Why SMS 2FA is the weakest option for your accounts
SMS codes are better than a password alone, but they can be intercepted, redirected or phished. Here is why text message 2FA ranks last and what to use instead.
What happens to your data when a company is acquired
When a company is acquired, your account data usually goes with it. here is how that transfer works, what stays protected, and what you can do about it.
What a VPN audit report really proves
a vpn audit report proves a narrow thing: that specific claims held on specific systems during a specific window. here is how to read one without being fooled.
What a privacy policy actually commits a company to
a privacy policy is a promise a company can be held to. here is what it binds them to, what it leaves open, and how to read one in ten minutes.
Metadata explained: what encryption does not hide
Encryption hides what you say, not who you talk to, when, or from where. A plain-language guide to metadata, how it leaks, and what you can realistically do.
How to set up encrypted backups you can actually restore
Set up restic backups to Backblaze B2 with a tested restore, a key stored offline, and a monthly check, so the backup works on the day you need it.
How to secure a family member's devices without becoming IT support
A practical guide to locking down a parent's phone and laptop once, with a password manager, auto updates and backups, so you can stop being tech support.
How to opt out of data broker listings yourself
A step by step guide to finding and removing your personal information from data broker and people search sites without paying for a removal service.
How to lock down a Windows laptop for privacy
A practical Windows 10 and 11 privacy checklist: encrypt the disk, trim telemetry, switch to encrypted DNS, close inbound ports, and verify it in an evening.
How to audit what your phone apps are actually sharing
Step by step, see which servers your phone apps contact and what they send, using mitmproxy, built-in privacy reports and a spare afternoon. Free tools only.
VPN vs proxy: which do you actually need
A VPN encrypts everything leaving your device. A proxy just relays one app's traffic. Here is which one fits what you are trying to do, and what to skip.
Tor vs a VPN: what each actually hides
Tor and a VPN both hide your IP address, but from different people. Here is what each one hides, what it leaves exposed, and when to use which.
The best secure cloud storage in 2026
Seven zero-knowledge cloud storage picks I'd actually trust with client files and backups, compared on encryption, pricing, and jurisdiction.
The best private browsers in 2026, ranked
Seven private browsers ranked on tracker blocking, fingerprinting, price and real downsides, from Brave and Firefox to Mullvad, Tor and Safari.
The best privacy-focused operating systems in 2026
Five privacy-focused operating systems compared for 2026: GrapheneOS, Tails, Qubes OS, Whonix and /e/OS, with pricing, real trade-offs and who each suits.
The best email privacy services in 2026
Six email privacy services compared on encryption, jurisdiction, pricing and trade-offs, from Proton and Tuta to Fastmail and SimpleLogin aliases.
The best data broker removal services in 2026
Five paid data broker removal services and one free DIY route, compared on price, proof of removal and coverage by a Singapore-based operator in 2026.
The best ad and tracker blockers in 2026
Eight ad and tracker blockers tested across browser, DNS, and mobile in 2026, compared on price, setup effort, and how much they actually block.
Signal vs Session for private messaging
Signal and Session both promise private messaging, but they solve different problems. I compare protocols, jurisdiction, audits, and pricing to pick a winner.
Self-hosting vs trusting a provider
Self-hosting your email, cloud, or password manager sounds like more privacy. Here's what you actually gain, what you give up, and how to decide.
Proton Mail vs Tuta (Tutanota) in 2026: Full Comparison
Proton Mail and Tuta both encrypt your inbox, but they pick different fights with different governments. Here's which one fits your threat model.
NordVPN vs Proton VPN in 2026: A Full Comparison
NordVPN and Proton VPN compared on jurisdiction, audits, open source status, and price, with clear verdicts for streaming, torrenting, and everyday privacy use.
How to set up a password manager the right way
How to set up a password manager properly: pick a vault, migrate every login, lock it down with 2FA, and avoid the mistakes that quietly undo it all.
Firefox vs Brave for privacy: which should you use?
Firefox and Brave both fight tracking by default, but they solve different problems. I compare threat models, audits, and pricing to help you pick.
Bitwarden vs 1Password in 2026: Full Comparison
Bitwarden is free and open source, 1Password is polished and built for teams. I compare encryption, audits, pricing, and pick a winner per use case.
Browser Sync and Who Else Can See It
Browser sync uploads your history, passwords and open tabs to your vendor's servers. Here's who can actually see that data and how to lock it down.
What a chatbot keeps after you close the tab
A plain look at AI chatbot data retention: what gets stored, what trains future models, and which settings actually change your exposure.
Printer tracking dots: what your printer secretly adds to every page
Colour laser printers add invisible yellow tracking dots to every page. Here's what machine identification codes encode, why they exist, and the printer logs that matter more.
What Smart Home Devices Actually Send
Smart speakers aren't secretly recording everything you say. The real privacy risk in a connected home is the timestamped metadata every device sends, and almost nobody checks the settings that control it.
Authenticator apps vs hardware keys
Authenticator apps and hardware security keys both beat SMS codes, but only one resists real-time phishing. Here's how they differ and which to pick.
Buying A Second Hand Phone And What Is Still On It
A factory reset removes less than most people assume. Here's what actually survives on a used phone, how account locks work, and what to check before you buy or sell one.
Insurance quotes and the data behind the price
A breakdown of what actually happens to your data when you request an insurance quote, from credit-based scores to telematics apps to comparison site trackers.
QR Codes and What Scanning One Actually Does
A plain explanation of what happens technically when you scan a QR code, where the real risks sit, and practical checks that don't require paranoia.
Reading Your Own Credit File: What Your Credit Report Actually Reveals About You
How to check credit report data yourself, understand what a credit file actually contains, and use it as an early warning system for identity theft.
The Data Trail Behind a Food Delivery Order
A walkthrough of what food delivery app data actually collects, from GPS pings to payment tokens, and which parts of that trail you can realistically manage.
What A Background Check Actually Pulls
A breakdown of what employment background check data actually comes from, how identity gets matched to records, and why your file might contain someone else's history.
What your pharmacy and health apps actually share about you
Pharmacy loyalty programs, symptom checkers, and health apps often share more data with advertisers than most people realize. Here's how that data moves and what you can actually do about it.
What your ISP can actually see, and how to limit it
Your internet provider sees more than you think, even over HTTPS. Here's exactly what your ISP can and can't see, and simple ways to limit it.
What is browser fingerprinting and how to reduce it
Browser fingerprinting identifies you without cookies, using dozens of tiny signals. what it is, how sites use it, and what actually cuts your uniqueness down.
What you agree to at a hotel or airport login page
The terms behind one hotel tick box ran to about four thousand words and eleven minutes of reading. The clause everybody argues about is retention, and the part that actually does something is the field where you type a room number.
Disk encryption and the moment it stops protecting you
Full disk encryption protects data at rest, not data in use. Here's exactly what BitLocker, FileVault, and LUKS actually defend against, and where that protection quietly ends.
How to Find an Unwanted Bluetooth Tracker Near You
How AirTags, Tile, and similar trackers actually broadcast, how the built-in unwanted tracker alerts work, and how to do a manual sweep when you suspect one is nearby.
Helping a Parent Recover From a Scam Call
A calm, step-by-step guide to helping a parent recover after a phone scam, covering financial exposure, remote access risks, account lockdown, and reducing the odds of a repeat call.
Location History Is The Most Sensitive File You Own
Location history reveals more about you than almost any other data trail. Here's how it's collected, why it's so easy to re-identify, and what actually reduces exposure.
Masked email addresses and where they fall apart
How email alias services actually work under the hood, what they genuinely protect against, and the specific points where the protection quietly ends.
Passkeys Are Replacing Passwords, and Here's the Catch
Passkeys vs passwords, explained through how each actually works: why passkeys resist phishing, and the new failure points (recovery, syncing, lock-in) nobody mentions in the marketing.
SIM Swap Fraud and What a Carrier Lock Actually Does
How SIM swap fraud works, why phone numbers became a security weak point, and what a carrier's port-out lock does and doesn't protect against.
Untangling shared accounts after a relationship ends
A practical, threat-model-based guide to separating shared accounts after a breakup: location sharing, smart home admin access, cloud photo libraries, saved passwords, and two-factor authentication.
What is a passkey and should you use one
Passkeys are replacing passwords on Google, Apple and Amazon accounts. Here's what they are, how they work, and whether switching is worth it now.
Who can see your fitness data
The insurer is not buying your heart rate in most markets. Meanwhile the running app is publishing a map that begins and ends at your front door, and that toggle has been on since install day.
How to securely wipe a device before it leaves your hands
What actually happens when you delete a file, why factory resets work differently on modern phones than old hard drives, and how to securely wipe a device before you sell, donate, trade in, or recycle it.
Your Router Sees Every Site On The Network
How home and office routers log DNS requests from every connected device, what that reveals even when a site uses HTTPS, and where that visibility actually goes.
What happens when you ask a company what it holds on you
A practical, threat-model-first look at data access requests: how to file one, what companies are required to hand over, and what the process does and doesn't actually get you.
Getting your phone ready for travel: a privacy checklist that actually works
A practical, no-drama guide to locking down your phone before a trip: what to update, what to turn off, and how a VPN and encryption actually help.
Getting your data out of a company that is closing
A shutdown email means your account data is on a countdown. Here's how exports actually work, what they miss, and how to get your data out before the servers go dark.
Doorbell camera privacy: what your camera actually records, and who can see it
How doorbell cameras capture, store, and share footage, and the practical tradeoffs for protecting your privacy and the privacy of everyone who walks past your door.
Browser fingerprinting: how websites recognise you without cookies
Cookies aren't the only way sites track you across visits. Here's how browser fingerprinting actually works, what it can see, and what realistically reduces it.
How to monitor your child's phone without treating them like a suspect
A practical look at parental controls and privacy: how monitoring tools actually work, what they can't see, and how to set boundaries a kid can respect instead of just work around.
Paying online without spreading your details
How online payments actually leak your data, and which habits and tools genuinely narrow that exposure instead of just feeling private.
Private search engines tested honestly: what actually changes when you switch
A grounded look at how private search engines actually work, what they can and can't protect you from, and how to evaluate their privacy claims yourself instead of taking marketing copy at face value.
The best VPNs in 2026, tested from Singapore
Seven VPNs tested against real audits, real jurisdictions, and my own multi-device setup in Singapore. Prices, protocols, and honest tradeoffs, no fluff.
The first hour after a phone goes missing
What to do if your phone is stolen, in order, and why each step matters mechanically instead of just because someone said so.
Ways to block ads, compared honestly
A grounded, technical comparison of ad blocking methods: browser extensions, DNS-level blockers, built-in browser tools, VPN filtering, and the hosts file, plus what each one actually stops.
What a data breach notification actually means
The reassurance in a breach email is the part written for you and it carries no facts. Severity is set by one bulleted list of field names, and by the gap between the date the intrusion started and the date it was found.
What a document carries when you send it
A practical look at document metadata before sending: what Word, PDF, and image files store behind the scenes, and how to check what's actually in a file.
What a locked phone still shows: lock screen privacy settings that actually matter
A locked phone is not a sealed box. Notification previews, widgets, radios, and USB ports all leak information before anyone enters a passcode. Here is what actually changes when you lock down these lock screen privacy settings.
What a video call shows about you
Video calls reveal more than your face and voice. Here's what your camera, microphone, network, and the platform itself actually expose, and what closes each gap.
What rejecting cookies actually does
A clear-eyed look at what happens on the technical level when you click 'reject all' on a cookie banner, and what tracking methods keep working anyway.
What shows up when someone searches your name
A breakdown of what actually populates a name search, from data broker listings to old social accounts, and what you can realistically do about each piece.
What your backup is actually storing
A plain look at what iPhone and Android backups actually capture, how backup encryption really works, and what that means for your privacy in practice.
Where to keep passwords compared: password manager alternatives
A threat-model comparison of dedicated password managers, browser vaults, OS keychains, local encrypted files, paper, and memorization, so you can pick based on what you're actually defending against.
The best private search engines in 2026
I tested duckduckgo, brave search, kagi, mojeek, startpage, and searxng for real privacy, index independence, and price to find 2026's best pick.
The privacy settings worth ten minutes
A checklist somebody forwarded me had forty one items on it and they had done four. Here are the five worth doing, ordered by what each one actually buys, which is the part the long lists get wrong.
The 7 best password managers in 2026
Seven password managers I've actually run day to day in 2026, compared on encryption, pricing, and what breaks when you need to use them.
What your TV remote knows
The microphone in a voice remote opens on a button press, and that is the boring part. The record worth reading is the one your thumb writes: every app launch, every pause, every film you gave up on four minutes in, timestamped and kept for years.
The best encrypted messaging apps in 2026
Seven encrypted messengers I've actually used running an international SIM and proxy business, picked for real metadata practices, not marketing claims.
What a loyalty card is actually buying
The reward is usually one to two percent, and refusing it on principle is advice that costs money. The trade is that the shop stops recording what was bought and starts recording what you bought, every week, for years.
What your photos share without you
Instagram has stripped location tags off uploads for years, so the warning most people repeat is a decade out of date. The tags survive on forums, marketplaces and direct file sends, and the part nobody strips is the picture itself.
What actually gets deleted when you delete it
One deletion request came back in eleven days with a numbered list. Another has never been answered. Both companies removed the live record, which is the part that was doing anything to me.
Public wifi and what the risk actually is
The cafe cannot read your banking session and has not been able to for years. What it gets is a timestamped list of every domain your device asked for, and your phone will rejoin a network with that name in another country without asking you.
What Encrypted Traffic Still Reveals
HTTPS hides what you send and receive, but the name of every service you connect to is announced in the clear. Here is exactly where it leaks and what actually closes it.
What a password manager actually protects
Password strength has been a solved problem for years. What a manager buys you is uniqueness, which turns a breach at one company into a problem at one company and kills credential stuffing outright.
What a child's tablet is collecting
A breakdown of what actually gets logged when a kid uses a tablet, from the operating system down to the ad SDKs buried in free games, and what changes it when it doesn't.
What a fitness tracker infers that you never told it
Fitness trackers don't just log steps. Here's how heart rate, motion, and GPS data get turned into inferences about health, location, and habits you never explicitly shared.
What a genealogy DNA test actually does with your sample
A walkthrough of what happens to your saliva after you mail it to a genealogy DNA company, from lab processing to data storage, law enforcement requests, and the privacy tradeoffs at each step.
What a smart doorbell records and who can request it
A breakdown of what smart doorbells actually capture, how long footage sits on company servers, and the real channels police and neighbors use to request it.
What airport facial recognition actually stores
A breakdown of what happens technically when an airport scans your face, what data is created, where it goes, and what retention actually means in practice.
What happens to your data when an app shuts down
When an app closes down, your account data doesn't just vanish. Here's what actually happens to it on the backend, and what you can realistically do about it.
What your banking app collects in the background
A breakdown of the device signals, permissions, and third-party SDKs banking apps quietly collect, what's genuinely for fraud prevention, and what isn't.
What your car knows about you
A rental I picked up had seven phones in its paired list and two address books still sitting in local storage. The car also has its own modem and its own sim, so declining the app changes less than people assume.
What Your Email Address Alone Reveals About You
How an email address alone can expose your identity, habits, and accounts through hashing, breach data, and cross-site matching, and what actually limits that exposure.
What your smart TV does when you are not watching
How smart TV tracking actually works, from automatic content recognition to network scanning, and what you can realistically do about it.
What Your Workplace Can See on a Work Laptop
A breakdown of work laptop monitoring: what MDM, EDR agents, managed browsers, and network logs actually capture, and how each mechanism works.
What your browser extensions can actually see
An extension granted access to all sites reads and rewrites every page you open, including your bank. I had nineteen installed on my personal browser and actively used three.
How data brokers build a file on you
Cookies are roughly the fifth most important input into a broker file. Public registries and loyalty programmes are the first two, and neither of them is a technical problem you can fix in a browser.
Private browsers compared: what each one actually blocks
Chrome still accepts third party cookies by default in 2026, and the strongest content blocker no longer runs there. Here is what each browser does about tracking, separated from what its marketing says.
How your phone number tracks you
Your number is the one identifier you keep for decades, which is exactly why data brokers join on it. What a recycled line inherits, why four small breaches beat one big one, and the two number split that actually helps.
Encrypted messaging compared: Signal, WhatsApp and iMessage
All three encrypt the message body properly, so the comparison is settled by what is left over: the record of who spoke to whom, and whether your backup quietly hands the conversation back.
How to build a threat model without becoming paranoid
Four questions, half a page, about twenty minutes of writing, and five decisions fall out the other end. Most security advice you have read was built for an adversary you will never meet.
The two factor that actually stops phishing
Text codes, app codes and hardware keys are not three points on one scale. Only the third structurally cannot be replayed on a fake site, and the pair of keys it takes to do that properly runs about $100.
What a VPN actually does, and the claims that cost you money
A VPN moves one thing: where your traffic enters the public internet. The advertised price is usually a three year prepaid plan at a fifth of the real monthly rate.
The best 2FA and hardware security keys in 2026
Xavier Fok compares seven 2FA options for 2026, from YubiKey and Google Titan hardware keys to free authenticator apps, with real pricing and picks.
How to spot and avoid phishing in 2026
A practical, step-by-step guide to spotting AI-crafted phishing emails, texts, and deepfake calls in 2026, plus the tools that actually stop them.
How to secure your home network in 2026
A step by step guide to locking down your home router, Wi-Fi, and IoT devices in 2026, from an operator who secures networks for a living.
How to remove your personal data from the web
A step by step guide to removing your name, address, and phone number from people search sites, data brokers, and Google search results in 2026.
How to lock down your Google account
A step-by-step guide to locking down your Google account: 2-step verification, passkeys, session audits, and Advanced Protection Program setup.
How to check if your accounts were in a breach
A step-by-step guide to checking whether your email, passwords, or accounts appeared in a data breach, using Have I Been Pwned and other free tools.
How to browse without being fingerprinted
A practical walkthrough for reducing browser fingerprint uniqueness: tool picks, config steps, testing methods, and what changes as you scale identities.
How to actually stay private online in 2026
A practical, step-by-step guide to real online privacy in 2026: passwords, 2FA, email, browser fingerprinting, VPNs, and encryption that actually works.
How mobile proxies improve privacy vs a VPN
How mobile proxies beat VPNs for privacy: CGNAT-shared IPs, setup steps, real costs, common mistakes, and what changes when you scale to 1000 IPs.
End-to-end encryption explained: what it actually protects
A plain-language guide to end-to-end encryption: what it actually protects, how the math works, and why not every app that claims 'encrypted' is equal.
Do you still need antivirus in 2026
A plain-language look at whether antivirus software still matters in 2026, how modern threat detection actually works, and what's overkill.
The best VPNs in 2026, tested for speed, privacy and trust
How we test VPNs, what actually matters, and the providers that hold up in 2026 for speed, verifiable privacy, and honest ownership.
How to actually stay private online in 2026 (a realistic guide)
A threat-model-first guide to reducing what you leak online in 2026, with the small number of changes that do most of the work and honest limits.
Password managers in 2026, compared
A practical comparison of the main password managers in 2026, how they differ on security model, price and openness, and how to pick one and switch.
What your ISP can actually see, and how to limit it
A clear, non-alarmist look at what your internet provider can really see after HTTPS and encrypted DNS, and the specific steps that limit it in 2026.