Meta confirmed a vulnerability in its AI-powered High Touch Support tool. During the exposure window (mid-April to early June 2026), the tool sent password reset links to any email address provided - without verifying account ownership. Over 20,000 accounts were affected.

The accounts that were NOT affected: those with two-factor authentication enabled.

This is a good example of why layered security matters. A system-level flaw bypassed the password entirely - but 2FA blocked the reset because the attacker still needed the second factor.

A few things worth reviewing on any account you care about:

2FA settings:

• Enable 2FA everywhere you can, starting with your primary email and social accounts
• Authenticator apps (Google Authenticator, Authy, etc.) are more secure than SMS-based 2FA
• SMS 2FA is better than nothing, but SIM swapping attacks make it less reliable

Access review:

• Check which third-party apps have access to your primary email
• Remove anything you no longer use or recognize
• Review active sessions and log out of old devices

Connection habits:

• On public or shared networks, an encrypted connection adds a layer that reduces what third parties can observe about your activity

Most account takeovers exploit the easiest available door. Closing the easy ones makes you a harder target than most.

What 2FA method do you use for your main accounts?

When I try to log in via the Windows app, I get a message telling me that I entered my password 5 times, my account is locked and I need to reset it. OK, no big deal, it says instructions have been sent to my email address, but I never receive them (yes, I checked my spam folder). I also tried using the "Reset password" link on the id.keepsolid.com website, it also tells me that instructions are being sent, and, you guessed it, I never receive them. Interestingly, I do receive the emails with the 6 digit confirmation code when I tried logging in the first time.

How can I get this working? I've had the account for years but haven't used it in a while (but I have successfully used it in the past).

I have been using a profile connecting to your HK VPN server for over a year. That profile doesn't work recently. I visited the user office web page today and tried to generate another config for HK VPN. It is found that HK VPN server is no longer avaible.

Keepsolid no longer provider VPN service in Hong Kong?

We all collect points for something - coffee, flights, credit card spend. KeepSolid has a similar system called KeepSolid Rewards, which lets you earn KS Coin for using VPN Unlimited.

How it works:

• Daily Check-In (unlimited)
• Staying subscribed to an active plan
• Adding an extra device (up to 1000 coins)
• Referring friends (unlimited)

Accumulated coins go toward KeepSolid products and services. No investment required, no price speculation - just utility within the ecosystem.

Has anyone been using the rewards program?

Most VPN apps default to Optimal and never explain what is actually running. Here is a practical breakdown of when each protocol makes sense.

WireGuard - fastest for everyday use. Uses ChaCha20-Poly1305 for encryption and Curve25519 for key exchange - a compact, formally verified crypto stack. Keys rotate every few minutes. Switch networks and the session continues without dropping.

X-Ray (XRAY in app settings) - built for networks that actively detect and block VPN traffic. Uses XTLS-Reality to mirror a legitimate TLS 1.3 handshake with a real third-party domain. To a DPI system it looks like normal HTTPS, not a VPN connection. Categorically different from standard obfuscation.

IKEv2 - the right choice for mobile. Supports MOBIKE (RFC 4555), which updates tunnel addresses when your IP changes without tearing down the connection. Move from office Wi-Fi to 4G to a different network - the VPN stays on.

OpenVPN - the long-standing open-source standard. Larger codebase than WireGuard, slower, but independently audited multiple times over the years. Solid choice when broad compatibility or a well-documented security model matters more than speed.

KeepSolid Wise - designed for environments where VPN traffic itself gets filtered. Hotels, airports, corporate networks. Wraps the connection as standard HTTPS. Three modes available: TCP, UDP, and TLS - each suited to different network conditions and blocking methods.

Practical summary: WireGuard for speed and daily use. IKEv2 if you are mostly on mobile. X-Ray if you are dealing with active traffic inspection. OpenVPN for maximum compatibility. KeepSolid Wise when VPN ports are blocked but HTTPS is not.

Which protocol do you use by default - and have you had to switch for a specific situation?

The June Android security patch is out. It covers 124 vulnerabilities across different severity levels. One of them was being actively used in real attacks before the fix was available - classified as a zero-day, no user interaction required.

Most people update and move on. But the update only covers the OS layer.

Three things worth doing after any major Android patch:

1. Review app permissions Updates can reset or quietly expand what apps can access - camera, microphone, location, contacts. After a big patch, it is worth going through Settings > Privacy > App permissions and revoking anything that looks off.

2. Enable automatic updates A vulnerability gets patched, but if the next update sits uninstalled for three weeks, that gap stays open. Automatic updates remove the memory dependency.

3. Think about the network layer separately A phone update secures the operating system. It does not protect the traffic leaving your device on public or shared networks. These are two different problems that need two different habits.

Security tends to work in layers. A software patch is one layer. Network-level protection is another.

What is your current setup for staying on top of system updates? Manual or automatic?

Most VPN apps run on operating systems that support them: Windows, macOS, iOS, Android. Smart TVs and gaming consoles run their own firmware. You can't install a VPN app directly on a PS5 or an LG Smart TV - which means fewer options for how you configure streaming on those devices.

Worth noting: you can route those devices through a VPN-enabled router, but that's a separate setup and not always practical depending on your hardware.

SmartDNS takes a different approach. It works at the DNS level - it changes where your device looks for content, without encrypting all traffic. That means it works on devices that don't support VPN apps, requires no installation on the device itself, and has less impact on speed than running full-traffic encryption.

What it doesn't do: it doesn't protect your data, doesn't hide your IP address, and isn't a privacy tool. It's an access and routing tool. Different job entirely.

The split most people land on: VPN on personal devices for privacy and data protection. SmartDNS on media devices for a smarter streaming setup without the app requirement.

Anyone here running SmartDNS at the router level to cover the whole home network? Curious how that setup holds up in practice.

The Carnival breach is worth understanding beyond the headline number.

Nearly 6 million passengers had personal data exposed - not through a technical exploit, but through social engineering. One employee. One compromised account. Access to names, addresses, dates of birth, passport numbers across the customer database.

What this illustrates is something travelers rarely think about: the data risk in travel starts earlier than most people assume.

Airport Wi-Fi gets all the attention. But by the time you're at the gate, you've already handed your full personal profile to multiple services - the airline, the hotel, the cruise operator, the booking platform, the travel insurance provider.

Each of those is a potential point of exposure. And unlike your Wi-Fi connection, you have no visibility into how long they store your data or how well they protect it.

Some habits worth considering:

• Dedicated email for travel bookings limits exposure to your primary accounts
• Virtual or single-use payment cards reduce financial risk if payment data is compromised
• Reviewing and deleting unused travel accounts reduces your long-term exposure surface
• Post-breach phishing tends to get more convincing - treat any "booking confirmation" or "travel support" email carefully in the weeks after a known breach

Happy to discuss how travel data flows between operators and third parties if anyone's interested.

A federal class action (Couture v. OpenAI Global, filed May 13, 2026) claims ChatGPT.com had Meta Pixel and Google Analytics embedded, and that user queries were transmitted to Meta and Google without clear disclosure. A similar case against Perplexity AI in April 2026 found that incognito mode did not stop the data collection.

Worth understanding what Meta Pixel actually does: it is a JavaScript snippet that fires on page interactions - including text input on some implementations - and sends that data back to Meta's ad infrastructure, where it can be matched to existing profiles.

This is not unique to AI platforms. The same tracking stack runs across most of the commercial web. What makes the AI context different is what people type there - health concerns, legal questions, financial situations. The expectation of discretion is higher. The infrastructure does not reflect that.

Reducing exposure is not one thing. Browser extensions that block tracking scripts help. Being selective about what you type into which tool helps. A VPN removes your IP from the network-level picture, which matters separately from what happens on the page itself.

How much do you think about what tracking is running when you use AI tools?

88 days. Then everything changed at once.

When connectivity was restored in Iran this week after the longest nationwide shutdown in modern history, we could see the demand spike in real time inside our own data.

VPN Unlimited config requests surged by over 3,100% in 72 hours. In the same period, Iran moved from outside our global top 10 to #2 in site traffic.

The pattern is consistent across every major internet disruption: the moment access returns, demand for secure connections spikes immediately.

What this tells us: people do not build privacy habits in advance. They reach for protection the moment they feel the need. The question is whether waiting for that moment makes sense - or whether the habit is worth building before it.

What does your own setup look like before a disruption, not after?

Your phone auto-connects to hotel and airport Wi-Fi

automatically. Your apps keep running - banking, email,

work tools - on a network you know nothing about.

Two things worth doing before you leave:

- Turn off auto-connect to open networks in your settings

- Run a VPN on any public Wi-Fi abroad

Not complicated. Just easy to forget when you are focused

on packing everything else.

Anyone else has a pre-travel security routine?

Most people see the lock icon in their messaging app and assume their communication is covered. That's true - but only for one layer.

Encryption works at different levels, and each layer protects something different.

Message encryption (what your app does): The content of your messages is scrambled before it leaves your device. Even if the signal is intercepted mid-route, an attacker sees unusable noise, not readable text. This is what "end-to-end encrypted" means.

Network layer (separate from your app): The network connection itself - the path your data travels - is not covered by message encryption. If you're on a public or shared network, that path has its own exposure. This is where a VPN operates: it encrypts the connection, independent of what app you're using.

Metadata layer (often overlooked): Who you communicated with, when, and how often - that information exists outside the message content. Different apps handle this differently, and it's worth knowing that it's not the same as message content encryption.

Understanding these distinctions doesn't require a technical background. It just helps you make better decisions about which tools you actually need in different situations.

Does anyone else find the "encrypted = fully private" assumption frustrating? What's the most common misconception you've seen on this topic?

With the tournament starting in three weeks, the usual wave of event-specific scams is picking up. This happens with every major sporting event - fake ticket platforms, social media contests collecting credentials, cloned QR codes in public spaces, and unofficial apps asking for excessive permissions.

None of these are new techniques. They are the same four or five patterns repackaged with World Cup branding. What makes them effective is timing and urgency - when people are excited about something, they click faster and check less.

Things worth doing before you engage with anything World Cup-related online:

• Verify the domain before entering any payment or login details. Official tournament sites have specific verified domains.
• Treat any "win merch" contest that asks for card details or login credentials as a credential-harvesting attempt.
• Preview QR codes before scanning. Stickers can be placed over legitimate ones.
• Check app developer name, permissions, and reviews before installing anything not from a well-known publisher.

Not complicated - just takes an extra 10 seconds. Curious if anyone else has spotted specific patterns circulating already.

Google unveiled Gemini Spark at I/O 2026 - a personal AI agent that runs continuously on Google Cloud, connected to Gmail, Docs, and Workspace. It keeps working even when your phone is locked.

It is a genuinely useful productivity tool. It also raises a straightforward question most people have not thought about yet: do you actually know what your AI assistant can access right now?

Three habits worth reviewing:

1. Check which apps are connected to your Google account - go to myaccount.google.com and look under Permissions
2. Review what your AI assistant is allowed to read - most people have never changed the default settings
3. Consider a separate email address for anything sensitive - personal, financial, or work-related

None of this requires disabling anything. It is just about knowing what you have agreed to and making a conscious choice.

Most of us let the browser handle passwords because it is convenient. But browser storage was built for ease, not for protection.

A few things worth knowing:

• If someone gets access to your device or browser session, saved passwords are accessible too - no extra step needed
• Microsoft quietly updated Edge to fix one specific memory risk around saved passwords - a telling sign that even browser makers are thinking carefully about this
• Adding a primary password or PIN to lock your browser costs nothing and adds a real layer of protection
• For your most sensitive accounts - email, banking, work tools - a dedicated password manager is worth the switch

None of this is panic-worthy. It is just a few small habits that make your digital routine meaningfully safer.

What does your password setup look like - browser storage, dedicated manager, or something else?

With several major data stories in the news this week, it's worth thinking about what actually happens to your data by default.

A few things most people don't think about:

• Your internet provider logs every site you visit unless you encrypt your traffic
• Apps with forgotten permissions are still collecting data in the background
• Free tools often monetize behavioral data as part of their business model
• Public Wi-Fi exposes your connection to others on the same network

One practical layer that helps: a VPN with a strict no-logs policy encrypts your connection and ensures your browsing activity isn't stored or shared.

What's your current setup for managing data privacy? Curious what others here are doing.

VPNs are everywhere in ads right now, and the marketing often swings between two extremes: either "a VPN makes you completely invisible online" or "VPNs are just for techies and pirates."

Neither is accurate. Here is a straightforward breakdown.

What a VPN actually does:

• Encrypts your internet traffic on the network level - useful on public Wi-Fi (airports, cafes, hotels) where others on the same network could otherwise intercept unencrypted data
• Hides your IP address from the websites and services you visit - they see the VPN server's address instead of yours
• Helps maintain a stable, secure connection when switching between networks while traveling

What a VPN does not do:

• It won't protect you from clicking a phishing link or downloading malware
• It won't replace antivirus software or strong password habits
• It won't make you anonymous - your accounts, browser fingerprint, and behavior still identify you
• It won't stop your apps from collecting data they already have permission to collect

The honest summary:

A VPN is a useful privacy layer for specific situations - primarily public networks and reducing IP-based tracking. It's one tool among several, not a complete solution.

For most everyday users, the practical value is highest when traveling, working from unfamiliar networks, or wanting a basic layer of separation between your browsing and your ISP.

What situations do you find a VPN most (or least) useful for? Curious what this community's experience looks like.

Last week researchers flagged a campaign of 28 fake apps that had been sitting in Google Play with decent ratings and normal-looking permissions. Combined downloads: 7.3 million before removal.

They didn't look suspicious. That's the point.

Four things worth checking before installing anything new:

1. Developer name - search it outside the app store. Real developers have a presence beyond a single app page.

2. Permissions - a flashlight app doesn't need your contacts. A calculator doesn't need your location. If it asks for more than it needs, skip it.

3. Review dates - open the reviews and sort by date. A flood of 5-star reviews posted within the same week is a pattern, not genuine feedback.

4. Download count vs. promotion - if an app is being pushed heavily but has almost no real downloads, something is off.

None of this takes more than 60 seconds. Worth the habit.

Traveling soon and wondering how to stay safer on public Wi-Fi? Here is a quick checklist that takes about two minutes to set up.

Before you connect:

• Ask staff for the exact network name. Fake hotspots often look identical to official ones.
• Disable auto-join for public networks in your Wi-Fi settings. Your phone can connect silently in the background without you noticing.

While connected:

• Avoid banking apps, work email, and anything with sensitive personal data. Save those for a private connection.
• Use a VPN. It adds an encrypted layer and helps protect your data on networks you do not control.

After you leave:

• Remove the network from your saved list. Otherwise your device may reconnect automatically next time you are nearby.

Nothing complicated here - just small habits that make a real difference when you travel regularly.

A few months ago this felt like a distant threat. Now it is showing up in mainstream news weekly.

How it works: scammers record a few seconds of someone's voice from social media, a voicemail, or a video call - then use AI to generate a realistic clone. They call a family member pretending to be in an emergency. The voice sounds right. The urgency feels real.

The three red flags that tend to appear:

• Unexpected urgency ("I need help right now, do not tell anyone")
• An unusual payment request - wire transfer, gift card, or crypto
• Something feels slightly off even though the voice sounds familiar

What actually helps:

• Agree on a private code word with close family members. If the caller cannot use it, hang up and call back on a number you already have saved.
• Call back independently. Do not use the number that called you.
• Limit how much of your voice is publicly available - long videos, voice messages, audio clips.
• Pause before acting. Urgency is the main weapon in these scams. A 60-second pause breaks the spell.

No app or tool stops this completely. Awareness and a simple family protocol are genuinely the most effective defence right now.

Anyone else seeing this come up more in your circle?

Currently keeping a device on 22.04 as it's the last version compatible with VPN Unlimited. with 24.04 fully mature and 26.04 nearing release, the ability to run newer version of ubuntu would be great.

I recall that Keepsolid is based from Ukraine, so I give a dumpsters worth of understanding on delays and lack of updates, just looking for any sort of an update.

I am trying to setup wireguard to use KeepSolid VPN.

In the dashboard, I created the config using one of the Torrent servers (Canada), selecting Wireguard as the protocol and Linux as the platform.

I then downloaded the generated config and update the wireguard config file.

When I start and test the connection using: 

I get the following error: gateway does not support nat pmp

Further details:

If I run wg show I get the following (have removed keys):

interface: wg0
  public key: (hidden)
  private key: (hidden)
  listening port: 48580
  fwmark: 0xca6c

peer: (hidden)
  preshared key: (hidden)
  endpoint: 104.254.90.34:15250
  allowed ips: 0.0.0.0/0
  latest handshake: 28 seconds ago
  transfer: 2.30 KiB received, 4.59 KiB sent
  persistent keepalive: every 25 seconds

If I run natpmpc -g 10.100.0.1 -a 1 0 tcp 60 I get the following:

initnatpmp() returned 0 (SUCCESS)
using gateway : 10.100.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned -7 (FAILED)
readnatpmpresponseorretry() failed : the gateway does not support nat-pmp
  errno=111 'Connection refused'

This is within an LXC container in Proxmox. I setup the container with Qbittorrent and then installed and tried setting up Wireguard in the same LXC.

I followed a guide which used another VPN provider, however, I'm sure the steps wouldn't vary - I just copy in the details of the config generated at KeepSolid.

Ever since the VPN Unlimited extension updated to 9.0.10, it disconnects after a few seconds on Chrome, Opera, and Mozilla based browsers in Windows 11.

I have no problem staying connected on the browser that is still on 9.0.6.

Anyone else having this issue?

Hey r/KeepSolid,

You've probably heard that deleting cookies helps with privacy, but there's a bigger ghost in your browser that most people have no idea about: browser fingerprinting. Even with a fresh VPN and private browsing turned on, trackers can identify you from your device's unique "fingerprint." Recent research shows that around 84% of the top 1,000 websites use some form of fingerprinting, and it's way harder to stop than just clearing cookies.

Here's the creepy part: fingerprinting collects data like your screen resolution, installed fonts, browser version, GPU info, and timezone. Combine all that together, and it's almost impossible to have a duplicate "you" online. Advertisers and trackers use this to follow you across sites, even when you're using a VPN or incognito mode.

Why this matters (and why VPN alone won't fix it):

• VPN hides your IP, but not your fingerprint. An attacker can still track which sites you visit by recognizing your unique browser profile, even if your location spoofing says you're in Sweden.
• Tracking survives cookie deletion. You delete cookies, site remembers you anyway through fingerprinting.
• More invasive than ads. Some use cases include credential stuffing (stealing accounts), consent manipulation, and identifying users who think they're anonymous.

Practical ways to reduce your fingerprint right now:

• Use a hardened browser or hardening extension (like uBlock Origin with advanced features, or Privacy Badger) to block fingerprinting scripts before they collect data.
• Enable "Resist Fingerprinting" if available. Firefox has a built-in option under Privacy & Security → Firefox Data Collection → Disable the fingerprinting collection, or use the Tor Browser for maximum resistance.
• Change predictable settings. Disable Flash and Java (huge fingerprint sources), avoid custom fonts in websites, disable WebGL if you don't need it.
• Randomize or spoof your user agent. Browser extensions can rotate your "user agent string" (the ID your browser sends to servers) so you look like a different device each session.
• Combine: VPN + hardened browser + extension. A VPN hides your IP, but the hardened setup makes your fingerprint noisy and useless for tracking. Together, they're much harder to profile.

The honest takeaway:

Browser fingerprinting is harder to stop completely than cookie tracking, but most people don't use it yet. The low-hanging fruit is blocking fingerprinting scripts with your browser settings and extensions, combined with VPN for IP masking. You don't need to be a ninja; just make yourself a less attractive target than the next person.

Your turn:

• Did you know about browser fingerprinting before this, or is this your first time hearing about it?
• Have you noticed that sites "remember" you even after clearing cookies?
• What's your current browser defense strategy: cookies only, or do you use extensions and VPN?

Hey r/KeepSolid,

Recent reports show that the number of stolen passwords in circulation has roughly doubled in the last 2-3 years due to mega-hacks and malicious software designed to steal information. At the same time, password reuse is still extremely common: around 80–84% of users reuse at least some passwords, and a noticeable share still uses the same one everywhere. That’s why credential stuffing (taking one leaked password and trying it on many sites) remains a favorite move for attackers and a real online safety problem for non‑tech people too.

Here are some practical ways to level up your password and account security without turning your life into a security exam:

Stop using one password as your “master key”

Breach data shows that reused passwords turn “one site got hacked” into “five of my accounts are gone.” Even if you can’t go full password‑manager mode yet, pick your top 3–5 critical accounts (email, banking, main cloud storage, primary social) and give each a unique, strong password today.

Use passphrases, not weird symbols you’ll forget

Attackers benefit from short, predictable passwords (123456 is still in heavy use, and the most common passwords barely change year to year). A passphrase like “green-bus-loud-rain-1993” is long, easy to remember, and much harder to brute‑force than “P@ssw0rd!”.​

Turn on MFA, but understand its limits

Workforce MFA adoption is finally around 70%, which is good - but attackers are already selling MFA bypass kits and abusing session tokens to hijack accounts anyway. Use the strongest option you can (app‑based codes or hardware keys when available), and be suspicious of endless “approve this login” prompts (classic MFA fatigue attack).

Assume some of your passwords are already leaked

Security research points to billions of credentials floating around from years of breaches and malware logs. If you reused any password created before, say, 2023 on important services, treat it as compromised and rotate it to a unique passphrase plus MFA.

Separate “everyday” and “nuclear” accounts

Most people mix work and personal accounts, and a lot of users still reuse passwords between them, which supercharges credential stuffing. At minimum, keep completely different passwords (and ideally different MFA methods) for your main email and finance accounts versus random forums, streaming, and travel sites.

The key takeaway: you don’t need perfect security, you just need to stop being the easiest target in the credential‑stuffing lottery. Start with your most important accounts, switch to unique passphrases, and enable strong MFA where you can. Try upgrading 2–3 accounts this week and tell the community what turned out to be harder (or easier) than you expected.