Preparing you to protect yourself, your family, or your business from online threats in this digital age.
Joined June 2025
- Tweets1.2K
- Following25
- Followers285
- Likes174
Pinned Tweet
A new welcome and website preview video has been added to our Essentials Membership landing page. If you are curious to see what Members have access to...watch and learn:
youtu.be/4DN_9dzDkZs
New article drop: "Parental Rights or Government Control?"
This is an analysis and critical review of an opinion article published by state Senator Kevin Cook of Idaho who is proposing a bill that would require age-based verification of all who use App Stores in an attempt to make Big Tech bigger and government it's puppet master.
The Senator's justification is very confusing, but is representative of a new political strategy that is trying to address this core issue:
The Internet is a domain of Free Speech, and freedom is only good when it is contained by virtue, and we are no longer a virtuous people.
“Our Constitution was made only for a moral and religious people. It is wholly inadequate to the government of any other.” – John Adams
The question is, how do we fix this? Do we attempt to make the people virtuous again by working to restore identity, morality, roles, responsibility, and accountability where it belongs in our traditional hierarchy of society? Or do we abandon that and use the power of government in a top-down approach to re-establish some moral framework upon a people who otherwise prize moral relativism?
It seems Senator Cook prefers the later, but he is not alone. This is the path we are being led down by those with moral concerns about the soul of America and where the use of our freedoms untethered from our moral base has led us.
This is part of our postmortem of the age of the Internet - the digital age - and the rise of the empire in its place.
My thoughts and recommendations as to how we can proceed are included. Link is in the comments below.
Second threat advisory of the day: this one is for the root certificate authority loss we learned of late yesterday.
Busy day for the integrity of the Internet.
practivesecurity.substack.co…
There are some common questions that are forming around the advisories we have been issuing and also posting at @MattInformed . Here's some quick answers:
Q: Why are we not recommending the Brave browser?
A: We have no opinion about Brave one way or another. We will assess it soon and provide feedback to our customers in an upcoming tool review.
Q: Why are we not recommending the Chrome browser?
A: Because we regard Google as a predatory company that undermines personal security and privacy for their profit. They may be fast to fix security updates, but they also work aggressively to exploit you as a person. We consider Chrome as spyware and a tool for influence operations.
Q: Why do we recommend Safari since Apple tends to be slow to release updates?
A: Because Apple as a company has a long-standing culture of proactive security, high quality control for updates, and an inherent respect for privacy. This does make them slower to update, but you are better protected in the long-term.
Q: Why are we recommending against iOS 27?
A: See our Substack for our recent article on this. TLDR: Siri AI embedded into the foundation of the OS is a no-go for us.
Q: Why do we recommend against Passkey?
A: Because the assumed security in Passkey architecture is that whomever has your device and can unlock it is you, and an unlocked phone grants applications access to passkeys needed to unlock online accounts. That defeats the purpose of MFA. It's actually pretty terrible. It'c convenience over security.
Q: What credentials do you have to make these claims and recommendations?
A: See practivesecurity.com/about
Here's an example of the different layers of security between MFA (true MFA) and Passkey:
True MFA requires you to present something you know, something you have, and something you are (or at least two of those) each time you attempt to access the protected service (run the app, login to the website etc.). The best implementation of this uses all three factors including a strong password, randomly generated auth code via an authenticator app, and some biometric (Face ID, Touch ID).
Passkey only requires you to submit these credentials one-time and from then on stores a key on your device so that all that is needed to access your accounts is the unlock code for your device. Unlock codes are often easy to guess or observe and devices are easy to steal.
Passkey does protect your accounts from being access from a remote attacker who can present all your credential information, but it also leaves your entire security up to the integrity of your device.
Access the device with the unlock code and passkey is defeated entirely.
But this isn't only a weakness in passkey. It's also a weakness in stored authentication tokens that most apps use including many that claim to use MFA but do not.
Passkey has some advantages, but it is not a total improvement over MFA. True MFA is still king.
Why is a root certificate compromise such a big deal?
Well, certificate authorities are responsible for helping website and web service providers prove their identity and authenticity to their customers and client software. They are also used in the data encryption process. This is part of a system of distributed trust that the Internet depends on.
Think of it this way: if you are in a room of 1000 people and you want to find everyone named Matt, you might call out "hey, who here is named Matt?" You might see 10-15 people raise their hand making the claim that they are so named. Some might be, some might not be.
How do you know who is being authentic and who might be deceiving you? How do you know who you can trust? You need some external authority that can validate the identity of those who are claiming it as their own. In the real world we often used government IDs that are issued and signed by authorities.
On the Internet, we use root certificate authorities (RCAs) to be that external identity authority that websites can use to in order to prove they are part of a service architecture they claim to be. To prove their identity, a website operator submits a signed copy of a digital certificate to the root CA (RCA), and the root CA adds their own signature, making the identity certificate valid and anyone who possesses it the rightful bearer of that identity.
For example, if you try to connect to Amazon with your browser, your computer will call out to the Internet asking where the nearest Amazon server is. Many websites can answer by that name or you can be directed to a specific one through malware or hacking. Certificates signed as valid by RCAs are used by the answering websites so that the real Amazon servers can be distinguished from the fake ones. Any server that claims to be Amazon but doesn't present a signed certificate from an RCA, can't be trusted as authentic.
But if an attacker gains a root certificate that is used to sign the certificates of websites and web services, then they can create forged certificates and make the claim that they share the identity of the legitimate servers and websites they are spoofing or claiming to be. They can create forged Internet IDs.
Your browser and your web application won't know they are being lied to.
Thinking of that room full of Matts, let's say you ask all who raised their hand to show their driver's license to prove their identity. You trust that the DMV has validated each Matt's identity when they issued them their ID card. But what if one of the alleged Matts had access to the DMV machines that print drivers licenses and could create one without the normal verification process? You would have no way of knowing that they are lying about their identity, because they presented valid credentials. They might be Jim but have a valid ID that says they are Matt.
That's what's going on with the root certificate authority issue. That's why it's potentially really bad. However, last I looked, the stolen certificates had been invalidated and should not be usable...but that invalidation process can take time and might have some gaps.
Regarding the root certificate issue, yeah, this could be really bad.
Only use FireFox, Safari, or DuckDuckGo as your browser (by default, always). Check for updates for your browser and all apps today through the weekend, and install them.
Be extra careful about clicking links you receive in messages, email, and posts.
With a root certificate, an attacker can spoof a legitimate website and trick your browser or apps into thinking it is real, act as a relay between you and the real service provider, and decrypt any communications you send to the legitimate service they are spoofing. Think wire tap between you and the legitimate service you are using.
This could be used to collect passwords, read email, read messages, intercept and manipulate communications from your apps/browser to your service provider.
It all depends on if this becomes weaponized, who uses it, and what they use it for.
Update your apps and software, and be extra careful about clicking links sent to you.
We recently wrote about our concerns with iOS and macOS 27 and from those concerns have recommended that you avoid upgrading to that version for Macs, iPads, and iPhones. You can read about that here:
practivesecurity.substack.co…
In today's context of the PHP and root certificate incidents happening today, our guidance is to watch for software updates throughout today and through the weekend and make sure you are installing them. That's updates, not necessarily upgrades.
We still recommend avoiding iOS and macOS version 27. iOS and macOS 26 are still supported by Apple and you will receive security updates for version 26 (aka Tahoe). You do not have to upgrade to 27 to remain protected from vulnerabilities in version 26.
The main reason we recommend avoiding 27 is that Siri AI is now core to the OS and cannot be easily (if at all) disabled. It's a forced integration of AI into many functions of your OS, and we have broad concerns about this from a privacy, security, and mental health perspective.
So stick to 26, and keep it updated, but avoid 27.
If Apple gives us the option to disable Siri AI across the entire OS as we can disable Apple Intelligence in version 26, then our recommendation might change.
Our initial advisory is now available for the PHP issue. This is an early warning advisory with more to come later today.
practivesecurity.substack.co…
Practive Security retweeted
Regarding the PHP vulnerability, I have seen some security researchers recommending people limit web browsing for a few days (due to the potential for common websites to be compromised via this vuln).
There is exploit code available for this vuln, though it is not known to exist “in the wild.” But with the weaponization of AI, it’s possible that the discovery and broad distribution of exploit code could happen fast - possibly reverse engineered after the patches are released.
I expect cyber security providers of web application firewalls and exploit prevention services will have protections deployed quickly today, and IT teams will be busy patching and upgrading.
And I think it may be wise to lay low on the Internet today. Do what you need to, but probably skip frivolous browsing.
Also:
Make sure you are running full service anti-virus / anti-malware on every device (including phones). I recommend BitDefender for home/personal use.
Update your browser apps and only use Safari, FireFox, or DuckDuckGo. No opinion about Brave (people keep asking). Make sure ad blocking is turned on and auto play of active content is turned off.
Be very cautious of links you receive in SMS messages, message apps, and email. Check and verify the source first and check the URL to make sure the website domain is as expected.
Keep your operating system and all applications up to date, and watch for new updates over the coming days. Regarding iOS, I do not recommend upgrading to 27. Stay on 26 and update as possible.
Make sure you have MFA turned on for all websites or online accounts. True MFA. Passkey has a major design weakness so I do not recommend it.
This is all to protect your devices and your accounts in case a website you visit is explored and does attempt to steal your credentials, information, or deliver exploit code to your device.
@PractiveSec will be following this today. Advisory coming for customers.
As AI-powered cyber attacks are affecting more and more businesses, many are calling for the use of AI to fight the weaponized instances of AI that are plaguing the Internet.
But do you really need AI to fight AI? We have analyzed the trends of AI weaponization extending back over a decade, and our answer is, no.
That aligns with recently announcements from CISA and NIST who are recommending defense-in-depth principles as effective foundational strategies that will work to defend you against AI-powered attacks today.
We explain why and what you can do to build effective defenses for your organization and why you don't need to reinvent your SOC, as part of our "Best Practices" and "Mindset" content available via our Business Essentials / Pro Membership on our website PractiveSecurity.com
Cyber attacks involving AI seem to be on the rise, and at the very least are making headlines and capturing our attention. We have been analyzing the trends of AI use in cyber attacks and how to counter them since before OpenAI released ChatGPT in 2016.
We have written several articles that analyze the trends, the truth, and what you can do about them. We have prepared knowledge, strategies, and practical recommendations for individuals as well as businesses.
The good news is, you can defend against AI-powered cyber attacks, even those conducted by the so-called frontier models.
The bad news is, most people and organizations are not prepared and our growing dependency and use of AI is making us less secure.
And so we are drifting into further danger, led by the AI model providers themselves.
But we have you covered.
Individuals will find helpful articles on personal AI defense within our Essentials Membership content library.
Professionals and those working in organizational cybersecurity or information security teams will find our guidance in our Business Essentials / Pro content library.
You can sign-up for both or either on our website Practivesecurity.com
Parents, AI adoption among minors is very high at well over 60% as of 2025 data and at least 30% of teens reported finding AI companions to be more personally fulfilling than their real world friends.
And right now there is a national effort among Conservatives in our legislative bodies (state and federal) to prevent your kids from accessing AI.
Meanwhile, our First Lady and President are setting up national programs that encourage our children to use AI everyday and to become "AI native" in their posture toward the future.
Are you preparing your kids to regard this technology in the proper and healthy way? Are you aware of the dangers and the benefits? Do you need help?
We have loads of articles, podcasts, and several presentations geared to help you.
If you'd like an overview in seminar / video format, we have one available through our website called the AI Workshop for Parents. If you'd like to browse our content theme by theme, check out the AI page available for our Essentials Members.
In our AI Workshop we provide you an overview of the AI technology and its origins so you first understand what it is (and what it isn't). Then I walk you through the nature of the revolution, the primary methods of use in everyday life, before we dive into analyzing the deeper aspects of this transformational moment in history, wrapping up with practical recommendations for what you can do in your life and with your family.
Learn more at practivesecurity.com/essenti…
Sign up today at
practivesecurity.com/signup
Content highlight on AI: if you are looking for an exploration into the simple truths of what AI is and how we should approach it, we have you covered. Get started with these articles, which attempt to cut to the chase in a very practical sense. They are a blend of thinking through the deeper issues while guiding us to some practical application in the real world as we encounter AI and are considering if, how, and when to use it, while safeguarding ourselves from the potential harms use can bring:
AI Essentials
Rules for the Proper Use of AI
AI is Never Just a Tool
An Ethical Framework for AI
You will find these on our Artificial Intelligence page of our website, accessible only to our Essentials Members.
Content highlight on AI: if you are looking for an exploration into the simple truths of what AI is and how we should approach it, we have you covered. Get started with these articles, which attempt to cut to the chase in a very practical sense. They are a blend of thinking through the deeper issues while guiding us to some practical application in the real world as we encounter AI and are considering if, how, and when to use it, while safeguarding ourselves from the potential harms use can bring:
AI Essentials
Rules for the Proper Use of AI
AI is Never Just a Tool
An Ethical Framework for AI
You will find these on our Artificial Intelligence page of our website, accessible only to our Essentials Members.
Fresh FAQ on the top of the stack (no paywall): Who Is Practive Security, and Why?
practivesecurity.substack.co…
Wondering who we are, why we exist, and why we think we can be of help to you?
Here you go:
youtu.be/MRarp7daXb4?si=Hqi7…
We're halfway through cybersecurity awareness month! It's a great opportunity to discover the importance of this topic - of the threat, risks, impacts, and opportunities to defend yourself from the harms we are exposed to online.
We are here to be your trusted advisor.
Dive in for just $15 / month and become an Essentials Member at practivesecurity.com. Read all about the benefits on our website.
Or you can get started with our book, Practive Security 101. Buy a copy and learn the fundamentals about online threats, what to do about them, as well as digital health and how to defend all that you are: heart, mind, body, soul, and your property.
Practive Security 101 in paperback on Amazon:
amazon.com/dp/B0H4LK1Y93
A fresh newsletter is headed to the inbox of our Subscribers and Members right now. As always, lots to cover including:
Digital ID, IoT, GrokBot, Espionage at OpenAI, Free Software, and Golden Retrievers
practivesecurity.substack.co…
Smart devices are everywhere: lights, door locks, thermostats, refrigerators, garage door openers and more. We call these everyday objects with embedded and Internet-connected computers, the Internet of Things (IoT). Hackers love them. They take control over our IoT devices by the millions at a time and use them to orchestrate all sorts of badness.
Learn why and what to do about it in our latest article available on the Personal Security page of our website. Essentials Members only.
Another of our favorites that has been edited (and improved) is "Guarding Our Attention." It is available on Substack and our Personal Security page at PractiveSecurity.com
As we review the topics of digital health and online security, we draw from Biblical wisdom as well as that from Jonathan Pageau, Iain McGilchrist, C.S. Lewis, and Josh Herring.
We hope this helps: practivesecurity.substack.co…
