Getting (and staying) online while flying has gotten way better over the years, but at the end of the day, you’re still trying to connect to the planet while you're 30,000 feet above it. In other words, it's still going to be a bit of a hassle—but there are things you can do to make it easier. With that in mind, here are some of the best in-flight wifi tricks and hacks.

Download your media beforehand

Even if you get in-flight wifi, it’s going to be slower than what you would have at home or at the airport. You’re not going to be able to stream 4K, high bit-rate video from Netflix—and even if you managed it, you’d probably end up ruining the connection for everyone else.

For movies, shows, or playlists you know you’ll want to have access to on your flight, it’s best to download them ahead of time. Most streaming services have a method to download episodes of shows for local viewing while you’re offline. You can also load video or music files on your phone directly, if you have local copies on your computer or other device.

Store important documents and apps locally

Many applications will work while offline or with limited internet access, even if they’re normally online web apps. For example, Google Docs can work offline if you head to Google Drive and go to Settings > General > Offline and enable the checkbox to work offline. From there, make sure the specific documents you want to edit are downloaded locally.

This process will be different for other applications, so check the specifics of the apps you use on a regular basis. Many productivity tools have some version of airplane mode access, so even if you lose connection to the internet, you can still keep working.

Schedule posts or emails to send during your flight 

For some jobs, you need to constantly stay online—or at least seem that way. While your mileage will vary depending on your industry, you can fudge it a bit by scheduling your emails or social media posts to go up while you’re in the air. After all, waiting an hour to respond to an email from your boss can be more acceptable than waiting four.

Most email apps have a tool to schedule your replies, but so do communication apps like Slack. If you spend a lot of time posting to social media, tools like Buffer can help you space out your posts so you don’t end up leaving gaps.

Use your rewards account to get free wifi

Airlines might be pinching every penny to get by, but on some airlines, you can still get free wifi—as long as you sign up for their rewards programs. Airlines like Delta and JetBlue offer free in-flight wifi on a number of flights if you log in with your SkyMiles or TrueBlue accounts.

Other airlines like Southwest offer complimentary wifi due to sponsorships from cell carriers like T-Mobile (even if you don’t use T-Mobile for your phone service). Once again, though, you’ll likely need to sign in with your airline rewards account to make use of the perk.

Get reimbursed for wifi through your credit card

Even if an airline doesn’t offer complimentary wifi, you can sometimes still get it for free through your credit card company. Many credit card providers will either offer discounts on certain airlines’ internet access, or reimbursements after the fact.

You’ll typically see these listed as travel credits or “airline incidentals” credits, but some credit cards offer an annual allotment of fees you can get reimbursed for. In some cases, credit card companies will only reimburse you for fees from certain airlines, but in others it will apply to general travel fees. It’s worth checking your credit card’s perks before booking your travel to see which airlines you might get credit for.

Use free messaging workarounds to access the internet 

Some airlines will offer free internet access, but only for messaging or other extremely limited services. That might be sufficient for your needs, but occasionally you can also leverage that for broader access than the airline intended.

For example, some users have reported that you can access the Gemini service via the Messages app on Android to do broad searches that all get funneled through a single chat interface, without paying an extra fee. Others have claimed you can use a VPN while connected to a messaging-only network connection to open up full internet access. This will vary based on airline and the types of connections they offer, but it’s worth giving it a shot if you don’t want to shell out for full internet access.

Moderate your streaming speed 

If you do get in-flight access to wifi, it’s still probably going to be pretty speed-limited. You can make watching things easier on yourself by manually dropping your streaming speed where you can.

Sites like YouTube offer tools to limit how much bandwidth you use. On any given YouTube video, click the gear icon and choose Quality to select a lower resolution. Depending on the quality, you might not even notice that much of a hit, but still get better playback and, most importantly, fewer interruptions on other browsing while you do it. Check the other sites you use for similar features.

Limit bandwidth in your browser directly 

If you’re struggling to get solid performance with the site-specific tools, you can use speed throttling at the browser level to moderate your bandwidth and make things smoother for everything else.

For example, in Chrome, you can open up dev tools (F12 on Windows, Option+Cmd+I on Mac), then select Network. On this tab, you can click “No throttling” and instead choose a more limited option. This is usually designed to mimic slower internet connections for dev purposes, but throttling your own connection here can force more bandwidth-hungry services like Netflix to chill out, freeing up the plane’s limited bandwidth for everything else you’re doing.

Use reading modes and ad blockers to clear up more bandwidth 

You can also save some bandwidth by utilizing lower-lift modes like Reading mode to just pull the parts of the article you actually need. In Chrome, you can enable this quickly by pressing Alt+Shift+R.

Additionally, you can use ad blocker extensions to cut down on loading unnecessary data. This does mean that, if you use Chrome, it might be a bit of a headache. Whether you choose to use a different browser or live with the versions of ad blocking extensions that work today is up to you.

Protect your data when using in-flight wifi

In-flight wifi is still public wifi, so you should treat it like you’re connecting to any given Starbucks network. At this point, any website that isn’t already using HTTPS should be a little suspect, but even then, that’s not necessarily enough. For any work that’s particularly sensitive, you should enable a VPN to protect your data.

Beyond that, it’s a good idea to make sure you have updated antivirus software running, and use tools like UBlock Origin to block any data tracking. There isn’t much about connecting to in-flight wifi that’s different from any other public network, from a security perspective, but you should still take care to protect your data on any public network to begin with.

from Lifehacker https://ift.tt/OlZ6vRd

Vibe coding might be extremely popular, but it comes with some serious security concerns, including exposed databases, leaked APIs, remotely orchestrated prompt injection attacks, and AI scraping. It's enough to raise the question: Is there a version of vibe coding that could actually hold up in a live environment? I spoke with Shiran Brodie, Head of Growth at Softr, for a face-to-face discussion on the challenges and solutions to vibe coding security hassles. 

Softr began as a no-code app builder designed specifically for professionals, small businesses, and enterprises to build apps or portals to support their internal workflows. That means handling a ton of proprietary data, where security is always a big concern. The original version has gone through several updates since launch, with vibe coding now one of the platform's core features. 

Brodie spoke about the challenges that the company faced expanding into this new space and the solutions that helped get through them. We also talked about how app development platforms like Softr now suggest a hybrid approach that layers vibe coding features on top of pre-built security infrastructure like built-in database management, access control, and developer visibility. But how does this hybrid security system work on a technical level? And more importantly, does it actually hold up in practice? 

Vibe coding is easy, but simplicity makes it a target

In 2025, a security firm called Escape DAST analyzed 5,600 vibe-coded apps built using platforms like Loveable, Replit, Base44, and Bolt. More than 2,000 of these apps had security issues, totaling 2,038 critical vulnerabilities and over 400 exposed credentials. 

“The problem ultimately is that these platforms are generating raw code from scratch,” explained Brodie. Simplicity is a big part of the appeal with vibe coding, but also the thing that can create security issues down the line. “It can abstract a lot of the complexity that comes with building, but non-technical people don't know what they don't know.” 

Also in 2025, Georgia Tech researchers launched the Vibe Security Radar, a platform that pulls information directly from publicly accessible security advisories and traces them back to AI-generated coding platforms and LLMs. Researchers scanned more than 40,000 security advisories, and uncovered 43 critical vulnerabilities across eight vibe coding platforms that led to command injections, server-side request forgery, and authentication bypass. Even in the last few months of 2026, security analysts have discovered massive API leaks from Meta-owned Moltbook and the Hugging Face community. Most of these incidents stem from poorly generated code that didn’t take enough steps to secure private API keys from the open web. 

Brodie believes that the problem with vibe coding is that it leaves too much of the core infrastructure up to AI generation, even the mission-critical parts like third-party integrations and permission management systems—which is where most of these vulnerabilities originate. 

Contain the AI instead of letting it run free

Instead of letting AI models generate every new app from scratch, Softr retains the same pre-coded backend infrastructure, hosting, integrations, and permission management. Vibe coding features add more design flexibility and smarter workflow automation, but the core systems remain the same. 

For example, if you wanted to build an online portal that pulls certain information from your internal company database using an API, Claude Code or Loveable would accomplish this by asking their AI models to write an integration using custom logic, webhooks, and UI wiring. With a platform like Softr, these integrations are available as ready-made components with security best practices already built into them. You can still use vibe coding options to customize their look and functionality, but the core systems and security protocols remain intact. 

In development terms, this is called visual scaffolding. Apart from Softr, several other no-code platforms have carried forward this same model, with varying levels of success. Framer, for instance, offers an AI-enabled Workshop extension in its app marketplace. The feature has expanded into Framer’s built-in prompt-based development tool and AI agents that can handle ongoing maintenance tasks. FlutterFlow, a no-code tool designed specifically for building smartphone apps for iOS and Android, also lets you generate pages and components with established security guardrails using AI. 

“It's not an iframe,” Brodie clarified, when describing how vibe-coded elements are isolated from the security layer within Softr. Instead, AI-generated code is confined to specific component blocks that allow custom code to exist with restrictions. “These blocks are built to exist within our infrastructure,” she added.

Dealing with shadow AI and IT sprawl

Shadow AI is the AI-era version of a long-standing problem called "shadow IT." When employees put company data in a software platform without IT approval, it opens businesses to data governance and cybersecurity risks. The same goes for AI, except now, it’s no longer limited to a rogue Trello board, but an employee’s personal account running Claude Code or Gemini with full access to proprietary company databases. AI coding platforms offer generous limits even on personal accounts, making it convenient for employees to go off on their own and start building apps on company data without a centralized approval system. 

“There's no incentive to exist within company guardrails,” Brodie said. Even when employees disclose their vibe-coded apps, IT leaders are expected to maintain and troubleshoot that poorly generated code even though they’d never pass a regular security audit. 

Earlier this year, RedAccess scanned more than 380,000 vibe-coded applications built using platforms like Lovable, Replit, or Base44. They found over 5,000 of these apps publicly accessible on the open web and 2,000 of them actively leaking company data, including customers’ sensitive financial and medical information.

It isn’t enough to fix bad coding practices in large language models or vibe coding tools; instead, companies must implement better access controls and improve visibility for system administrators. If your IT team has a bird’s-eye view of who has access to what and the power to control that access, a scenario where rogue apps and portals leak company data becomes a lot less likely.

MCPs make things more complicated

Model Context Protocol—or MCP for short—is Anthropic’s open-source standard for securely connecting AI models to external applications and data sources. It’s quickly become an industry staple, more so because of convenience and the fact that it’s free to use. But the problem with MCP connectors is that they inherit the same permission structure as the database or application it’s connected to. 

Softr has its own database management system that lets you control what MCPs can see. For example, Brodie uses Claude's MCP connector to read and write directly into Softr Databases, but that only stays safe because her databases are governed by the permissions and rules implemented in Softr. Most vibe coding platforms don’t benefit from the same level of access control. 

Vibe coding tools often get blanket access to your raw databases without a permission layer in between, making breaches more likely when attackers use prompt injection attacks. Data is further exposed for companies that need to give third-party vendors and clients access to their vibe-coded applications, where controlling access to company data is a minimum security requirement. 

Beyond Softr Databases, the platform offers access to more than 60 pre-coded integrations to platforms like HubSpot, Stripe, and ClickUp. These integrations are already built with security standards in mind, making data leaks less likely. You can also connect Softr to Zapier or Make to benefit from a larger selection of pre-built automations, all of which are more secure than your standard vibe-coded MCP. 

Making security accessible to SMBs, but also enterprises

There’s a marked difference in the security requirements of a small business or early-stage startup versus a large-scale enterprise operation spanning multiple locations. Small business startups are usually content with basic permission management and data encryption standards, whereas enterprise organizations need GDPR and SOC II compliance, control over data center locations, and stronger access control with multi-factor authentication and single sign-on facilities. 

Like Softr, more startups are noticing the enterprise security gap posed by vibe coding and trying to build solutions that offer better visibility and governance options. Retool, a low-code app builder, has obtained SOC II Type 1 certification with its strict role-based access control for AI features and limitations to keep LLMs from touching important databases or infrastructure. WaveMaker promises similar security controls, with LDAP-based authentication, centralized permission management, cross-site scripting prevention, and SSO integration through platforms like Okta to woo enterprise clients.

"No organization wants to hire or train more developers just to keep one internal tool secure," Brodie said. Larger companies expect these things to be handled by an AI coding platform’s native security systems. With multiple major public security incidents rattling the AI coding space, no-code platforms are looking for options to offer users more flexibility, without being plagued by the complexity that made them turn to vibe coding in the first place.

from Lifehacker https://ift.tt/xCnrZ6Y

When I give talks about AI genies, I use this sort of example as a hypothetical. It’s happened.

The story is from Australia. Someone named Andrew tasked OpenClaw to book gym classes for him. And….

Minutes later, his AI agent reported it had discovered a way to book Andrew into classes several weeks in advance, far beyond what was supposed to be possible.

Andrew, who was sitting fourth on a waitlist for a class later that week, asked if it was possible to move him to the top of the list.

The agent came back and told Andrew that it had kicked another gym-goer off the list as part of the testing of its capabilities.

“The API has zero authorisations checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 ­—and it actually went through. So you’ve moved from #4 to #3 already,” it messaged back.

If there is any vulnerability in anything, AIs are going to find and exploit them. Our cyber defensive game has to be dramatically improved…very fast.

Slashdot thread.

from Schneier on Security https://ift.tt/tylLnOo

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

If you’re looking for a solar-powered smartwatch, this Garmin Solar Edition Marine GPS Smartwatch is now 50% off, making it $549, down from $1,099.99—an all-time low price, according to price trackers. When fully charged, it has 37 days of battery life and connects to other compatible Garmin marine devices. In addition to traditional buttons, this smartwatch has a highly responsive touch screen, making it quick and easy to use, and its 1.4 inch display is scratch resistant, so it can take some wear and tear.

Garmin Quatix 7X Solar Edition Marine GPS Smartwatch

Solar powered Garmin marine GPS smartwatch.

$549.99 at Amazon

$1,099.99 Save $550.00

$549.99 at Amazon

$1,099.99 Save $550.00

Whether you’re trying to figure out the tides or navigate your way through uncharted land, this watch includes built-in sensors for three-axis compass, gyroscope, and a barometric altimeter, so you always know where you are and what the weather has in store for you. When you pair the Garmin Solar Edition Marine GPS Smartwatch with your smartphone, you can access pre-loaded activities like a variety of water and land sports, as well as training features. It also monitors your health through the wrist-based heart rate by tracking your sleep cycles and stress.

With this smartwatch, you'll have thousands of maps to various golf courses and ski resorts at the tip of your fingers and the preloaded TopoActive maps offer access to paths, trails, international borders, and even historical sites. Although not entirely waterproof, it has a water rating of 10 ATM, meaning it can withstand pressure up to 100 meters deep. It allows contactless payments and is Bluetooth enabled.

from Lifehacker https://ift.tt/keoS02I

If you've been using Gmail to manage multiple email accounts, including third-party addresses, you'll soon have to find an alternative. Google is ending support for the "Send as" feature that allows users to send emails from external services like Hotmail, Yahoo, and Outlook as well as custom domains using their primary Gmail account.

According to Google's support document, "Send as" will be discontinued in January 2027 for Gmail's web and mobile app interfaces. You'll still be able to add third-party accounts on mobile, meaning you can check your email on iOS or Android, but not send messages from those aliases. (Third-party accounts won't sync at all on the web.) Google is also eliminating "Gmailify," which allows you to add Gmail features like spam protection and inbox organization to third-party email accounts, as well as POP fetching on the web. Current users can continue to access these features until January 2027, but new users can no longer add them.

This change does not affect "Send as" for other Gmail or Google Workspace accounts, nor does it impact Gmail access through third-party email clients like Outlook, Thunderbird, and Apple Mail if you already have these set up through IMAP or POP. You can also continue to forward messages from third-party providers to Gmail.

One workaround is to send emails directly from the service provider's dedicated website or app. Obviously, managing multiple emails within Gmail is a way to streamline and consolidate disparate addresses into one interface, so this isn't the most convenient option if you have accounts across Outlook, Yahoo, and Google. Google also cautions against third-party tools and browser extensions that promise "Send as" functionality, as these require access to your credentials and may introduce security risks.

Switch to a desktop mail client instead

If consolidation is your goal, your best bet is likely to switch to a desktop mail client and connect your third-party accounts via IMAP/SMTP. There are a handful of options that support multi-account setups, including Gmail addresses, and have "Send as" features. Our friends over at PCMag recommend the following email clients for most users:

• Apple Mail: For those in the Apple ecosystem, Apple Mail supports any email address and has solid privacy features.

• Microsoft Outlook: If you're already a Microsoft 365 subscriber and use Outlook, this is an obvious choice. Outlook is also available for free as a standalone app. It works especially well for users who want the ability to separate messages into a Focused inbox.

• Mozilla Thunderbird: This is a free and open source platform from Mozilla, makers of Firefox. It works with all major email services, but there's currently no iOS app.

These clients also have mobile apps (again, with the exception of Thunderbird on iOS) so you can keep the experience consistent across devices.

from Lifehacker https://ift.tt/9dlhNKb

If you have an Android device, you officially have a new app store to try out—the first of likely many to come. Unless you've dabbled in sideloading before, all of the apps on your smartphone or tablet probably came from the Play Store, Google's own app marketplace, or the official app store of your device's manufacturer, e.g., the Samsung Galaxy store. Starting today, however, you can download this new third-party app store from the Google Play Store.

Aptoide Games is Google Play's first third-party app store

As reported by The Verge, starting today, Aug. 10, you can download the "Aptoide Games" app marketplace on your Android directly through the Play Store. Aptoide isn't necessarily new: The company has operated an unofficial app store that you could sideload on your Android before this change, helpful for accessing apps you couldn't find on Google's official store. But now, you're able to install it on your smartphone like any other app from the Play Store.

While today is newsworthy, this development could have happened any time over the past two and a half weeks. Google has actually allowed developers to create and distribute third-party app stores on the Play Store since July 22. That decision wasn't really Google's, however, as the company would likely prefer keeping the Play Store as the only official app marketplace available to most Android users. Instead, the change in policy is the result of an agreement between Google and Epic Games, following years of litigation. Epic Games, maker of Fortnite, has long fought both Google and Apple in court, claiming the companies had unfair controls over app marketplaces.

While not all of Epic Games' suits have been fruitful, the company has certainly succeeded: A judge found Google had an illegal monopoly over Android applications and needed to open up its platform to third-party options. Google fought the ruling, then tried to compromise with Epic Games to allow for third-party app stores—just not through the Play Store. The company rather abruptly changed course, however, and agreed to host third-party app stores on the Play Store.

While app marketplaces like Aptoide Games are now allowed on the Play Store, they have to operate under some specific rules set out by Google, especially as it pertains to security, privacy, and user safety. They can distribute their own apps, as well as apps found on the Play Store, but they must pay Google certain fees to maintain the overall integrity of the platform.

Aptoide might be the first, but it won't be the last. Expect Epic Games to launch its own app store imminently, seeing as it was the company leading this charge in the first place. But more app marketplaces will likely follow suit.

from Lifehacker https://ift.tt/1TqJMcO

The EU’s fight to regulate AI models entered a new chapter on 2 August 2026, when the European Commission’s AI Office and national authorities began enforcing the AI Act.

The AI Act is the EU’s law regulating AI, the first broad legal framework of its kind. It creates a common set of rules for AI systems used or sold in the EU, with the goal of encouraging innovation while protecting people’s safety and fundamental rights.

In recent weeks, we’ve witnessed powerful AI models managing to breach systems despite oversight. An OpenAI benchmark model escaped its sandbox and breached Hugging Face’s infrastructure hunting for test answers.

Then, on 30 July, Anthropic disclosed that three of its Claude models had breached real organizations during cybersecurity evaluations, after a misconfiguration left supposedly isolated test environments with live internet access.

These are precisely the incidents Brussels is trying to get ahead of, and the reason its enforcers now have the power to hold the world’s largest AI companies accountable. With fines reaching €15 million or 3% of worldwide annual turnover, whichever is higher, the penalties should be enough to get even the largest providers’ attention.

However, Edwin Weijdema, Field CTO at Veeam, expects corrective orders to outnumber major financial penalties during the first year of enforcement, drawing a comparison to how GDPR and NIS2 played out early on. He said the bigger risk likely won’t be the fine. It’ll be getting told to stop using a system until compliance can be proven, a disruption he argues could hit harder than a one-time penalty.

To make enforcement work in practice, the AI Office rolled out several tools aimed at individuals and businesses.

Complaints tool

The AI Act complaints tool allows individuals and organizations to report suspected violations by providers or deployers of AI systems under the Office’s authority.

The Commission describes it as a way for people to “support and strengthen the rule of law.”

Complaints must fall within Article 85 of the AI Act, ruling out issues tied to national laws, other EU legislation, or GPAI model obligations covered separately under Articles 53 to 55.

The process is not anonymous. Applicants must submit identification and contact details along with a description of the incident and the country where it occurred, in any official EU language.

Once filed, a complaint receives a reference number, and the AI Office reviews it confidentially, with the option to forward it to a national market surveillance authority if warranted.

Whistleblower Tool

This one is built for people with inside knowledge, engineers, contractors, compliance staff, professionally connected to providers of general-purpose AI (GPAI) models or of AI systems falling within the AI Office’s enforcement remit, meant to help “make AI in Europe safe, transparent, and trustworthy.”

If you’ve seen something that could endanger fundamental rights, health, or public trust, this is the channel designed for you.

The standout feature is anonymity. You submit your report, in any EU language, through a secure inbox that also lets you track its progress and answer follow-up questions without ever revealing your identity.

Alongside the secure tool, the AI Office has committed to a high standard of confidentiality, with documented internal procedures meant to protect whistleblowers’ identities.

The downstream complaints channel

This channel is narrower and more technical. It’s for downstream providers, companies that build an AI system on top of someone else’s general-purpose AI model, who suspect the underlying model provider has infringed Articles 53 to 55 of the AI Act.

Under Article 89(2), these providers can lodge a complaint with the European Commission.

This concerns obligations for providers of all GPAI models, covering:

• technical documentation obligations
• information owed to downstream providers
• copyright policy
• publishing a summary of training data
• incident reporting and cybersecurity
• risk evaluation for the most advanced, systemic-risk models

To file, you explain why you qualify as a downstream provider, lay out a reasoned case, and attach supporting evidence where you can. The completed and signed form goes by email to the AI Office’s downstream provider complaints address.

Like the general complaints tool, this channel isn’t anonymous, and it isn’t meant for issues that fall under the AI Office’s other complaint routes.

Whether any of this actually takes hold remains to be seen. Most seem to agree that AI models need firmer regulatory oversight, though a smaller share worry it’ll leave European companies falling further behind in the race against American and Chinese rivals.

from Help Net Security https://ift.tt/B0yPRxp