Tech Secrets

The Password Manager’s Value Is the Audit Report, Not the Vault

Most people set up a password manager, import old passwords, and stop — leaving the actual risk untouched. The audit feature (weak/reused/breached passwords) is what closes the gap, and it needs to be run, not just available.

The mechanism: attackers mostly don’t guess passwords. They buy leaked username/password pairs and test them across other sites — credential stuffing. A unique password per account defeats this attack category regardless of how strong any single password is.

Email Aliasing Identifies the Source of Every Leak

A unique email alias per service (SimpleLogin, Apple’s Hide My Email) means that when spam starts on one alias, you know exactly which company leaked or sold your data — and can kill just that alias.

Passkeys Are the New Default — But Not a Strict Upgrade Over Hardware Keys

Passkeys — phishing-resistant, passwordless credentials built on FIDO2/WebAuthn — are now supported across every major platform. Amazon alone confirmed over 320 million customers using passkeys as of August 2025, up from 175 million a year earlier.

For most people, a passkey is now the best default for everyday accounts: it can’t be phished the way a typed code can, and needs no separate hardware. But it isn’t automatically superior to a physical hardware key for every threat model. A synced passkey lives inside your Apple, Google, or Microsoft account — so someone who compromises that account can, in principle, reach the passkey too. A hardware key’s private key never leaves the device and can’t be reached that way. For journalists, activists, admins of sensitive systems, or anyone facing targeted attacks rather than mass phishing, a device-bound hardware key or device-bound passkey is still the stronger choice.

Practical hierarchy for 2026: passkey or hardware key (pick based on threat model) > TOTP authenticator app > SMS. SMS remains weakest — NIST’s current digital identity guidelines now classify SMS one-time codes as a “restricted authenticator,” not a recommended one.

Incognito Mode Was Never About Hiding From Google — Only From the Person Next to You

Incognito hides your history from other people using the same device. It was never designed to hide your IP, your ISP-level traffic, or your identity from sites you’re logged into — Google never claimed otherwise in the product itself, which is part of what the underlying lawsuit turned on.

Google’s Incognito-tracking class action (filed 2020) was settled in December 2023 and finalized in April 2024. The case centered on data collected through Google Analytics and Ad Manager on third-party sites visited while in Incognito mode — not on a failure of Incognito’s stated local-privacy function. The final settlement included no cash payment to users; Google agreed to delete a large volume of previously collected data, stop using an undisclosed internal signal that detected when someone was in Incognito mode, and let users block third-party cookies by default for five years. Individual users retained the right to sue separately.

For genuine network-level privacy — hiding activity from an ISP or from tracking scripts — pair a privacy-respecting DNS resolver with a browser that has fingerprinting protection (Firefox strict mode, Brave) and a reputable VPN on untrusted networks.

App Permissions Are a Slow Leak — Review Yearly

Permissions accumulate silently; an old flashlight app with lingering location access is a forgotten passive leak. Both iOS and Android now show a permissions timeline, not just current status. Twenty minutes once a year, revoking what an app doesn’t clearly need, closes most of this.

Notification Triage, Not Blanket Silence

Allow only direct-contact alerts — calls and messages from specific people — and kill every algorithmic notification (likes, “recommended,” “see what you missed”). Algorithmic notifications run on variable-reward psychology, the same mechanism behind slot machines; direct-contact notifications are actual human signals.

Email Bankruptcy Is a Legitimate Strategy

If your inbox has thousands of unread messages, “inbox zero” will cost 40+ hours you don’t have. Archive everything older than 30 days in one pass, set filters going forward, and use three labels: Action, Waiting, Reference. Nothing disappears — search still works on archived mail.

PARA: The Folder Structure Organized by Actionability, Not Topic

Most folder systems collapse because they’re organized by topic instead of status. PARA — Projects, Areas, Resources, Archive, from Tiago Forte — maps to whether something is active, an ongoing responsibility, reference material, or done. Finished work moves to Archive instead of getting deleted, becoming a searchable history over time.

Keyboard Shortcuts Compound — Only the Five You Actually Repeat

Don’t memorize fifty shortcuts. Identify your five most-repeated manual actions and learn only those. An action performed 20 times a day, saving 8 seconds each time, is about 2.5 minutes a day — roughly 15 hours a year from five shortcuts alone.

Cloud Sync Is Not a Backup

Google Drive, iCloud, OneDrive, and Dropbox sync: delete or corrupt a file, and that change propagates everywhere within seconds. A real backup is versioned, isolated, and needs a deliberate restore step. The standard rule is 3-2-1: three copies, two media types, one offsite. Most sync services only retain limited version history — typically 30–180 days.

Context Front-Loading Beats Clever Phrasing

Before a complex AI request, state your role, your audience, your constraints, and what a failed answer looks like. That context shapes the output more than any single instruction: “I am [role]. My audience is [audience]. The goal is [goal]. Don’t [failure mode].”

AI Hallucination Clusters in Predictable Places

AI tools are most likely to fabricate on specific statistics, very recent events, niche citations, and obscure or private entities. They’re most reliable explaining established concepts, generating structure, summarizing your own text, and working through logic. Verify anything near the risky end before relying on it.

Automation ROI Should Be Calculated, Not Assumed

Before automating anything: hours saved per year ÷ hours to build it. An email filter saving 10 min/week (≈8.7 hrs/year) that takes 45 minutes to set up returns ~11.6x. A report automation taking 12 hours to build but saving 2 hrs/year never pays back. Automate frequent-and-simple first.

Your Attention Is a Product — Use Platforms as Utilities, Not Environments

Any app built around an algorithmic feed profits by converting attention into ad revenue — that’s the disclosed business model, not cynicism. Practical implication: get specific information, then leave, rather than browsing until bored.

Maintainable Beats Optimal — Subtract Before You Add

A consistently maintained simple system beats a theoretically perfect one abandoned in sixty days. Before adopting anything new, ask: “Can I keep this running in my worst week?” Just as often, the higher-leverage move is removing an app or step that creates work without creating value — run a quarterly subtraction audit rather than only ever adding tools.