Agenda

Ground rules

• Back up before you change anything.
• Never type a password or recovery phrase into a chat, or into a site you reached from a link.
• One change at a time. If you get locked out of anything, stop and grab a helper.
• Personal devices only, not work laptops.
• Join the leaderboard with a code name. Only your counts show.

Where everyone starts: the core list, in this order

1. Main email: passkey or authenticator app; recovery phone and email are yours; remove unknown devices, forwarding rules and old "Sign in with Google/Apple" apps.
2. Password manager: master password on paper; move your top 5 accounts in with new passwords (email, bank, phone carrier, Apple or Google, most-used shopping).
3. Phone number: carrier account PIN plus port-out or SIM lock.
4. Phone and computer: automatic updates on; 6+ digit phone passcode; Stolen Device Protection (iPhone) or Theft Protection (Android); Find My on.
5. Your apps, not just the system (MacUpdater has shut down, so use these):
   • Mac: App Store, then Updates; and "Check for Updates" in each app's menu (browsers, Zoom, Office, creative apps).
   • Windows: Microsoft Store, then Library, then Get updates; or type winget upgrade --all in Terminal.
   • Homebrew users: brew outdated, then brew upgrade.
   • Hidden or bundled tools that updaters miss (like FFmpeg inside other apps): the site's "Find hidden, out-of-date or risky software and code" prompt.
6. Money: strongest sign-in and alerts on bank and cards; US credit freeze at Equifax, Experian and TransUnion.
7. Backup: one copy that isn't just cloud sync, and restore one file to prove it works.
8. Remote access, if you use it: reach your own computers, cameras and servers only through a private network like Tailscale (or the maker's app), with its login on a passkey. Close any ports opened to the internet.

Bonus, 5 minutes: a family code word agreed in person, and "hang up and call back on a number you look up."

Key concepts

1. Your email is the master key. Every "forgot password" link goes there, so whoever controls it controls everything else. That's why it's first.
2. Some sign-ins can be fooled, some can't. Text codes and app codes can be phished or stolen with your number; passkeys and security keys only work on the real site. Use the strongest one each account offers.
3. One breach becomes ten when passwords are reused. A password manager gives every account its own password, so a leak stays contained.
4. Updates close holes attackers already know about. Turn on automatic updates, and replace devices (and routers) that no longer get them.
5. Private network versus the open internet (Tailscale). Anything with an open port can be found and attacked by anyone. A private network like Tailscale lets only your own devices reach each other, so nothing is exposed in the first place.
6. Keep gadgets on their own network. A hacked camera or smart plug on the guest Wi-Fi can't reach your laptop.
7. Sync is not a backup. Cloud sync copies deletions and ransomware too; a real backup is a separate copy you've tested.
8. Scams run on urgency and secrecy. "Act now, don't tell anyone" is the tell. Hang up and call back on a number you look up yourself.
9. AI tools see what you show them. Anything a scan finds lands in the chat transcript, so approve kinds of checks deliberately and delete the chat afterward.

Then by topic (the site's focus checkboxes)

• Actively hacked: triage first, one on one with a helper: secure main email and money from a trusted device.
• Smart home: router first (admin password, updates, remote admin and UPnP off), gadgets on the guest network, 2FA on camera and doorbell accounts. See "Your smart home: risks by device" on the resources page.
• Car: find your car's type on the resources page ("Your car: risks by type") and do its fixes; secure the car app's account. Cars most at risk are listed under "Cars at risk" below.
• Crypto: recovery phrase on paper, offline; 2FA and withdrawal allowlists on exchanges.
• Websites: 2FA on host and domain registrar; updates; backups you control.
• Code or creative apps: run the hidden-software prompt.
• Public profile: security keys, data broker removal, Signal username.

Before people leave

• Update your leaderboard numbers.
• Pick 3 things to finish this week.
• Delete the Claude chats and any files they saved.
• Set a reminder to do this again in 3 months.

Topics to discuss

Passkeys

• What: you sign in with your phone or computer's face, fingerprint or PIN instead of a password. The passkey only works on the real site, so a fake sign-in page gets nothing.
• Use them for: your main email, Apple, Google or Microsoft account, your password manager, and banks that offer them.
• Know: they live in Apple Passwords, Google Password Manager, 1Password or Bitwarden and sync across your devices. Keep a recovery path (backup codes, or a second device). A passkey doesn't help if your computer itself is infected.

Security keys (YubiKey and similar)

• What: a small physical key you plug in or tap. It does the same fake-site-proof check as a passkey, on a device thieves can't copy over the internet.
• Useful for: your highest-value accounts (main email, Apple or Google, password manager, crypto exchanges, domain registrar), and anyone who might be personally targeted. Google's Advanced Protection uses them.
• Not useful for: accounts that don't support them; malware already on your computer using a session you're signed into; storing crypto (that's a hardware wallet, a different device). Not a must for everyone if you already use passkeys.
• Rules: buy two, register both, keep one at home. Buy from the maker or a big store, never a marketplace seller.

Smart home (IoT)

• The router is the most important gadget: change its admin password, turn on updates, turn off remote administration and UPnP, and replace it if it no longer gets updates.
• Gadgets on the guest network, so a hacked camera or plug can't reach your laptop.
• Camera, doorbell and lock accounts: a unique password and 2FA, and remove old users and codes.
• Never open ports to reach things from away. Use the maker's app or a private network like Tailscale.

AI and LLM tradeoffs

• Three ways to use AI:
  • Cloud (Claude, ChatGPT): the most capable. Your chats go to the company and are kept under its settings, so check training and memory settings and delete sensitive chats.
  • Private cloud (for example Tinfoil): open models run in locked hardware that even the provider can't read, and you can verify that. Less capable than the top models, and paid.
  • Local (on your own computer, for example Ollama): nothing leaves your machine, but it needs a strong computer and lots of storage, and it's slower and less capable.
• AI agents on your computer: approve the kinds of actions up front, never use a mode that skips all approvals, and remember that anything a scan finds lands in the transcript.
• Hidden instructions: web pages, emails and documents can contain text meant to trick an AI agent into doing something else. Treat an agent like a new assistant: limited access, and you review anything that sends, buys or deletes.
• AI tools and plug-ins are software too: install from known sources, and wait about two days before installing brand-new versions of anything.

Cars at risk

• Free fixes first (check these before anything else):
  • 2011 to 2022 Hyundai or Kia started with a turn key: a free anti-theft software update at a dealer (check by VIN on the maker's site), and a free ignition protector from the December 2025 multistate settlement.
  • Chevrolet Camaro: a free GM software update (campaign started March 2025).
  • Tesla: turn on PIN to Drive (Controls, then Safety & Security).
  • Honda (2023-and-newer Accord, Civic, CR-V): no published fix yet. Ask the dealer about security updates, and turn on HondaLink's stolen-vehicle locator if the trim has it. Add a diagnostic-port lock, as Berkeley police recommend.
• Most stolen in the US in 2025 (National Insurance Crime Bureau): Hyundai Elantra, Honda Accord, Hyundai Sonata, Chevrolet Silverado 1500, Honda Civic, Kia Optima, Ford F-150, Toyota Camry, Honda CR-V, Nissan Altima.
• Police warnings in 2026 (Berkeley, Philadelphia, Newark): 2023-and-newer Honda Accord, Civic and CR-V.
• No chip in the key: many 2011 to 2022 Hyundais and Kias started with a turn key. A dealer will install a free anti-theft fix.
• Highest theft rates per insured car (2022 to 2024 models, Highway Loss Data Institute): Chevrolet Camaro ZL1, Acura TLX, Honda CR-V hybrid.
• Most stolen in California in 2025: 2013 Hyundai Elantra, 2015 Kia Optima, 2013 Hyundai Sonata; pickups: 2001, 2002 and 2004 Chevrolet Silverado.
• Lowest risk: electric cars (the Tesla Model 3 is stolen at about 1% of the average rate); their main risk is the app account.
• What to do depends on the type of car: see "Your car: risks by type" on the resources page.

Private networks (Tailscale)

• Anything with an open port can be found and attacked by anyone on the internet. A private network lets only your own devices reach each other, so nothing is exposed. Protect its login with a passkey or security key.

Top misconceptions (and what's true)

1. "Change your passwords every few months." Forced changes lead to weaker, predictable passwords. Change one only after a breach or if someone may have it.
2. "Symbols and number swaps make a strong password." Length matters more. Let a password manager make long random ones, or use a long passphrase.
3. "Text-message codes are as good as any second step." They beat nothing, but they can be intercepted or moved with your number. Passkeys, security keys and app codes are stronger. Don't turn texts off until something better is set up.
4. "I need paid antivirus." The protection built into Windows and macOS is good. Keep it on and keep the system updated.
5. "A VPN makes me secure." It hides which sites you visit from the network you're on. It doesn't stop phishing, malware or account takeovers. It's mostly a privacy tool.
6. "Public Wi-Fi is dangerous." With encrypted sites almost everywhere, the risk is low. Don't type personal details into hotel or airport sign-in pages, and keep devices updated.
7. "Identity-theft monitoring protects me." It tells you after the fact. A free credit freeze prevents new accounts being opened in the first place.
8. "Cloud sync is my backup." Deletions and ransomware sync too. A backup is a separate copy you've tested.
9. "I'm not important enough to be targeted." Most attacks are automated and aimed at everyone. Your email and your money are worth something to someone.
10. "Security questions protect my account." The answers are often public or guessable. Use made-up answers and store them in your password manager.
11. "AI chats are private." Unless you change the settings, they're stored, and an AI agent can be fooled by hidden instructions in what it reads.