Things get shoved down the priority list until they demand to be dealt with. Sorta like taxes, now that I think about it.

In tech, that accumulation has a name: tech debt.

There's one more thing that makes it worse: the way layoffs are handled. When companies lay people off, they lose the institutional knowledge of what needed to be dealt with, what digital skeletons were in the closet, and what's in which box in the garage. Most companies aren't fully aware of their own tech debt profile — because the person who was aware got let go, usually without anything resembling a knowledge transfer. And so the countdown begins to the moment the unmaintained thing breaks.

So what's the connection?

I'm wildly oversimplifying, but here's the gist: Mythos is an AI tool designed to find vulnerabilities in software. And it is incredibly, terrifyingly good at it.

The problem is that the software industry has been accumulating tech debt since the beginning — and Mythos is throwing all of that debt in their faces, all at once, by finding every hole in the software and every skeleton in every closet.

That's bad news in a lot of ways. But nowhere is it more devastating than cybersecurity.

It's almost an industry joke how often cybersecurity teams identify vulnerabilities and are then directed to ignore them. This has been accumulating for decades. There is a lot of brokenness just waiting to be noticed — and Mythos is finding it at hyperspeed.

How fast is fast?

This fast. From Anthropic Warns That "Reckless" Claude Mythos Escaped a Sandbox Environment During Testing:

Not gonna lie, I cackled. There are not enough Tums in the world for that researcher.

So what's the actual problem?

If you discovered your front door lock was broken, you wouldn't announce it to the neighborhood. You'd keep quiet until you could get it fixed, because crime. Same deal here.

Companies know there are vulnerabilities all over their software. They just never expected to have to deal with all of them at once. And none of them are resourced to fix things as fast as Mythos can find and expose them — partly because the industry has been laying off cybersecurity staff for almost a decade now.

So picture it: your whole neighborhood's doors blow open at the same time, while the police are on strike.

There is no one coming to stop what happens next.

Part two (and what you can do to shield yourself from the fallout), coming Thursday.

SPONSORED
Every sponsor here is something we actually use or genuinely believe in. Click through if something resonates - it means the world to us and helps keep CybersecuriTea coming your way.

Daily news for curious minds.

Be the smartest person in the room. 1440 navigates 100+ sources to deliver a comprehensive, unbiased news roundup — politics, business, culture, and more — in a quick, 5-minute read. Completely free, completely factual.

Sign up now!

Join us for tea!

CybersecuriTea is a free, plain-English guide to digital safety, designed for families, friends, and the folks you love. Subscribe today and get weekly tips to help keep your digital life secure.

Or, if you’d like to support our work and keep the kettle warm for everyone:

Issue # 36

Sip previous brews. (Newsletter archive)

Recommend CybersecuriTea.

Give us feedback! We love to hear it.