Community Cyber Resilience poster
Workshop + Tea

Community Cyber Resilience

Simple steps that keep the bad guys out.

Thu Oct 29 · The Fold, SF + Zoom

Welcome

Your hosts

Gaia Dempsey

Co-founder of DAQRI, an early augmented-reality company. Former CEO of Metaculus, the forecasting platform. Founder of 7th Future. Long-time voice on AI safety and the ethics of new technology.

Jason Grey

Technology leader, innovator & inventor, engineer & architect. 40+ years writing software. Former Chief of Technology at Life Time Fitness, CTO at Warecorp, built the first mobile target.com. Now AI & search at Kagi.

jason-grey.com

Today

Three big wins

  1. Turn on automatic updates everywhere
  2. Set up a password manager for your key accounts
  3. Turn on two-step sign-in (2FA) for your most important accounts

Further along? We'll also cover hardware security keys — and being ready when the power goes out.

Have your phone and laptop handy. Bring a YubiKey if you have one.
Part 1

Layers Win

No lock is perfect. Stack a few, and you're a hard target.

Defense in depth

Like an onion

Each layer stops some attacks. Together they stop almost all of them.

  • Updates close holes crooks already know about
  • Password manager = a different strong password everywhere
  • 2FA = a stolen password isn't enough
  • Hardware key = fake sites can't fool it
Updates
Password manager
2-step sign-in
Key
You &
your stuff
Good news

Most break-ins are boring

Old software

A known bug that was already fixed — just not installed.

Fix: updates

Reused passwords

One site leaks, crooks try that password everywhere else.

Fix: password manager

Fake login pages

A scary email, a lookalike site, you type your password.

Fix: 2FA & keys

You don't need to be a fortress. Just harder than the next person.

Part 2

Update Everything

The easiest, biggest win. Turn it on once, then forget it.

Why it matters

Updates are free repairs

  • When a security hole is found, it's public — crooks read the news too.
  • The update is the patch. Not installing it leaves the door open.
  • Turn on automatic updates, and restart when asked.
  • Don't forget browsers, apps, and your Wi-Fi router.
Device too old to get updates? It's time to replace it — no setting can fix that.
Your device

Mac

System Settings › General › Software Update
  1. Install anything waiting
  2. Click ⓘ next to Automatic Updates
  3. Turn everything on — especially Install Security Responses and system files
App Store › Settings › Automatic Updates

Aim for macOS 27 · or the latest macOS 26.x

Apple fully patches only the newest version. Intel Macs can't run macOS 27.

iPhone & iPad

Settings › General › Software Update › Automatic Updates
  • Turn on everything, including Security Responses & System Files
  • Plug in overnight on Wi-Fi — it updates while you sleep
Settings › Apps › App Store › App Updates

Aim for iOS / iPadOS 27 · iPhone 11 or newer

Stuck on iOS 18 or older? Your phone is no longer fully protected.

Windows

Start › Settings › Windows Update
  1. Click Check for updates and install
  2. Turn on Get the latest updates as soon as they're available
  3. Advanced options › turn on Receive updates for other Microsoft products

Aim for Windows 11, version 26H2 (25H2 is OK)

Still on Windows 10? Free security updates are over. Upgrade to Windows 11 or replace the computer.

Android

Settings › System › Software updates

Samsung: Settings › Software update › Download and install. Turn on Auto download over Wi-Fi.

Settings › Security & privacy › System & updates

Install the Security update and Google Play system update.

Play Store › your picture › Settings › Network preferences › Auto-update apps

Aim for Android 17 · security patch less than ~2 months old

Linux

Ubuntu / Mint / Debian

sudo apt update && sudo apt full-upgrade
# install security fixes automatically
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Fedora

sudo dnf upgrade --refresh
# apps from Flathub
flatpak update

Or use the Software app › ⋮ › Preferences › Automatic Updates.

Aim for Ubuntu 26.04 LTS (24.04 OK) · Fedora 44 or newer

Don't forget

The other stuff

Browser

Chrome, Firefox, Edge and Safari update themselves — but only when you restart them. Close it fully once in a while.

Apps

Turn on auto-update in the App Store / Play Store. Delete apps you don't use.

Router

Check the maker's app or admin page for auto firmware updates. Very old router? Replace it.

Part 3

Password Managers

Remember one password. Let the app remember the rest.

Pick one

Any of these is great

Apple Passwords

Free Built in

Already on your iPhone and Mac. Zero setup if you're all-Apple. Works on Windows via iCloud. No Android.

support.apple.com/passwords

1Password

Paid Families

The most polished. Easy sharing with family, great on every device, extra-strong account protection (Secret Key).

1password.com

Bitwarden

Free Open source

Free on every device, open source, and checked by outside experts. Cheap upgrade for extras.

bitwarden.com

Setup steps

Set up Apple Passwords

  1. Turn on sync: Settings › your name › iCloud › Passwords → On
  2. Turn on AutoFill: Settings › General › AutoFill & Passwords → pick Passwords
  3. On Mac: System Settings › your name › iCloud › Passwords → On
  4. On Windows: install iCloud for Windows + the iCloud Passwords browser extension
  5. Open the Passwords app › Security to see weak or leaked passwords
Your Apple Account is now the master key. Make sure it has 2FA and a recovery contact.

Set up 1Password

  1. Sign up at 1password.com (Family plan if you share a household)
  2. Pick a passphrase as your account password
  3. Save your Emergency Kit (it has your Secret Key) — print it and store it safely
  4. Install the app on phone + computer, and the browser extension
  5. Phone: Settings › General › AutoFill & Passwords → 1Password
  6. Import from your browser, then check Watchtower

Set up Bitwarden

  1. Create an account at bitwarden.com
  2. Pick a passphrase as your master password — Bitwarden can't reset it if you forget
  3. Turn on 2FA for Bitwarden itself, and save the recovery code
  4. Install the app on phone + computer, and the browser extension
  5. Set Bitwarden as your phone's AutoFill service
  6. Import from your browser, then check Reports
Whichever you pick

Start small

  1. Email first — it resets everything else
  2. Bank and phone carrier
  3. Apple / Google / Microsoft account
  4. The rest, as you log in over the next few weeks
Once you've switched, turn off "save passwords" in your browser so you only have one place to look.
Part 4

Good Passwords

Long beats clever.

xkcd 936: Password Strength

xkcd #936 by Randall Munroe · xkcd.com/936 · CC BY-NC 2.5

The recipe

Length, not symbols

Weak

P@ssw0rd!

Short. Swapping a→@ fools nobody — computers try that first.

Strong

lantern-pickle-orbit-cello

Four or more random words. Long, easy to type, easy to remember.

  • Random words — not a song lyric, quote or your pet's name
  • You only need to memorize two: your password manager and your device passcode
  • Let the password manager make up everything else
The rules

Keep it simple

One per site

Every account gets its own password. When one site leaks, the others stay safe.

Change when there's a reason

No need to change every 90 days. Do change it right away when a site is breached or your manager warns you.

Use the checker

Apple Passwords › Security, 1Password Watchtower, Bitwarden Reports. Fix the red ones first.

Been in a breach?

Look up your email at haveibeenpwned.com. Most of us have been — that's why unique passwords matter.

Part 5

Two-Step Sign-In

Something you know + something you have.

From okay to amazing

The 2FA ladder

  • 1Text message (SMS)Better than nothing●○○○○
  • 2Authenticator appCodes on your phone●●○○○
  • 3Passkey + face / fingerCan't be phished●●●●○
  • 4Hardware keyCan't be phished, can't be copied●●●●●
  • 5Three keys, nothing elseFull send★★★★★

Any step up is a win. Start where you are.

Level 1

Text message codes

  • A code is texted to your phone
  • Weakest option: crooks can trick your carrier into moving your number to their phone ("SIM swap")
  • Fake sites can ask you for the code
  • Sometimes it's the only choice (some banks) — use it then
Ask your carrier for a port-out PIN or number lock. It makes SIM swaps much harder.
Level 2

Authenticator apps

A 6-digit code that changes every 30 seconds — on your phone, not sent over the air.

Google Authenticator

Dead simple. Backs up to your Google account, so a new phone is easy.

Microsoft Authenticator

Best for Microsoft accounts — tap to approve, with number matching. Also does regular codes.

Duo Mobile

Common at work and school. One-tap push approvals. Also does regular codes.

Others: 2FAS free & open source · Ente Auth open source, encrypted sync · Aegis Android, stays on device · Authy phone-only now · Your password manager can do codes too (handy, but all eggs in one basket)

Level 3

Passkeys & biometrics

  • Your phone or computer becomes the key
  • Unlock with your face, fingerprint or PIN — no password to type
  • Won't work on a fake site — it checks the address for you
  • Your face/fingerprint never leaves the device
  • Saved in Apple Passwords, 1Password, Bitwarden or Google
See "Sign in with a passkey" or "Create a passkey"? Say yes.
Level 4

Hardware security keys

  • A small USB / tap key — like a house key for your accounts
  • Plug in or tap your phone to sign in
  • Can't be phished, can't be copied remotely
  • Always register at least two — one is a backup
  • Buy from yubico.com or a big retailer — not a random reseller
Yubico

YubiKey 5 (USB-C + NFC) works with almost everything

Level 5 · full send

Three keys. Nothing else.

🖥 Fixed

A tiny key (YubiKey Nano) that lives in your computer.

🔑 Mobile

On your keychain. Tap it on your phone (NFC).

🔥 Fire safe

The backup. Locked away at home for emergencies.

Then remove text messages and app codes. Your account is only as strong as its weakest way in.

Google calls this the Advanced Protection Program.

Save your backup codes!

Every account gives you backup codes when you turn on 2FA. They get you in if you lose your phone or keys.

  • Good: save them in your password manager
  • Better: print them and keep them in your fire safe
  • Do NOT leave them in Downloads, Documents, your desktop, or cloud storage
How to: Google & Microsoft

Google: where to start

myaccount.google.com/security

Scroll to How you sign in to Google.

Everything below lives here:

  • 2-Step Verification
  • Passkeys and security keys
  • Google Authenticator
  • 2-Step Verification phones
  • Backup codes

Google: phone & app

1Turn on 2-Step Verification — Google walks you through it.

2Google prompts: any phone signed in to Google gets a "Is it you?" tap. Turned on by default.

3Authenticator: click Set up authenticator, scan the QR code with your app, type the code.

4Text message: fine as a backup — remove it once you have keys.

Google: passkeys & keys

Security › Passkeys and security keys

1Create a passkey on your phone and laptop — then sign in with your face or fingerprint.

2Add a security key — plug in or tap your YubiKey when asked. Do it for each key.

3Backup codes › Get backup codes › print or save in your password manager.

Microsoft: where to start

account.microsoft.com/security

Click Manage how I sign in (Advanced security options).

Works for Outlook, Hotmail, Xbox, Skype, OneDrive and Windows sign-in.

Microsoft: add sign-in ways

Click Add a new way to sign in or verify, then pick:

  • Use an app — Microsoft Authenticator (tap to approve) or any code app
  • Face, fingerprint, PIN or security key — makes a passkey or adds your YubiKey
  • Text a code — backup only

Then turn on Two-step verification.

Microsoft: go passwordless

1With the Authenticator app or a key set up, turn on Passwordless account. Now there's no password to steal.

2Recovery code › Generate a new code › print it or save it in your password manager.

3Remove old phone numbers and emails you no longer use.

Part 6

Physical Security

Storms, earthquakes, cyber attacks: sometimes the power, phones and card machines go down.

What governments say

Be ready for 3 days

🇬🇧 UK & 🇪🇺 EU

  • 3 days on your own (72 hours)
  • UK launched "Be Ready" last week (22 Oct)
  • 3 litres drinking water per person, per day
  • Cash, FM radio, power bank, torch, warm layers, copies of ID

🇺🇸 US

  • Several days on your own — at least 3
  • Ready.gov basic kit
  • 1 gallon water per person, per day (drinking + washing)
  • Hand-crank or battery radio, NOAA weather radio, cash, phone backup battery

Same idea everywhere: help can take days to reach you. Details below ↓

🇬🇧

UK: Be Ready

Cabinet Office · launched 22 Oct 2026 · gov.uk/beready

Water

Bottled, 3 days. 3 L per person per day to drink — more for cooking and washing.

Food

3 days, no fridge, no cooking. Tins, dried fruit, nuts. Buy what you normally eat.

Light & warmth

Torch + spare batteries. Blankets, sleeping bags, warm clothes.

Info

FM radio (battery or wind-up). Charged power bank.

Money & papers

Cash (notes + coins) and cards. Copies of ID. Written phone numbers and medicines.

Health & more

First aid, medicines, hygiene. Baby and pet supplies.

Their tips: build it slowly while shopping · check it every 6 months · swap numbers with your neighbours.

🇪🇺

EU: 72 hours

European Commission · Preparedness Union Strategy

  • Every household should cope on its own for 72 hours — the first days of a crisis are the hardest
  • Named essentials: food, water, torch, ID papers, medicine, radio, plus a power bank and cash
  • Threats in mind: floods, fires, cyber attacks, power cuts, war

Many countries publish their own guide too — e.g. France, the Netherlands, Ireland, Sweden, Finland, Poland.

🇺🇸

US: Ready.gov kit

FEMA · ready.gov/kit · local: sf72.org

  • Water: 1 gallon per person per day, several days
  • Food: several days, non-perishable
  • Radio: battery or hand-crank, plus a NOAA weather radio
  • Light: flashlight + extra batteries
  • Phone: charger + backup battery
  • First aid kit, prescriptions
  • Cash
  • Whistle, dust mask
  • Wipes, garbage bags (sanitation)
  • Wrench to turn off utilities, manual can opener, paper maps
Bay Area: plan for an earthquake — roads, power and water can be out for much longer than 3 days.
Our suggestion

How long?

3 days

The government minimum. A shelf in a closet.

Start here

5 days

Do this for sure. Covers a bad storm or a big outage.

Must have

90 days

Much better. Covers a long outage, a job loss, or a big quake.

Goal

Build it bit by bit: buy one extra each time you shop.

Supplies

💧 Water

  • Drinking: 3 L (UK) to 1 gallon (US) per person per day
  • 5 days for 2 people ≈ 10 gallons / 40 L — a few store-bought jugs
  • 90 days: too much to buy in bottles — use storage barrels and a water filter
  • Your water heater holds 30–50 gallons of clean water
  • Don't forget pets
Swap stored water every 6–12 months, or buy sealed emergency water that lasts years.
Supplies

🥫 Food

  • Food that needs no fridge and no cooking: tins, nut butter, crackers, dried fruit, nuts
  • Buy what you already eat — then eat the oldest first and replace it
  • Manual can opener
  • 90 days: add rice, beans, oats, pasta, and a camping stove with fuel
  • Special diets, baby formula (ready-to-feed), pet food
Camp stoves, grills and generators go outside only. Carbon monoxide kills.
Supplies

💵 Money

  • When power or networks go down, cards and phone payments stop
  • Keep cash in small bills (and some coins)
  • Enough for about a week of food and fuel
  • Store it with copies of ID and documents
The fire safe from the YubiKey slide is a great home for cash, papers and backup codes.
Supplies

📻 Radio

  • When phones and internet are down, radio still works
  • Get one that runs on batteries and a hand crank (many have solar and a USB port too)
  • US: pick one with NOAA weather alerts
  • Write down your local emergency stations

Bonus

Walkie-talkies (FRS) — no license, talk to neighbours and family nearby.

Supplies

🔋 Battery backups

Small

Power banks — keep 1–2 charged. A 20,000 mAh bank ≈ 4 phone charges.

Recharge every few months.

Medium

A UPS (battery box) for your modem and Wi-Fi router — stays online through short outages.

Large

A portable power station (1–2 kWh) plus a solar panel. Runs the fridge, medical devices, lights.

  • Torches and lanterns: LED, plus spare batteries — skip candles
  • Using medical devices that need power? Make a plan with your doctor and utility
Before you leave

Today's checklist

  • Automatic updates on — phone & laptop
  • Password manager installed
  • Email password is unique and strong
  • 2FA on your email
  • Backup codes saved (not in Downloads!)
  • 3–5 days of water, food and cash at home

Extra credit

  • Passkeys on Google, Apple, Microsoft
  • Two YubiKeys registered
  • Carrier port-out PIN
  • Freeze your credit — free at Equifax, Experian and TransUnion
Thank you

Questions?

More tea. More chocolate. Let's set things up together.

Gaia Dempsey · Jason Grey