Best & Worst Gifts: 2024

The holidays are upon us yet again, which must mean it’s time for my annual guide to the best and worst gifts for the privacy and security conscious buyers!

Overview

Connecting all of our mundane devices to the internet to make them “smart” was a dumb idea. As we love to say, the “S” in “IoT” is for security. And I’ll amend that to say that the “P” in “IoT” is for privacy. The stories are just endless: botnets of DVRs, home appliances spying on you (recently including an air fryer), TVs that watch you, and fitness trackers revealing secret military bases and allowing world leaders to be tracked. Even your car is spying on you.

And now we’re rushing to add Artificial Intelligence (AI) to everything. While AI has a lot of promise, there are many downsides beyond just disrupting some types of jobs. For one thing, most serious AI processing requires more horsepower than our devices have on hand – and so many of our AI queries are actually processed in the cloud. (The “cloud” is just a fancy marketing term for “someone else’s computer”.) That means that someone else could monitor, record, or even sell whatever information they can glean from these interactions.

if that weren’t bad enough, the companies competing for your spending money are going to insane lengths to differentiate their products from their competitors. The current plan to make AI better is to feed it more information, and so these companies are ravenously consuming all the data they can find – including the data they’ve collected from their users over the years – often with little or no warning.

Many of these devices (and the apps you use to control them) are mining and monetizing your data. You can take steps to protect yourself and your network, but it’s not easy. And I’m actually worried that in the near future, it will be almost impossible. We need privacy regulations to protect our data and regulators need to hold companies accountable for security negligence. The EU recently threw down the gauntlet, threatening to extend product liability to insecure software, but it won’t take effect for two years – in which time it might be defeated.

In the meantime, we can spend money on products that are more secure and services that respect our privacy. This supports the companies that are doing the right things and incentives the rest to follow suit. Conversely, you should generally avoid buying cheap smart devices and cell phones. Many of them have poor or non-existent security, mine and sell private data, and have horrible tech support. Spend the extra money for brand-name products from companies with reputations to maintain.

Note that just because someone already has a smart device doesn’t mean you can’t gift them a better one – one that’s more secure and doesn’t make money off their personal data. Also, you don’t have to give things. This list from The New Oil has some excellent ideas, including my ‘dragon coupons’, which I discuss below.

Finally, the new US administration it threatening to impose high tariffs on imported goods, like electronics. Who knows when or if that will actually happen, but if you want to hedge your bets, you might want to buy sooner rather than later.

Worst Gifts for Privacy & Security

Sadly, the list of worst gifts hasn’t changed a whole lot over the years – except that some have actually gotten worse. For a full write-up, you can look at the lists from last year and 2022. (You can go even further back, but be aware that I’ve removed products over the years for going bad.) I’m going to start with some new and updated information, and then just quickly rattle off the perennial list of gifts that are bad for security and privacy.

• DNA testing kits. Companies like 23andMe and Ancestry.com sell DNA kits that can help you find lost relatives, trace your lineage, and supposedly even help you find congenital medial problems. There’s arguably nothing more personal than your DNA – your genes are you. 23andMe may be about to go out of business, and your data may be up for sale. You can try to close your account and request that your data be deleted and DNA destroyed, but apparently it’s tricky.
• Smart devices from Google, Amazon & Facebook. While generally true of any smart devices, internet-connected devices from these three companies are particularly suspect. Note that this includes devices from companies that are now owned by them, including Ring, Nest, Fitbit, Waze, Blink, Eero, Roomba, Twitch, and others. I would also stay away from Facebook’s smart glasses.
• Tracking and fitness devices. There are a ton of these things on the market now, including the horrid child monitoring device Angel Watch, Tile and Samsung tracking tags, and fitness trackers like FitBit and Halo. These types of devices are chock full of sensors, including GPS, and send their data to the cloud. Location data is extremely valuable and is often sold “anonymously” to third parties – but it can be very easy to de-anonymize this sort of data.
• Modern cars. Mozilla released a hair-raising report last fall on how much data is being collected and shared by newer cars. And then earlier this year, the NY Times exposed how car data gathering led to higher insurance rates for unsuspecting drivers – and sold for a pittance. It’s absolutely horrific – and right now there’s very little you can do to stop it.
• The Internet of Cellular Things. Like modern cars, many newer medical devices and pricier home add-ons like solar panels and whole-house back-up batteries come with the ability to access the internet on their own – without your help or control. And the reason they do this is to collect data. Oftentimes this is harmless “telemetry” data that helps them to monitor status and even fix bugs, but you can bet that they will also be selling whatever data they’re legally able to. Again, maybe these aren’t common holiday gifts, but as cellular modems get cheaper, this is going to become much more common in all “smart” devices. Be aware of this.
• Cloud-tethered devices. Many manufacturers are moving to subscription-based models for cloud-based services, meaning that your smart devices may have significant ongoing costs. Some have even taken away features that were free. And any time a device depends on the cloud, it could become defunct (be “bricked”) if the manufacturer goes out of business. (I just did a great podcast episode about this which you might want to listen to.)

Again, I’ve written extensively about bad gifts and much of the advice just hasn’t changed. See previous lists for more information. See also Consumer Report’s 2023 Naughty List for detailed reviews of dozens of products.

Best Gifts for Privacy & Security

Okay, let’s get to the good stuff! And remember – if your intended recipient already has one of these things, but it’s a bad one, then your gift can be to replace it with a better one that’s more secure and protects their privacy.

• Password Manager. The first thing you should do to protect your online accounts is to use a strong, unique password for each one. The human brain just cannot do this – you need a password manager. I recommend BitWarden or 1Password. (At this point, I would steer clear of LastPass.) You can buy someone a one-year subscription or include them in a family plan.
• A privacy-respecting VPN service. A virtual private network will protect your web traffic from your internet service provider (ISP). When you’re in a hotel, coffee shop, hotel, airplane, or some other place with free WiFi, then they are your ISP. (And on mobile devices, your carrier is your ISP.) Wirecutter has a very good write-up on the best VPNs. I would recommend Proton VPN, IVPN or Mullvad. NOTE: Be careful when reading VPN reviews – many are written by the same companies that own the service.
• Cloud storage. DropBox, Google Drive, and Microsoft OneDrive are all very popular. But despite using strong encryption, they’re not truly private – because they hold the encryption keys. To store and share files, you should choose a service that lets you create and control the key. I prefer Sync.com. (If you insist on using something else, then at least consider using Cryptomator to guard the private stuff.) Note that Apple’s iCloud now has an option for you to hold the encryption key called Advanced Data Protection, though it does have some exceptions (email, contacts or calendar).
• Private email. So, speaking of email, contacts and calendar… Gmail, Yahoo Mail, Outlook, and most of the other popular “free” email providers are horrible about privacy. You are their product, not their customer. There are many degrees of privacy when it comes to email providers. For most people, Fastmail is a great option. Not only does it have excellent email features, it also has a calendar, contact manager, notes and file storage. If you want to go for a super-private service, I would highly recommend Proton or Tuta.
• Apple products. Apple is one of the very few big tech companies that don’t need your data. Apple sells hardware and makes a hell of a lot of money doing it. And whether it’s altruism or just capitalism at work here, they’ve made a point of making user privacy a key product differentiator. Apple’s record isn’t perfect. But they have a huge reputation to protect and they’re trying very hard to get privacy right.

And here are some products to consider.

• A private WiFi router. Many internet service providers (ISPs) bundle their modem with a built-in Wi-Fi router. Unfortunately, this means that you probably have limited control over the router’s security settings. It also means that your ISP technically has the ability to monitor the network traffic within your home and learn about you through your internet-connected devices. I strongly recommend that you install your own router and disable the WiFi on your ISP’s box. I recently upgraded to the GL.iNet Flint router which only costs about $100 and comes with lots of great privacy features, including open-source firmware.
• NextDNS. A nifty solution for blocking internet tracking and avoiding malicious websites is a privacy-oriented DNS service. The basic plan is free, which will work for most people. But if you have a ton of smart devices like me, you’ll probably need to pay for a plan.
• Apple HomePod mini. This is a nice, private alternative to Amazon Echo or Google Home speakers with a built-in digital assistant (Siri). It’s not portable and the recipient will need an iPhone or iPad to get the most out of it. But it sounds great and will respect your privacy way better than Alexa or Google. It can also be used as an Apple Home automation hub.
• Apple TV. Look, I know this sounds crazy, but modern smart TV’s are watching what you watch and selling this personal data. I recommend disconnecting your smart TV from the internet and using an external streaming box like Apple TV to watch Netflix, Amazon Prime Video, Disney+ and other streaming services. It’s not perfect, but it’s probably the best option for most people.
• Apple AirTags. If you lose stuff a lot, AirTags can be a life-saver. They’re amazingly good at tracking things – luggage, purses, wallets, key rings, bikes, backpacks and even cars. NYPD even gave out AirTags to try to thwart rampant auto theft. However, I have to also say that despite Apple’s best efforts AirTags have been used to stalk people. But I believe that Apple has gone to great lengths to mitigate this risk. I use AirTags all the time and have no qualms giving them as gifts. One more bonus: Apple is going to let you share AirTag locations with airlines, so they can use it to find lost luggage, too.
• USB Condom or portable phone charger. When you charge your smartphone or tablet on a USB port that you don’t own, you run a risk of your device being hacked. This is called juice jacking and can be a problem with public charging ports. But there are two easy fixes: bring your own portable charger or use a power-only USB cable (aka, a “data blocker” or “USB condom”). One fun option is magnetic cables – you insert a tiny nugget into the charging port of the device, then use a special cable that connects to it magnetically. These are power-only cables (no data). Here’s one example, but there are tons of others if you search.
• Faraday pouch. A Faraday Cage is something designed to block radio signals. Your phone, passport, key fob and credit cards all send and receive wireless communications. Okay, so why does that matter? Bad guys can actually do nefarious things if they can get close enough to these devices. For example, someone can steal your car by tricking it into believing your fob is nearby. So, sometimes you want to put these devices in a bag that blocks radio frequencies (RF). Some gift ideas include RF-blocking wallet, passport holder and car key fob pouch/box. If you want to keep your smartphone from giving you away, you can also get a phone pouch. SLNT has a bunch of interesting products, including Faraday backpacks.
• Firewalls Don’t Stop Dragons. My book is pretty big (almost 600 pages and over 200 tips), so it’s not going to fit in someone’s stocking – but it’s a great gift for just about anyone who wants to improve their security and privacy. Don’t let the size put you off – about half of those pages are screenshots and the reading is specifically meant to be fun and easy.
• Digital Defense. This list is enormous. It contains a lot of the same things I have here, but some more obscure items, as well.

Give the Gift of Your Time

After several years of recommending stuff made by other people, I decided last year that I wanted to create something myself. Helping others to improve their security and privacy is great – I do my best. But what if I could help my tribe to help their tribes? Sorta like that old 80’s shampoo commercial… and they told two friends, and they told two friends.

So I’ve put together some security and privacy coupons that you can give to your loved ones this holiday season (or really, at any time). I’ve chosen some top tips for defending your devices and data, and turned them into printable, giftable coupons. An example is shown below.

Now, maybe you’re thinking: I wish someone would give me one of these coupons. Well, you can put these coupons on your wish list! Look through the list and call out the specific ones you’d like to receive.