We live in a modern, jet-set, hyper-fast world! When we want to buy something online, boom, zoom, we use our fingerprint or face to approve the transaction, so we can grab the next Segway outta here! We don’t have time to enter a credit card! And can we trust a webpage form? Pfeh!

All right, calm down, 1950s inner voice, it’s not that bad. Most of our transactions involving a payment card or other sensitive data can be safely handled over a secure web connection. Apple Pay in Safari is the highest standard, of course, because the payment process involves encrypted elements, and your card number isn’t disclosed to the merchant. The Wallet app in iOS and the Wallet features in iPadOS and macOS further let us automate the entry of numbers and identifiers on pages we trust.

That’s all for automated commerce. What about other scenarios where you need to provide information to someone, often a friend or a local business, in order to transfer money or conduct a transaction? How can you be sure no one else is snooping in?

Make a call

Voice is still one of the most secure means of providing data. The landline wired and cellular wireless networks may be fertile ground for government agencies, but if you need to read a credit-card number or provide a PIN, a call is often the safest way to do so. By voice, you can always have the other person verify details that you believe only they know, or you can verify details to them for the same.

Because we live in a cyberpunk dystopian future, I do have to add a proviso. AI-generated voices have been convincing for a couple of years now—long enough that you shouldn’t trust an incoming call from someone you think you know, and certainly not from a bank, credit-card company, or other financial institution. I mean, I wrote “How To Avoid AI Voice Impersonation and Similar Scams” in January 2024! I assume the state-of-the-art scam is even better.

(The biggest takeaway is analog, too. Set a family password that you demand from a family member who calls asking for money or to do some weird phone or computer set of instructions.¹)

Unless recorded, voice calls also lack persistence, making them impossible to recover later. A real-time Bob needs to be either between Alice and Carol or doing an AI impression of Alice or Carol.

Use secure messaging

I could make the argument that using secure messaging carries even less risk than a voice call if you’ve had an ongoing messaging conversation with someone, so you know it’s really them. Are unsecured text messages being intercepted willy-nilly?² No, but there is also something about sending plain text all over the cellular networks that gives me the willies, nillies aside.

Secure messaging systems include:

• iMessage: While iMessage has seen exploits, they’re government-grade ones. Its secure end-to-end infrastructure is creaky, but unbroken. There’s an extra detail I’ll mention below.
• RCS with encryption: Between Apple Messages on iOS 26.5 or later and an Android device with RCS encryption support, you have a similar level of end-to-end protection. Make sure you see RCS encryption in the text field, or it’s just plain text. You can also use RCS encryption between two capable Android devices—as if!
• Signal: The Signal app and ecosystem have the best end-to-end encryption, as it implements some of the most modern approaches to protecting older messages and current conversations available so far.

The extra note on iMessage is complicated. Briefly, if you use Messages in iCloud, an encryption key to retrieve those messages is included in an iCloud-based iPhone or iPad backup. With access to your Apple Account, someone could potentially retrieve your stored messages. However, if you enable iCloud’s Advanced Data Protection, the backup is encrypted and requires endpoint decryption using one of your devices, protecting the Messages in iCloud encryption key. This should be a worry only if someone manages to obtain your Apple Account, can activate a second factor, and the information you passed via Messages is so sensitive that someone would hunt to uncover it.

Avoid using SMS or MMS text messages (unencrypted plain text), unencrypted RCS (in-transit/at-rest encryption), or other messaging systems where you’re not sure how they handle data protection. WhatsApp can be used if you either have backups disabled or have enabled end-to-end encrypted backups.

Don’t use most collaborative tools

I know that I spend a lot of time in shared documents, whether Google Docs, Notes, Pages, or more esoteric apps or web apps. Most lack the highest level of protection. Shared Pages and Numbers files on iCloud Drive, as well as Google Docs, are encrypted in transit and at rest, and granting shared access is relatively easy (very easy in Google Docs). For iCloud Drive documents, this is true even with Advanced Data Protection enabled.

I’d be dubious about pasting my driver’s license or credit-card information into any of them that are shared with someone else. Ditto, don’t take a picture of your payment card or driver’s license and share it via a Shared Album in Photos, as it has the same issue.

There are two notable (heh) exceptions: if you and the other party or parties to a shared Notes entry or an iCloud Shared Photo Library all have Advanced Data Protection enabled, end-to-end encryption is used.

Consider the risk

As with all decisions around privacy, consider how at risk you and your data are, including voice as data. In most cases, ensuring a baseline level of encryption can be enough. Even when the app or server can “see” your unscrambled information, the transport between your device and the server and another person’s device is encrypted. Someone would have to break into the server to sniff data. If stored on the server, the baseline state would be encrypted at rest; however, the server operator would manage those encryption keys.

For peace of mind, if not strictly necessary, I’d encourage you to consider using end-to-end encryption when you can. It’s so easily available. For someone to crack your connection, they would need to obtain one of your devices and be able to unlock it. Otherwise, the path between you and someone else is effectively impregnable.

For further reading

I cover message security extensively in my book Take Control of FaceTime and Messages, which I recently updated to include the beta release of RCS encryption for Apple-to-Android communication.

For more on Wallet, I wrote an entire book on that seemingly simple app and set of features, Take Control of Apple Wallet. The book arose from the frustrations of finding where things in Wallet (and outside Wallet but related to it) lived.

On the security side of things, Take Control of Securing Your Apple Devices includes detailed advice on the ins and outs of physical security: how to ensure someone with access to your hardware can’t reach your data.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

Apple’s built-in screen sharing support for Mac-to-Mac connections has always been a help for those of us with remote setups: headless Macs acting as servers, an office and home Mac, or the laziness of having Macs in different parts of your house you want to access without standing up.¹

Under the hood, Apple relies on VNC (Virtual Network Computing), a fairly ancient standard at this point in time, and you probably get the sense of its creaking joints if you use the Screen Sharing app regularly.² But it’s possible you didn’t know that, starting in Sonoma, Apple added a “super excellent” mode to Screen Sharing as an option when you connect two Macs with M-series chips. Called High Performance, it can deliver on its name.

Let’s shift into overdrive

When you connect to another Mac using Screen Sharing, you’re given a choice of which mode to use. Let’s walk through the connection steps:

1. Either launch the Screen Sharing app and double-click the Mac’s name in a list, or, in the Finder, Control-click/right-click the Mac’s name and choose Screen Sharing. (There are still more ways to start, too.)
2. From the Select Screen Sharing Type options, you can select Standard, which is VNC-based, or High Performance, which adds Apple’s secret sauce on top.
3. Click Continue.
4. Enter your credentials.
5. The screen appears, and you may need to enter your macOS account password on the remote Mac to unlock it.

In that pathway, if you choose High Performance, you’re presented with different options. You can also click the info (i) button to the right of an existing connection in the Connections window in Screen Sharing, and choose High Performance from the Screen Sharing Type pop-up menu to save that option for the next connection.

With a Standard connection, you get a pixel-for-pixel remote view of the other Mac’s display or displays. It’s just like you’re sitting in front of it. In fact, if you use the same account as the currently logged-in user, the remote Mac shows what you’re doing to anyone who looks at it. (You can log in as another user, and a session starts in the background that doesn’t appear on the remote display screen.)

High Performance takes a different approach. You can opt to create one or two virtual displays on the remote Mac, each with independent resolution, high-dynamic-range (HDR) support, and other features. It’s like being a remote user of the computer rather than sharing. (This mode doesn’t change the remote display resolution or other settings.)

With a High Performance connection between Apple silicon Macs, you gain these advantages:

• You can choose one or two virtual displays, regardless of the number of displays connected to the shared computer.
• The Dynamic Resolution option lets you resize a virtual display to the native resolution of your local screen, up to 4K (3840×2160 pixels) or, with HiDPI, up to 1920×1080. You can click the Dynamic button on the Screen Sharing toolbar or choose View: Dynamic Resolution during a live session.
• Stereo audio passes over the connection, as does improved video. The connection supports HDR (for richer low-light and shadow tones), 4:4:4 chroma subsampling (uncompressed color data for improved fidelity), and high frame rates of 30 or 60 frames per second (for more stable video streaming, such as when watching a video or using video-editing software).

The downside of High Performance is that it imposes severe requirements for it to work well. You need 75 Mbps per 4K display and low network latency, which requires fast Wi-Fi with a gigabit-or-faster mesh or wired backbone if there are multiple network routers or base stations. However, that requirement also means that when you’re using High Performance, it feels very much like sitting in front of the other display rather than viewing it remotely.

If you want the depth of HDR Video, you have to enable it on the remote Mac via System Settings: Displays. The option for HDR Video appears in a Preset pop-up menu, but, of course, only if the display supports the right HDR signal. HDR can be enabled or disabled from the View menu and Screen Sharing toolbar, if it’s available.

Because the remote display is blacked out when using High Performance (even when connecting as the currently logged-in user), this can be seen as a privacy advantage if you have concerns about anyone else viewing the remote Mac’s screen. However, High Performance mode’s utility really lies in treating Screen Sharing like a high-speed display tunnel instead of a jerky remote view.

For further reading

If you’re looking for more detailed information about High Performance mode or any aspect of Mac-based file and screen sharing, you might consult my book, Take Control of Apple Screen and File Sharing.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]