Carte des cyberrisques

Connaître les risques, garder les bonnes habitudes.

Ouvrez une catégorie pour voir ses technologies, les risques qu’elles comportent et ce qui vous protège.

Réseau domestiqueRouteurs, passerelles, Wi-Fi maillé, NAS, pare-feux, outils de segmentation

Routage et passerelles

Wi-Fi RouterRisque élevé

Points faibles

Default credentials never changed
Outdated firmware with unpatched CVEs
WPS enabled and brute-forceable
Weak WEP/WPA encryption
Remote management exposed to internet
DNS hijacking via compromised admin panel

Comment les attaques se produisent

Attacker logs in with default admin/admin — redirects DNS to malicious servers
Evil twin SSID mimics home network, intercepts all traffic
Router enlisted into Mirai botnet for DDoS attacks
MITM intercepts unencrypted HTTP sessions

Ce qui vous protège

Change default admin credentials immediately
Enable WPA3 or WPA2-AES; disable WEP/WPA
Disable WPS, UPnP, and remote management
Update firmware monthly or enable auto-update
Create separate guest network for IoT devices

Bonnes habitudes

Use reputable brands with active security lifecycle
Consider pfSense for advanced home firewall
Review connected devices list monthly
Enable DNS-over-HTTPS on router

ISP Modem / GatewayRisque moyen

Points faibles

ISP retains backdoor admin access
Default Wi-Fi password on device label
Slow ISP-controlled firmware patching
Shared infrastructure across subscribers

Comment les attaques se produisent

Physical attacker reads Wi-Fi credentials from label
DNS hijacking via modem admin panel compromise
ISP-level supply chain compromise of firmware

Ce qui vous protège

Place personal router behind ISP modem
Change default Wi-Fi password on gateway
Enable modem's built-in firewall
Request ISP disable remote management

Bonnes habitudes

Buy your own modem to reduce ISP control
Review ISP data retention policy annually
Use VPN at router level for all traffic

Mesh Wi-Fi System (Eero / Google Nest / Orbi)Risque moyen

Points faibles

Cloud-dependent management creates extra attack surface
Mobile app API vulnerabilities
Vendor stores network topology data
Inter-node traffic potentially unencrypted

Comment les attaques se produisent

Vendor cloud account compromise gives full network access
Malicious OTA firmware via vendor infrastructure
Companion app API vulnerability exposes controls

Ce qui vous protège

Strong password + MFA on vendor cloud account
Review vendor privacy and data policy
Keep firmware updated via app
Disable unused port forwards

Bonnes habitudes

Choose vendors with bug bounty programs
Segment IoT to separate VLAN
Audit connected device lists regularly

pfSense / OPNsense FirewallRisque moyen

Points faibles

Misconfigured firewall rules expose LAN
Outdated packages with known CVEs
Weak admin credentials on web UI
Exposed management interface on WAN

Comment les attaques se produisent

Attacker exploits unpatched HAProxy package for RCE
Brute-force on web UI grants full network control
Misconfigured NAT exposes internal services

Ce qui vous protège

Restrict web UI to LAN only
Use strong passwords + 2FA via plugin
Update OS and packages monthly
Enable logging and review weekly

Bonnes habitudes

Deploy IDS/IPS (Suricata, Snort)
Use VLANs for segmentation
Maintain configuration backups offline

Stockage et sauvegarde

Network-Attached Storage (NAS)Risque élevé

Points faibles

Default admin credentials
Services exposed directly to internet (port 5000/443)
Ransomware targeting NAS via network shares
Unpatched NAS OS (Synology/QNAP CVEs routinely exploited)

Comment les attaques se produisent

QNAP/Synology ransomware: DeadBolt encrypted thousands of NAS devices
Exposed NAS admin portal brute-forced from internet
NAS used as staging point for lateral movement on network

Ce qui vous protège

Never expose NAS directly to internet; use VPN for remote access
Change default credentials; disable admin account
Enable auto-updates; apply security advisories promptly
Enable 2FA on NAS admin interface

Bonnes habitudes

Enable immutable snapshots for ransomware recovery
Review which services are publicly accessible
Enable IP block-listing after failed login attempts

Cloud Backup Service (Backblaze / iDrive)Risque moyen

Points faibles

Account credentials reusable from breaches
No client-side encryption by default
Vendor breach exposes years of data
Restore process slow during incidents

Comment les attaques se produisent

Credential stuffing accesses backup archive
Ransomware encrypts files which then sync to backup, replacing clean copies
Vendor data breach exposes file metadata

Ce qui vous protège

Enable client-side encryption with private key
Use unique strong password + MFA
Choose vendor with versioning / point-in-time restore
Periodically test restore procedure

Bonnes habitudes

Follow 3-2-1 rule (3 copies, 2 media, 1 offsite)
Air-gap a periodic full backup
Audit account access logs quarterly

External / Portable USB DriveRisque faible

Points faibles

No encryption — physical theft = full data exposure
Lost or misplaced easily
USB malware (BadUSB)
No tamper indication

Comment les attaques se produisent

Lost drive at airport reveals years of personal data
BadUSB-style firmware attack pivots into host
Office cleaner copies drive contents

Ce qui vous protège

Use VeraCrypt or BitLocker To Go for full-disk encryption
Pair with strong passphrase, not just PIN
Disable USB autorun on hosts
Label and inventory drives

Bonnes habitudes

Prefer hardware-encrypted drives (Apricorn, iStorage)
Wipe drives securely before disposal
Avoid plugging unknown drives

Segmentation du réseau

Smart Ethernet Switch / PoERisque moyen

Points faibles

Default credentials on managed switches
Unencrypted management via Telnet
VLAN misconfiguration allows lateral movement
Firmware rarely updated

Comment les attaques se produisent

Attacker accesses management interface via default login
VLAN hopping exposes corporate traffic on home network
Compromised PoE switch powers malicious devices

Ce qui vous protège

Change default credentials; disable Telnet — use SSH only
Segment networks via properly configured VLANs
Update switch firmware; disable unused ports

Bonnes habitudes

Disable management access from untrusted ports
Use 802.1X authentication for port access control
Log all admin access to switch

Guest / IoT VLANRisque faible

Points faibles

Misconfigured inter-VLAN routing leaks traffic
mDNS/Bonjour leaks across VLANs by default
Improper firewall rules between segments

Comment les attaques se produisent

Compromised IoT device pivots to main LAN due to permissive firewall rule
Guest discovers production printer via mDNS leak

Ce qui vous protège

Default-deny inter-VLAN traffic; allow specific flows only
Use mDNS reflector with strict per-interface rules
Audit firewall rules quarterly

Bonnes habitudes

Place all IoT, smart TVs, cameras on isolated VLAN
Treat guest VLAN as untrusted internet
Document VLAN purpose and rules

Outils de sécurité réseau

Pi-hole / AdGuard Home (DNS sinkhole)Risque faible

Points faibles

Single point of DNS failure
Web admin UI exposed if not firewalled
Outdated blocklists may miss new threats
Update mechanism could be hijacked

Comment les attaques se produisent

Attacker compromises Pi-hole UI, redirects DNS to malicious resolver
Malware bypasses sinkhole using DoH directly to attacker server

Ce qui vous protège

Restrict admin UI to LAN only; use strong password
Enable DNS-over-HTTPS upstream (Cloudflare, Quad9)
Auto-update blocklists weekly
Block outbound DoH/DoT from clients (force them through Pi-hole)

Bonnes habitudes

Run on dedicated Pi or container
Maintain a secondary resolver for HA
Review blocked-domain reports weekly

Home IDS/IPS (Suricata, Zeek, Wazuh)Risque faible

Points faibles

False positives cause alert fatigue
Sensor placement misses encrypted traffic
Resource-intensive on small hardware
Outdated signature feeds

Comment les attaques se produisent

Critical alerts ignored due to noise
Encrypted exfiltration goes undetected
Attacker disables agent on compromised host

Ce qui vous protège

Tune rules to your environment
Update Emerging Threats / Talos rulesets weekly
Forward logs to a separate, hardened collector
Monitor agent health

Bonnes habitudes

Start with detect-only mode (IDS) before IPS
Use Wazuh for correlated host + network telemetry
Document and review high-severity alerts

Informatique personnellePortables, PC, tablettes, smartphones, liseuses, assistants IA

Appareils mobiles

SmartphoneRisque critique

Points faibles

OS not updated — known zero-days exposed
Malicious sideloaded apps
Excessive app permissions (mic, camera, location)
Weak 4-digit lock screen PIN
Juice jacking via public USB chargers
Bluetooth always-on broadcasts device

Comment les attaques se produisent

Spyware via malicious app reads messages, contacts, location
SIM swap at carrier intercepts SMS 2FA codes
Juice jacking via compromised public charger
Stalkerware installed via brief physical access

Ce qui vous protège

Full disk encryption (default iOS; verify Android)
Biometric + 6-digit PIN
Official app stores only; revoke unused permissions
USB data blocker for public charging
Enable remote wipe / Find My

Bonnes habitudes

Authenticator app (not SMS) for 2FA
Auto-update OS and apps
Mobile security app (Lookout, Bitdefender)
SIM PIN via carrier to prevent SIM swap

Tablet (iPad / Android tablet)Risque moyen

Points faibles

Shared family device without account separation
Child app installs without oversight
End-of-life devices with no security updates
Public Wi-Fi without VPN

Comment les attaques se produisent

Child downloads malware-laden app
Visitor accesses saved credentials on shared tablet
Phishing via unsafe browser session

Ce qui vous protège

Child profiles with parental controls
Restrict app installs to trusted accounts
Replace EOL devices
VPN on public networks

Bonnes habitudes

Monthly app permission review
Screen time and content limits for children
No sensitive financial data on shared tablets

eSIM / Dual-SIM PhoneRisque moyen

Points faibles

eSIM provisioning hijack via QR code phishing
Carrier-side eSIM swap easier than physical SIM swap
Multiple numbers complicate compromise detection

Comment les attaques se produisent

Attacker social-engineers carrier to provision eSIM on attacker device
QR phishing tricks user into provisioning attacker eSIM
Work line and personal line both compromised in one swap

Ce qui vous protège

Set carrier port-out PIN/passphrase
Use authenticator apps over SMS 2FA
Monitor carrier account for new eSIM activations
Enable carrier identity verification (e.g., Number Lock at Bell/Rogers)

Bonnes habitudes

Treat phone number as compromised — minimize SMS-based auth
Subscribe to carrier fraud alerts
Document recovery procedure if SIM is hijacked

Ordinateur de bureau et portable

Laptop / DesktopRisque élevé

Points faibles

Unpatched OS and third-party software
No full-disk encryption
No antivirus or outdated definitions
USB auto-run enabled
Shared admin accounts across family

Comment les attaques se produisent

Drive-by malware from compromised website
USB drop attack installs RAT
Keylogger delivered via phishing attachment
Ransomware encrypts all files
Physical theft of unencrypted device

Ce qui vous protège

BitLocker (Windows) or FileVault (macOS)
Keep OS and all software updated
Reputable AV/EDR solution
Disable USB auto-run
Separate user accounts per person

Bonnes habitudes

3-2-1 backup rule (3 copies, 2 media, 1 offsite)
Password manager; don't save in browser
Enable Secure Boot in BIOS
Use standard account daily; admin only when needed

Linux WorkstationRisque moyen

Points faibles

False sense of immunity to malware
Sudo misconfiguration grants full root
Outdated repositories miss security patches
Personal scripts running with elevated privileges

Comment les attaques se produisent

Cross-platform supply-chain attack via npm/pypi packages
Misconfigured SSH server brute-forced
Browser zero-day exploited identically to Windows

Ce qui vous protège

Enable unattended-upgrades / dnf-automatic
Use SELinux or AppArmor
Disable SSH password auth; key-based + fail2ban
Use a non-root user daily

Bonnes habitudes

Run a minimal, supported distro (Ubuntu LTS, Fedora)
Verify package signatures
Use Flatpak/Snap sandboxing where possible

Homelab Server / ProxmoxRisque moyen

Points faibles

Web UI exposed to internet
Default credentials on hypervisor
VM escape vulnerabilities
No network segmentation between guests

Comment les attaques se produisent

Attacker accesses Proxmox UI on port 8006, deploys cryptominer
VM escape from compromised guest
Lateral movement across all VMs on flat network

Ce qui vous protège

Restrict UI to VPN only
Strong passwords + 2FA on hypervisor
Apply patches monthly
Use VLANs and firewall between VMs

Bonnes habitudes

Snapshot before changes
Isolate management network
Monitor with Wazuh / Prometheus

Objets portables

Smartwatch / Fitness TrackerRisque moyen

Points faibles

Sensitive health data in vendor cloud (heart rate, sleep, location, fertility)
Vendor acquisition changes privacy terms
BLE proximity tracking
Health data accessible to insurers if sold

Comment les attaques se produisent

Vendor sells health data to insurers or advertisers
Compromised account reveals location patterns
Bluetooth sniffing enables physical tracking in public

Ce qui vous protège

Restrict all data sharing in companion app
MFA on platform account
Disable BLE when not syncing
Read privacy policy before purchase

Bonnes habitudes

Choose privacy-committed vendors
Export and delete data when leaving platform
Opt out of research/analytics programs immediately

Smart Ring (Oura / Galaxy Ring)Risque moyen

Points faibles

Continuous biometric collection (HRV, temperature, sleep stages)
Subscription model creates lock-in
Cloud-only access to your own data
Vendor breach exposes health profile

Comment les attaques se produisent

Insurance discrimination based on leaked sleep / stress data
Stalker uses cloud account to monitor location and routine
Re-identification from "anonymous" health datasets

Ce qui vous protège

MFA on vendor account
Review and minimize data sharing
Export data periodically; delete on cloud
Use unique email for the account

Bonnes habitudes

Prefer vendors offering local-only mode
Read GDPR/PIPEDA disclosures
Cancel and wipe data when discontinuing

E-Reader (Kindle / Kobo)Risque faible

Points faibles

Linked store account stores payment info
E-books may contain malicious PDFs
Sync exposes reading habits to vendor
Old firmware rarely updated

Comment les attaques se produisent

Compromised account enables unauthorized purchases
Malicious e-book exploits PDF parser vulnerability

Ce qui vous protège

MFA on e-reader store account
Keep firmware updated
Review linked payment methods

Bonnes habitudes

Use gift cards instead of saved payment methods
Disable Wi-Fi when not in use

Assistants IA

ChatGPT / Claude / Gemini Desktop AppRisque moyen

Points faibles

Conversation history may be used for training
Prompt injection via shared documents
Plugins/connectors with broad scopes
Sensitive data pasted into prompts

Comment les attaques se produisent

Employee pastes customer data into prompt — vendor retains it
Malicious shared document hijacks agent to exfiltrate files
Compromised account exposes years of conversation history

Ce qui vous protège

Disable training-on-data setting
Use enterprise/team plans with no-train guarantee
Audit installed connectors and revoke unused
Never paste secrets, PII, or regulated data

Bonnes habitudes

Local LLM (Ollama, LM Studio) for sensitive workloads
MFA on AI account
Document acceptable-use policy at home/work

GitHub Copilot / AI Coding AssistantRisque moyen

Points faibles

Suggests insecure code patterns
Leaks proprietary code into telemetry
Suggests memorized secrets from training data
Supply-chain risk via suggested packages

Comment les attaques se produisent

Hardcoded credentials suggested and committed
Vulnerable dependency installed based on suggestion
Reverse-engineered training data leaks confidential snippets

Ce qui vous protège

Enable enterprise / business plan with code-not-used-for-training
Use SAST + secret-scanning on AI-generated code
Review every suggestion before accepting

Bonnes habitudes

Pair AI suggestions with code review
Disable telemetry where possible
Train developers on common AI failure modes

Concentrateur et assistantsAssistants vocaux, afficheurs, concentrateurs, appareils Matter/Thread, plateformes d'automatisation

Assistants vocaux

Smart Speaker (Alexa / Google Home)Risque moyen

Points faibles

Always-on microphone — passive surveillance
Anyone physically present can issue commands
Linked account is high-value target
Third-party skills may be malicious

Comment les attaques se produisent

Ultrasonic "dolphin attack" issues inaudible commands
Compromised Amazon account enables unauthorized purchases
Malicious Alexa skill phishes credentials

Ce qui vous protège

Physical mute button when not in use
Require voice PIN for purchases
Remove unused third-party skills
MFA on linked Amazon/Google account

Bonnes habitudes

Place away from windows (ultrasonic mitigation)
Regularly delete voice history in app
All smart home devices on separate IoT network

Smart Display (Echo Show / Nest Hub)Risque moyen

Points faibles

Camera and microphone always on
Displays personal calendar, messages, photos
Linked account high-value
Children may access adult services

Comment les attaques se produisent

Physical attacker views private calendar or photos on display
Visual eavesdropping of displayed messages
Compromised display used to monitor home occupancy

Ce qui vous protège

Disable camera/mic when not needed
Place away from sensitive areas
Use guest/restricted profiles for children
MFA on linked account

Bonnes habitudes

Cover camera physically when not in use
Review daily-summary content shown publicly
Audit linked services and apps

Apple HomePod / Siri DevicesRisque faible

Points faibles

iCloud account compromise affects HomeKit
Voice recognition can be fooled
Limited automation cross-ecosystem

Comment les attaques se produisent

Compromised iCloud account unlocks HomeKit-controlled doors
Replay attack with recorded voice unlocks personal data

Ce qui vous protège

Strong Apple ID password + MFA
Enable "Recognize Voice" only for trusted users
Review HomeKit shared users quarterly

Bonnes habitudes

Use Advanced Data Protection on iCloud
Limit HomeKit to truly trusted family
Disable Siri on lock screen for sensitive commands

Concentrateurs et plateformes

SmartThings / Hubitat HubRisque moyen

Points faibles

Cloud dependency — local control depends on hub model
Custom code from community apps unvetted
Z-Wave/Zigbee pairing mode physical exploit window
Account compromise = full home control

Comment les attaques se produisent

Malicious community app exfiltrates sensor data
Attacker in pairing range hijacks new devices
Cloud breach exposes home automation rules and routines

Ce qui vous protège

MFA on platform account
Vet every community app before install
Pair devices in a controlled, brief window
Prefer hubs with strong local control (Hubitat, Home Assistant)

Bonnes habitudes

Backup hub configuration regularly
Segment hub on IoT VLAN
Review automations and access quarterly

Home Assistant (self-hosted)Risque moyen

Points faibles

Web UI exposed via Nabu Casa or port forward
Custom integrations (HACS) increase attack surface
Add-on containers may run privileged
Backup contains all secrets if not encrypted

Comment les attaques se produisent

Exposed UI brute-forced; full home control taken
Malicious HACS integration exfiltrates tokens
Unencrypted backup leak reveals API keys for every integration

Ce qui vous protège

Use Nabu Casa or VPN — never raw port forward
MFA enabled on all admin users
Enable backup encryption
Run on dedicated hardware on IoT VLAN

Bonnes habitudes

Audit installed integrations monthly
Review automations for unintended triggers
Subscribe to HA security advisories

Matter / Thread DevicesRisque faible

Points faibles

New protocol — implementation bugs likely
Border router becomes critical single point
Commissioning QR code phishing
Vendor cloud may still be required

Comment les attaques se produisent

Malicious QR code commissions device into attacker fabric
Border router compromise affects entire Thread mesh
Vendor cloud breach despite local Matter control

Ce qui vous protège

Buy from reputable vendors with security commitments
Pair only via trusted controllers
Keep border router firmware updated
Verify devices appear in expected fabric

Bonnes habitudes

Prefer local-only operation when possible
Audit Matter fabrics on hub
Reset and re-commission suspicious devices

Éclairage et énergie connectésAmpoules, prises, interrupteurs, moniteurs d'énergie, onduleurs solaires

Éclairage

Smart Bulb (Hue / LIFX / Tuya)Risque faible

Points faibles

Insecure pairing protocols on cheap brands
Bulb leaks Wi-Fi credentials when factory reset (older Hue)
Cloud account compromise allows remote control
Telemetry to vendor reveals home occupancy

Comment les attaques se produisent

Discarded bulb extracted to recover Wi-Fi password
Mass remote shut-off via compromised vendor account
Occupancy inference from on/off patterns

Ce qui vous protège

Factory reset and physically destroy bulbs before disposal
MFA on vendor account
Use Zigbee/Matter local bulbs over cloud-only Wi-Fi bulbs

Bonnes habitudes

Choose vendors that publish security policies
Place on IoT VLAN
Avoid no-name Tuya bulbs for sensitive areas

Smart Switch / DimmerRisque faible

Points faibles

Mains-powered — physical install hazard if vendor abandons firmware
Cloud account high-value
Some flash custom firmware (Tasmota) — risk and reward

Comment les attaques se produisent

Vendor goes out of business — switches become unmanageable but still on mains
Compromised account turns off freezer or critical equipment

Ce qui vous protège

Choose vendors with long support history
MFA on app account
Document a manual override path

Bonnes habitudes

Prefer Matter/Zigbee for local control
Test failure modes (Wi-Fi down, cloud down)

Alimentation et énergie

Smart PlugRisque moyen

Points faibles

Cheap brands ship with hardcoded backdoors
Telemetry reveals device usage patterns
Insecure web interfaces on local network
Vendor cloud breaches

Comment les attaques se produisent

Researchers found hardcoded creds in TP-Link Kasa plugs
Energy data infers when residents are home
Compromised plug toggled to interrupt critical devices

Ce qui vous protège

Buy from reputable vendors
Place on IoT VLAN
Disable cloud sync if local control suffices
MFA on vendor account

Bonnes habitudes

Avoid plugs for life-safety equipment (medical, freezers)
Audit plug list monthly
Update firmware via app

Whole-Home Energy Monitor (Sense / Emporia)Risque faible

Points faibles

Granular load disaggregation reveals individual appliance use
Cloud-only data storage
Account compromise exposes full energy profile

Comment les attaques se produisent

Insurance / utility uses leaked data to infer behavior
Burglar uses pattern analysis to time entry

Ce qui vous protège

MFA on vendor account
Review data retention and sharing
Use local-only options where available

Bonnes habitudes

Place sensor in main panel only — not sub-meters of sensitive areas
Periodically delete historical data

Solar Inverter / Battery SystemRisque élevé

Points faibles

Internet-connected inverters often default-credentialed
Vulnerabilities (e.g., SolarMan, Enphase) allow remote shutdown
Aggregated grid impact if many compromised
Firmware updated infrequently

Comment les attaques se produisent

Researchers demonstrated remote shutdown of thousands of inverters via vendor cloud
Local network attacker disables home power
Battery firmware bug overheats cells

Ce qui vous protège

Place inverter on isolated VLAN — block direct internet
Change defaults; enable MFA on vendor portal
Apply firmware updates promptly

Bonnes habitudes

Choose vendors with published security disclosures
Maintain manual transfer / off-grid procedure
Monitor for unexpected production drops

Sécurité du domicileCaméras, sonnettes, serrures intelligentes, alarmes, ouvre-portes de garage

Caméras et sonnettes

Wi-Fi Indoor / Outdoor CameraRisque élevé

Points faibles

Default credentials never changed
Footage stored unencrypted in vendor cloud
Open RTSP streams exposed to internet
Firmware rarely updated

Comment les attaques se produisent

Mirai-class botnet recruits insecure cameras
Unauthorized viewers access feeds via Shodan-discovered RTSP
Vendor cloud breach exposes weeks of footage

Ce qui vous protège

Change default credentials; enable MFA on vendor account
Disable UPnP and direct internet exposure
Update firmware; verify vendor security commitments
Place cameras on isolated VLAN

Bonnes habitudes

Avoid cameras in bedrooms / bathrooms
Notify household and visitors of recording
Review footage retention and sharing policy

Video Doorbell (Ring / Nest / Eufy)Risque moyen

Points faibles

Footage shared with law enforcement requests
Vendor employee access (historical Ring incidents)
Bluetooth pairing exploitable during install
Audio captures bystanders without consent

Comment les attaques se produisent

Eufy was caught uploading thumbnails despite local-storage claims
Bystanders identified via facial recognition
Compromised account allows real-time monitoring

Ce qui vous protège

Strong unique password + MFA
Review and limit law-enforcement sharing settings
Disable cloud features if local works

Bonnes habitudes

Notify visitors that recording occurs (laws vary by province)
Audit shared users
Consider local-storage models

Serrures et accès

Smart Lock (August / Yale / Schlage Encode)Risque élevé

Points faibles

Bluetooth relay attacks unlock doors
Cloud account compromise grants physical entry
Battery failure during attack window
Sharing codes via app may be over-permissioned

Comment les attaques se produisent

Relay attack from outside with accomplice near phone unlocks door
Stolen / phished cloud credentials grant entry
Guest with one-time code arrives, then re-shares it

Ce qui vous protège

Disable proximity auto-unlock
MFA on lock app account
Use time-limited, single-use codes
Pair with deadbolt + alarm

Bonnes habitudes

Audit access log weekly
Rotate guest codes after use
Maintain physical key as backup

Garage Door Opener (MyQ / smart hub)Risque moyen

Points faibles

Old fixed-code remotes trivially replayable
Cloud account = remote door open
Companion app vulnerabilities
API integrations (Tesla, IFTTT) expand attack surface

Comment les attaques se produisent

Replay attack on fixed-code opener allows entry
Compromised account opens door remotely for accomplice
Removed third-party API access disrupts integrations (MyQ history)

Ce qui vous protège

Replace fixed-code with rolling-code opener
MFA on cloud account
Disable unused integrations
Audit "shared users" list

Bonnes habitudes

Notification on every open/close event
Manual disconnect for travel periods
Combine with garage interior camera

Alarmes et capteurs

Wireless Alarm System (SimpliSafe / Ring Alarm)Risque moyen

Points faibles

RF jamming disables sensor-to-base communication
Cellular failover may have weak signal
Default duress codes often unset
Cloud monitoring outage = no professional response

Comment les attaques se produisent

Researchers demonstrated SimpliSafe jamming attacks
Burglar disables Wi-Fi at meter; alarm silenced
Account takeover disables system

Ce qui vous protège

Choose systems with anti-jam detection
Set duress codes; train all family members
Cellular + Wi-Fi failover; UPS for base station
MFA on monitoring account

Bonnes habitudes

Test system monthly
Combine with cameras for verification
Local siren that works without cloud

Smart Smoke / CO Detector (Nest Protect)Risque faible

Points faibles

Cloud dependency for notifications — no Wi-Fi = no alert to phone
EOL devices stop receiving updates
Battery failure silently

Comment les attaques se produisent

User assumes alert reached phone but Wi-Fi was down
Compromised account hides alerts

Ce qui vous protège

Verify local alarm sounds regardless of cloud
Test monthly per Canadian fire code
Replace per manufacturer end-of-life schedule

Bonnes habitudes

Combine with traditional hard-wired detectors
MFA on Nest account
Maintain CO detector in every sleeping area (CSA recommendation)

Identité & AuthentificationMots de passe, MFA, SSO, sécurité email

Gestionnaires de mots de passe

1PasswordRisque moyen

Points faibles

Master password is single point of failure
Browser extension XSS risks
Cloud sync exposes encrypted vault
Phishing pages mimic 1Password unlock

Comment les attaques se produisent

Master password phishing via fake unlock prompt
Compromised browser extension exfiltrates vault
Account takeover if MFA not enabled on 1Password account itself

Ce qui vous protège

Use a long unique passphrase as master password (5+ random words)
Enable 2FA on 1Password account (hardware key preferred)
Keep Secret Key safely backed up offline
Update apps and extensions promptly

Bonnes habitudes

Use Watchtower to monitor breached credentials
Enable Travel Mode when crossing borders
Audit shared vaults quarterly
Use unique passwords for every site (even low-value ones)

BitwardenRisque moyen

Points faibles

Master password reuse risk
Self-hosted instances poorly maintained
Browser extension supply chain
Free tier lacks MFA on every device

Comment les attaques se produisent

Phishing master password via cloned login page
Self-hosted Vaultwarden exposed without HTTPS
Malicious extension update steals vault

Ce qui vous protège

Use strong unique master password
Enable hardware key 2FA (YubiKey)
If self-hosting, use HTTPS + reverse proxy + fail2ban
Regularly export encrypted backups

Bonnes habitudes

Subscribe to premium for emergency access
Review login history monthly
Disable browser auto-fill on untrusted sites
Use Bitwarden Send for secure file/text sharing

KeePass / KeePassXCRisque faible

Points faibles

Local database file can be stolen
No native cloud sync — users build risky workflows
Plugins are unvetted third-party code
KeeFarce-style attacks on running process

Comment les attaques se produisent

Stolen .kdbx file brute-forced offline
Malicious plugin exfiltrates entries
Memory dump of unlocked KeePass process

Ce qui vous protège

Use long passphrase + key file as composite key
Store .kdbx on encrypted volume only
Avoid third-party plugins unless audited
Lock workspace when away from device

Bonnes habitudes

Use Argon2 KDF (not AES-KDF) for new databases
Sync via your own encrypted cloud (e.g., Cryptomator + Drive)
Keep offline backup copies
Use KeePassXC over original KeePass on Linux/macOS

Browser-built password managersRisque élevé

Points faibles

Vault tied to OS/browser account — single sign-on creates lateral risk
Weak master protection on Windows (DPAPI bypass)
Synced across all signed-in devices
Limited cross-browser portability

Comment les attaques se produisent

Malware (RedLine, Vidar) extracts entire Chrome/Edge vault from disk
Family member with device access reads all saved passwords
Lost device with auto-login unlocks every saved site

Ce qui vous protège

Disable browser password saving; use a dedicated manager
If using browser manager, enable OS biometric prompt before reveal
Enable strong device login + screen lock

Bonnes habitudes

Migrate to dedicated password manager
Audit and clear saved passwords periodically
Never use browser manager on shared/family devices for sensitive accounts

Authentification multifacteur

Authenticator apps (Authy, Google, Microsoft)Risque moyen

Points faibles

Cloud-backup of TOTP seeds (Authy, Google Auth) creates a remote target
Lost device locks user out if no backup
Push-fatigue attacks on Microsoft Authenticator
Phone malware reads codes via screen capture

Comment les attaques se produisent

Authy account hijack (2022 Twilio breach exposed seeds)
MFA-bombing tricks user into approving malicious push
Stolen device with no PIN gives codes immediately

Ce qui vous protège

Disable cloud backup of TOTP seeds where possible
Enable Authenticator app PIN/biometric lock
Use number-matching MFA prompts (Microsoft)
Backup recovery codes in password manager

Bonnes habitudes

Prefer hardware keys for high-value accounts
Maintain a backup authenticator on a second device
Periodically test recovery codes
Migrate to phishing-resistant methods (passkeys/WebAuthn)

Hardware security keys (YubiKey, Titan)Risque faible

Points faibles

Physical loss/theft of key
Limited site support for FIDO2
Older U2F-only keys lack backup options
Some keys vulnerable to side-channel (older Yubico FW)

Comment les attaques se produisent

Lost key + no backup = account lockout
Coercion: physical adversary forces key tap
Supply-chain tampering on counterfeit keys

Ce qui vous protège

Always register at least 2 keys per account
Buy from official vendor only (Yubico, Google, Feitian)
Enable PIN on FIDO2 keys for presence + knowledge factor
Store backup key in fireproof safe / safety deposit box

Bonnes habitudes

Keep one key on keyring, one in secure storage
Use NFC-capable keys for mobile compatibility
Register passkeys where supported
Disable SMS fallback once hardware key is set up

Passkeys (FIDO2 / WebAuthn)Risque faible

Points faibles

Vendor-locked passkey sync (iCloud/Google) creates platform dependency
Cross-platform recovery still maturing
Family members on shared Apple ID could see passkeys
Lost-account recovery flows still rely on weaker factors

Comment les attaques se produisent

Apple ID / Google account compromise unlocks all passkeys
Phishing of fallback recovery method bypasses passkey
Shared device on family Apple ID exposes accounts

Ce qui vous protège

Use a strong unique password + hardware key on the parent platform account (Apple/Google)
Avoid family-shared Apple ID for sensitive logins
Maintain hardware-key passkeys (YubiKey 5, Titan) for portability

Bonnes habitudes

Use passkeys for every site that supports them
Periodically review passkey list per account
Combine passkeys with strict device PINs and biometrics
Test the recovery flow before relying on it solely

SMS / Voice OTPRisque élevé

Points faibles

SIM-swap attacks at carrier
SS7 protocol weaknesses allow SMS interception
Codes visible on lock screen
Carrier insider risk

Comment les attaques se produisent

SIM swap then drain bank account / hijack email
SS7 interception of SMS code (used by sophisticated attackers)
Shoulder surfing of code on lock screen

Ce qui vous protège

Set carrier SIM PIN / port-out lock with provider (Bell/Rogers/Telus offer this in Canada)
Hide message previews on lock screen
Migrate critical accounts to TOTP/hardware keys

Bonnes habitudes

Treat SMS MFA as legacy — replace where possible
Never use SMS MFA for crypto exchanges or password manager
Confirm carrier escalation procedures for port-out fraud

SSO & Fédération

Points faibles

IdP account compromise = mass account takeover
Disabled IdP account = lost access to dependent services
Phishable consent screens
Permissions creep across third-party apps

Comment les attaques se produisent

Compromised Google account unlocks dozens of SSO services
Malicious OAuth app harvests Gmail/Drive scopes
Account suspension by IdP locks user out of unrelated services

Ce qui vous protège

Maximum security on IdP account: hardware key + strong password
Quarterly review of OAuth-connected apps and revoke unused
Avoid using SSO for highest-value accounts (bank, password manager)

Bonnes habitudes

Document where you used each SSO provider
Maintain a dedicated alternative email for critical accounts
Enable IdP account recovery options carefully

Corporate SSO (Okta, Azure AD/Entra)Risque élevé

Points faibles

IdP compromise = enterprise-wide breach (Okta 2022/2023 incidents)
Misconfigured SCIM provisioning leaks data
Token replay if session not bound to device
Stale accounts retain SSO access

Comment les attaques se produisent

Okta admin compromise → lateral movement across SaaS apps
MFA-bombing of corporate users
Token theft via infostealer malware then replay

Ce qui vous protège

Enforce phishing-resistant MFA (FIDO2) for all admins
Conditional access: device compliance + IP restrictions
Short session lifetimes; require re-auth for sensitive apps
Monitor IdP audit logs continuously

Bonnes habitudes

Adopt Zero Trust principles
Deprovision leaver accounts within hours
Quarterly access reviews
Use PIM/PAM for admin role activation

Authentification email

SPF / DKIM / DMARCRisque moyen

Points faibles

Domain without DMARC easily spoofed
Misconfigured DKIM key length (<2048) is brute-forceable
Subdomain takeover bypasses parent SPF
Loose `p=none` policy provides no protection

Comment les attaques se produisent

Spoofed invoice email from your domain to your CFO
Phishing of customers using lookalike subdomains
BEC fraud via spoofed CEO email

Ce qui vous protège

Publish strict DMARC policy (`p=reject` after monitoring period)
Use 2048-bit DKIM keys; rotate annually
Configure SPF with `~all` then upgrade to `-all`
Subscribe to DMARC reporting service (Postmark, EasyDMARC)

Bonnes habitudes

Add BIMI record once DMARC is enforced (logo in inbox)
Monitor reports monthly for unauthorized senders
Document all legitimate sending services
Audit subdomains for SPF/DMARC inheritance

Technologie FinancièreApps bancaires, POS, portefeuilles crypto, sans contact

Applications bancaires

Mobile banking app (RBC, TD, Desjardins, etc.)Risque élevé

Points faibles

SMS-based 2FA susceptible to SIM swap
Overlay attacks on Android (banking trojans like Anatsa)
Rooted/jailbroken device bypasses app security
Public Wi-Fi MITM if app pins are absent
Saved login on shared family device

Comment les attaques se produisent

Banking trojan overlays login form, captures credentials and intercepts SMS code
SIM swap → password reset → emptied account
Stolen unlocked phone with biometric set to a family member

Ce qui vous protège

Use authenticator app or hardware key over SMS where supported
Set carrier port-out PIN with Bell/Rogers/Telus
Install bank app only from official store
Enable transaction alerts for every debit/credit
Use cellular data, not public Wi-Fi

Bonnes habitudes

Maintain a daily transfer limit appropriate to your needs
Enable biometric login but require PIN for transfers
Review monthly statements line-by-line
Report any unrecognized device under My Devices in app

Online banking web portalRisque élevé

Points faibles

Credential stuffing from breached passwords
Browser auto-fill exposes login on shared computers
Old browser without TLS 1.3
Phishing emails mimic bank notifications

Comment les attaques se produisent

Reused password from breach allows attacker login
Phishing email leads to fake portal that captures credentials + 2FA
Browser session hijack via XSS in third-party banner

Ce qui vous protège

Unique strong password from password manager
Enable all available MFA options (especially hardware keys)
Always type bank URL or use a bookmark — never click email links
Use a dedicated browser profile for banking

Bonnes habitudes

Sign out and close browser after each session
Enable account lockout notifications
Monitor accounts via independent service (Credit Karma, Borrowell in Canada)

Terminaux de paiement & POS

Smart POS terminals (Square, Clover, Moneris)Risque moyen

Points faibles

Default merchant credentials
PIN-pad shimming/skimming attacks
Outdated terminal firmware
Network segmentation gaps allow lateral movement from POS to back office

Comment les attaques se produisent

Card-skimmer overlay captures swipes and PINs
Compromised POS pivots to corporate network (Target 2013 precedent)
Malicious USB peripheral on terminal exfiltrates card data

Ce qui vous protège

Change default credentials immediately
Inspect terminals daily for tampering/skimmers
Keep terminal OS/firmware updated
Segment POS network from corporate network and Wi-Fi

Bonnes habitudes

PCI-DSS compliance baseline
Use P2PE-validated solutions where available
Train staff to recognize tampering
Review terminal logs weekly

Mobile card readers (Square Reader, SumUp)Risque moyen

Points faibles

Bluetooth pairing vulnerabilities
Lost reader paired to attacker phone
Companion app permissions overreach
Counterfeit reader sold via marketplaces

Comment les attaques se produisent

Unpaired Bluetooth reader hijacked by nearby attacker
Stolen paired phone processes fraudulent refunds
Fake reader skims card data before forwarding

Ce qui vous protège

Buy directly from vendor — never marketplaces
Pair only over secure Bluetooth and verify reader serial
Lock companion app with biometrics

Bonnes habitudes

Daily reconciliation of transactions
Disable unused payment methods in companion app
Restrict admin accounts to owner only

Portefeuilles crypto

Hardware wallet (Ledger, Trezor)Risque faible

Points faibles

Seed phrase exposure (photo, cloud, paper theft)
Counterfeit devices from unauthorized resellers
Supply-chain tampering before delivery
Companion app phishing prompts
Ledger Recover service controversy (key shards held by 3 parties)

Comment les attaques se produisent

Stolen seed phrase drains entire wallet
Malicious firmware update via compromised companion app
Address-substitution malware on host PC swaps destination
Coercion attack with $5 wrench to reveal seed

Ce qui vous protège

Buy only from official vendor (ledger.com, trezor.io)
Verify device authenticity on first boot
Always verify destination address on the hardware screen
Never type seed into any device — write on paper/steel and store offline

Bonnes habitudes

Use a passphrase (25th word) for plausible deniability
Distribute seed using SLIP-39 or Shamir Backup
Store backups in geographically separate locations
Decline Ledger Recover if you don't want key shards held by third parties

Hot wallets (MetaMask, Phantom, Trust)Risque élevé

Points faibles

Browser extension supply-chain attacks
Malicious dApp drains via signTypedData phishing
Seed phrase stored on device disk
Clipboard hijacking on host OS

Comment les attaques se produisent

Fake Uniswap site asks for unlimited token approval, drains wallet
Malicious browser extension impersonates MetaMask
Address-replacing clipboard malware
Drainer-as-a-Service kits empty wallet on first signature

Ce qui vous protège

Use hardware wallet to sign all transactions originating from hot wallet
Revoke unused token approvals (revoke.cash) regularly
Install only verified extensions from official store
Use a dedicated browser profile for crypto

Bonnes habitudes

Limit hot wallet to small operating balance only
Maintain a separate cold-storage wallet for the bulk
Verify every signature payload before approving
Bookmark dApp URLs — never use search engines

Centralized exchange accounts (Coinbase, Kraken, Newton, Bitbuy)Risque élevé

Points faibles

Exchange insolvency risk (FTX, Celsius, QuadrigaCX in Canada)
SIM-swap → password reset → withdrawal
Withholding of funds during disputes
KYC data breach exposes identity

Comment les attaques se produisent

Exchange bankruptcy locks all customer funds
SIM swap drains exchange wallet
Phishing of exchange credentials + 2FA
Insider exfiltration of KYC data

Ce qui vous protège

Use Canadian-regulated exchanges (Newton, Bitbuy, Coinsmart) and only keep trading balance
Enable hardware key 2FA
Set withdrawal address allow-listing
Set carrier SIM-swap protection

Bonnes habitudes

Not your keys, not your coins — withdraw to self-custody for long-term holdings
Diversify across exchanges if you must keep funds there
Monitor news for exchange solvency
Save exchange tax records (CRA reporting)

Sans contact & portefeuilles mobiles

Apple Pay / Google WalletRisque faible

Points faibles

Lost device with weak passcode allows transactions
Express Transit mode bypasses biometric (Apple Pay)
Family Sharing exposes payment methods to children
Relay attacks on contactless cards stored in wallet

Comment les attaques se produisent

Stolen iPhone with shoulder-surfed passcode → unlimited Apple Pay spend (well-documented attacks 2023-24)
Child uses Family-shared payment method without limits
NFC relay attack at checkout

Ce qui vous protège

Use 6+ digit passcode (alphanumeric strongly preferred)
Disable Express Transit if you don't need it
Enable Stolen Device Protection (iOS 17.3+)
Set spending limits on Family Sharing

Bonnes habitudes

Enable transaction notifications
Review wallet activity weekly
Add only cards with strong fraud monitoring
Use Find My to remotely wipe if lost

Tap-to-pay credit/debit cardsRisque faible

Points faibles

Skimming via concealed handheld NFC reader (limited per-tap value)
Lost card abused below tap limit ($250 in Canada per tap)
Multiple stolen cards in same wallet
Card details leaked via merchant breach

Comment les attaques se produisent

Pickpocket uses stolen card for sub-limit purchases until reported
NFC skimmer in crowded transit reads card data
Merchant breach leaks PAN for online fraud

Ce qui vous protège

Use RFID-blocking sleeve/wallet for high-risk environments
Enable transaction alerts on each card
Report loss within minutes (most banks have in-app card freeze)
Set lower tap limits if your bank allows

Bonnes habitudes

Use mobile wallet (Apple/Google Pay) instead — tokenized PAN
Review statements weekly
Activate fraud alerts via Equifax/TransUnion in Canada

CommunicationsMessageries, clients email, visioconférence

Messageries chiffrées E2EE

SignalRisque faible

Points faibles

Endpoint compromise (malware on phone) reads decrypted messages
Linked desktop client expands attack surface
Backup files (if enabled) stored locally
Phone number is the identity (privacy concern)

Comment les attaques se produisent

Stalkerware on device captures messages despite E2EE
Linked-device approval phishing
Compromised phone backup exposes message history

Ce qui vous protège

Set Registration Lock PIN to prevent SIM-swap takeover
Enable Screen Lock in Signal app settings
Review and remove unused linked devices monthly
Use Signal usernames (2024+) to hide phone number

Bonnes habitudes

Enable disappearing messages for sensitive chats
Verify safety numbers in person for high-stakes contacts
Disable message previews on lock screen
Use a dedicated number (Google Voice/MySudo) if privacy is critical

Matrix / ElementRisque faible

Points faibles

Default homeservers vary in security posture
Cross-signing setup is complex; users skip verification
Federation metadata leaks
Bridges to non-E2EE networks expose content

Comment les attaques se produisent

Compromised homeserver admin reads room metadata (membership, timing)
Unverified device joins room and reads new messages
Bridge to Discord/Slack leaks messages to non-E2EE channel

Ce qui vous protège

Self-host Synapse/Conduit for sovereignty
Always verify all your own devices and contacts via emoji/QR
Disable bridges in sensitive rooms
Use private rooms with required device verification

Bonnes habitudes

Encrypt every room (default in Element)
Maintain offline backup of recovery key
Review room membership periodically
Prefer matrix.org alternatives if metadata privacy matters

Messageries grand public

WhatsAppRisque moyen

Points faibles

Meta metadata collection (contacts, groups, timing)
Cloud backups (iCloud/Google Drive) historically not E2EE by default
Linked-device sessions persist
SS7/SIM-swap attacks on registration

Comment les attaques se produisent

Cloud backup search by law enforcement (now optional E2EE)
Account takeover via SIM swap and SMS code
Group invite link harvested by adversary

Ce qui vous protège

Enable two-step verification with PIN
Enable end-to-end encrypted backups (settings → chats → backup)
Hide last seen, profile photo, and groups from non-contacts
Avoid public group invite links

Bonnes habitudes

Migrate sensitive conversations to Signal
Review linked devices monthly
Block unknown numbers
Disable message previews

iMessageRisque moyen

Points faibles

SMS fallback to non-iMessage contacts is unencrypted
iCloud Messages sync exposes content if iCloud account compromised
NSO Pegasus zero-click exploits historically targeted iMessage
Family Sharing surfaces conversations partially

Comment les attaques se produisent

iCloud breach exposes archived messages
Pegasus-style zero-click exploit installs spyware
Stolen unlocked device reads all conversations

Ce qui vous protège

Enable Advanced Data Protection (iOS 16.2+) for E2EE iCloud
Enable Lockdown Mode if you're a high-risk target
Strong unique iCloud password + hardware-key 2FA
Disable iCloud Messages if you don't need cross-device sync

Bonnes habitudes

Keep iOS updated within 24h of releases
Verify Contact Key Verification (iOS 17.2+) for sensitive contacts
Use Signal for highest-stakes conversations
Hide message previews on lock screen

Clients email

Outlook / Apple Mail / ThunderbirdRisque moyen

Points faibles

Auto-load remote images leaks open notifications + IP
Attachment auto-preview can trigger exploits
OAuth tokens cached locally
Add-ins/plugins have broad mailbox access

Comment les attaques se produisent

Tracking pixels confirm email opened and approximate location
Malicious attachment exploits Office vulnerability
Compromised add-in exfiltrates entire mailbox

Ce qui vous protège

Disable remote image auto-load
Disable preview pane for unknown senders
Audit and remove unused add-ins/plugins
Enable encryption (S/MIME or PGP) for sensitive correspondence

Bonnes habitudes

Use a dedicated email client profile per account
Run email client with reduced privileges where possible
Subscribe to vendor security advisories

Web mail (Gmail, Outlook.com, ProtonMail)Risque moyen

Points faibles

Browser session hijack via XSS or malicious extension
OAuth-connected third-party apps have persistent access
Auto-forward rules abused by attackers
Saved password in browser

Comment les attaques se produisent

Malicious extension reads inbox content
Attacker creates auto-forward rule after compromise to maintain access invisibly
OAuth grant phishing for full mailbox scopes

Ce qui vous protège

Use hardware key 2FA on email account (THE most important account to protect)
Quarterly review of OAuth-connected apps
Quarterly review of forwarding rules and filters
Use a dedicated browser profile for email

Bonnes habitudes

For maximum privacy: ProtonMail or Tutanota with E2EE
Enable login alerts
Review account activity / IP history monthly
Set up account recovery carefully (it's the bypass for everything else)

Visioconférence

Zoom / Teams / Google MeetRisque moyen

Points faibles

Meeting links shared publicly enable Zoom-bombing
Recording stored in cloud with default permissions
Background image leaks
Plugin/integration access to entire account

Comment les attaques se produisent

Public meeting link shared → harassment and disruption
Recorded confidential meeting accidentally publicly accessible
Compromised user account joins all upcoming meetings

Ce qui vous protège

Require meeting passcode + waiting room
Restrict screen sharing to host
Review recording storage permissions
Use SSO + MFA for corporate accounts

Bonnes habitudes

Lock meetings once all expected attendees join
Disable cloud recording for sensitive meetings (use local with encryption)
Audit installed apps/integrations in admin console
Enable end-to-end encryption where supported (Zoom E2EE)

DivertissementTV connectées, jeux, VR/AR, audio

TV connectée & streaming

Smart TV (Samsung Tizen, LG webOS, Android TV)Risque moyen

Points faibles

Always-on microphone for voice control
ACR (Automatic Content Recognition) tracks every frame watched
Pre-installed apps with broad permissions
Vendor stops firmware updates after 2-3 years
Default credentials on developer/debug interfaces

Comment les attaques se produisent

ACR data sold to advertisers (well-documented for Vizio, Samsung)
Compromised app on TV pivots to home network
Voice data leaked from compromised vendor cloud
TV botnet enrollment after EOL

Ce qui vous protège

Disable ACR / Smart Interactivity in settings (Samsung: 'Viewing Information Services')
Disable always-on microphone if not used
Place TV on isolated IoT VLAN
Use external streaming device (Apple TV) instead of built-in apps

Bonnes habitudes

Review and uninstall pre-installed apps
Decline marketing/personalization opt-ins on first setup
Replace TV when vendor stops security updates
Disable Wi-Fi entirely if TV is used only via HDMI

Streaming sticks (Roku, Fire TV, Chromecast, Apple TV)Risque faible

Points faibles

Companion app permissions overreach
Cast/AirPlay open to local network without auth
Account compromise enables fraudulent rentals
Side-loaded apps on Fire TV

Comment les attaques se produisent

Cast bombing: any guest on Wi-Fi sends content to TV
Compromised account purchases fraudulent rentals
Malicious sideloaded APK on Fire TV

Ce qui vous protège

Require PIN for purchases
Disable Cast / AirPlay when not in use, or restrict to trusted devices
Avoid sideloading on Fire TV
Place on guest VLAN

Bonnes habitudes

Strong password + 2FA on associated account
Audit subscriptions monthly
Sign out from accounts on shared/rental devices
Update device firmware regularly

Jeux vidéo

Gaming consoles (PS5, Xbox, Switch)Risque moyen

Points faibles

Account credentials reused from other breaches
Voice chat captures background audio
Fraudulent gift card / V-Buck phishing
Saved payment methods accessible by family members
Stalking via Friends list / online status

Comment les attaques se produisent

Account takeover drains stored payment method on game purchases
Voice phishing in voice chat targets minors
Doxxing via leaked Gamertag → real identity
Fortnite-style phishing for in-game currency

Ce qui vous protège

Enable 2FA on PSN / Xbox Live / Nintendo account
Require password for all purchases
Set up child accounts with parental controls and spending limits
Restrict friend requests and online visibility

Bonnes habitudes

Use a dedicated gaming-only email
Educate kids on chat phishing
Review Friends and blocked lists periodically
Update console system software

PC gaming (Steam, Epic, mods)Risque moyen

Points faibles

Game mods can contain malware
Steam phishing via fake trade offers
Saved Steam credentials in steam_login_users token
Game launchers run with broad privileges

Comment les attaques se produisent

Steam Stealer malware exfiltrates session token, hijacks account
Malicious mod on Nexus/Workshop installs RAT
Phishing trade offer drains inventory of valuable skins

Ce qui vous protège

Enable Steam Guard Mobile Authenticator (NOT email)
Download mods only from official Workshop / vetted sources
Run games as standard (non-admin) user
Use a dedicated browser for gaming community sites

Bonnes habitudes

Periodically clear Steam login sessions
Don't accept random Discord/Steam friend requests
Use Family Sharing carefully
Keep antivirus active even when gaming

Casques VR/AR

Meta Quest / Apple Vision Pro / PicoRisque moyen

Points faibles

Eye-tracking and biometric data sent to vendor
Room-scan / spatial mapping reveals home interior
Always-on cameras for passthrough
Account tied to broader vendor ecosystem (Meta/Apple)
Children's biometric data collection concerns

Comment les attaques se produisent

Meta account compromise → eye-tracking + spatial data exposed
Inappropriate content access by minors via shared headset
Spatial map of home leaked from vendor breach

Ce qui vous protège

Review and minimize data sharing in headset settings
Use guest mode for visitors
Set up parental controls / age-appropriate accounts
Cover passthrough cameras when not in use

Bonnes habitudes

Decline biometric/research opt-ins
Limit room-scan to necessary areas only
Update headset firmware regularly
For Meta Quest, use a dedicated Meta account separate from Facebook

Appareils audio

Bluetooth headphones / earbuds (AirPods, Sony, Bose)Risque faible

Points faibles

Bluetooth always-on broadcasts MAC for tracking
BLE pairing vulnerabilities (KNOB, BIAS attacks)
Find My / vendor cloud account exposes location history
Companion app permissions

Comment les attaques se produisent

Bluetooth tracking via persistent MAC across stores/cities
Eavesdropping via BIAS attack on vulnerable firmware
Vendor account breach exposes paired device locations

Ce qui vous protège

Update firmware via companion app regularly
Disable 'always discoverable' modes
Strong password + 2FA on vendor account
Disable Bluetooth when not in use

Bonnes habitudes

Use random/private MAC where supported
Review vendor app permissions
Erase devices before resale
For AirPods, enable Find My's Lost Mode if misplaced

Smart speakers (Echo, Google Nest, HomePod)Risque élevé

Points faibles

Always-listening microphone
Voice purchases without confirmation
Drop-In / intercom features can be abused
Voice match weak — children or guests trigger purchases
Vendor cloud stores voice recordings

Comment les attaques se produisent

Accidental purchase via overheard advertising
Drop-In abused by family/ex-partners for surveillance
Voice recording leak from vendor breach
Compromised account streams audio surreptitiously

Ce qui vous protège

Require voice PIN for purchases
Disable Drop-In / restrict to specific contacts
Mute mic physically when not in use
Set voice recording auto-delete (3 months)

Bonnes habitudes

Review voice history monthly
Disable third-party skills you don't use
Place on isolated IoT VLAN
Strong password + 2FA on Amazon/Google/Apple account

Santé & Bien-êtreWearables, dispositifs médicaux, apps santé, télésanté

Wearables & bagues connectées

Fitness trackers (Fitbit, Garmin, Whoop)Risque moyen

Points faibles

Continuous health data (HR, sleep, location, menstrual) in vendor cloud
Account compromise reveals daily routines
Strava-style heatmaps revealed military bases historically
Vendor acquisition (Google bought Fitbit) changes privacy terms
BLE tracking via persistent identifier

Comment les attaques se produisent

Stalker uses leaked location/route data to predict whereabouts
Insurance discrimination based on inferred health metrics
Compromised vendor cloud leaks reproductive health data
Heatmap publicly exposes home address

Ce qui vous protège

Disable public sharing of activity/location
Set workout privacy to 'private' by default
Review and minimize data shared with third-party apps
Strong password + 2FA on vendor account

Bonnes habitudes

Read vendor privacy policy before purchase
Audit connected third-party apps quarterly
Export and delete data when leaving the platform
Avoid posting workout maps starting/ending at home

Smart rings (Oura, Galaxy Ring, Ultrahuman)Risque moyen

Points faibles

Highly sensitive biometric data (fertility, sleep stages, body temp)
Subscription model means data captive to platform
BLE pairing vulnerabilities
Vendor business model may pivot to data monetization

Comment les attaques se produisent

Reproductive health data subpoenaed (post-Roe US precedent — relevant for cross-border travel from Canada)
Vendor cloud breach exposes detailed biometric profiles
Insurer purchases aggregated health data

Ce qui vous protège

Use a privacy-respecting account (separate email, no real name where possible)
Disable cloud sync if local-only mode is supported
Decline research / data-donation opt-ins
Strong password + 2FA

Bonnes habitudes

Choose vendors with clear privacy commitments (Oura has stronger track record)
Periodically export and delete historical data
Be aware of vendor jurisdiction (US vs EU vs Canadian data residency)

Dispositifs médicaux

Continuous Glucose Monitor (CGM — Dexcom, Libre)Risque élevé

Points faibles

BLE communication historically unencrypted on some models
Cloud-shared data with caregivers
Companion app permissions
Smartphone OS vulnerabilities affect data integrity

Comment les attaques se produisent

BLE eavesdropping intercepts glucose readings
Compromised companion app sends false alarms
Caregiver portal account takeover exposes patient data
Disruption attack on insulin pump pairing (life-safety risk)

Ce qui vous protège

Update CGM firmware via official app immediately
Strong password + 2FA on Dexcom/Libre account
Restrict caregiver sharing to verified contacts
Use a dedicated phone if possible

Bonnes habitudes

Backup CGM data export monthly
Be aware Diabetes Canada / Health Canada device advisories
Disable Bluetooth when CGM is removed
For pumps, follow vendor cybersecurity guidance strictly

CPAP / Smart medical wearablesRisque moyen

Points faibles

Cloud-uploaded sleep / breathing data
Insurance compliance reporting reveals usage patterns
Mobile app account often weak password reset flow
Device firmware rarely updated by patients

Comment les attaques se produisent

Insurance denies coverage based on usage data
Vendor cloud breach exposes detailed sleep patterns
Health employer wellness program access

Ce qui vous protège

Strong password + 2FA
Understand insurance data-sharing requirements before consenting
Update firmware when prompted
Review what data is shared with employer/insurer wellness programs

Bonnes habitudes

Request data export and audit access logs annually
Use device offline if cloud features aren't medically required
Document any unusual device behavior

Applications santé

Period / fertility trackers (Flo, Clue, Natural Cycles)Risque élevé

Points faibles

Reproductive health data is legally sensitive (cross-border concerns)
Free apps monetize data via ads/analytics
Account-less / pseudonymous modes may still leak via SDK telemetry
Data sales to brokers

Comment les attaques se produisent

Reproductive health data subpoenaed in legal proceedings (cross-border US travel risk)
Data broker resale reveals pregnancy to advertisers
Compromised account exposes intimate health timeline

Ce qui vous protège

Choose privacy-first apps (Euki, Drip — local-only, no cloud)
Use anonymous mode if available
Avoid logging in with social accounts (Facebook/Google)
Review data-sharing settings strictly

Bonnes habitudes

Read privacy policy and data location specifically
Avoid US-hosted apps if cross-border privacy is a concern
Periodically delete historical data
Consider paper tracking for highest sensitivity

Télésanté

Telehealth platforms (Maple, Telus Health, Dialogue)Risque moyen

Points faibles

Video session quality varies in encryption
Health record stored in vendor cloud
Provincial privacy law applies (PHIPA in Ontario, etc.)
Account credentials reused from breaches
Family-shared accounts blur record ownership

Comment les attaques se produisent

Account takeover exposes full medical history
Insecure home Wi-Fi exposes telehealth video
Vendor breach exposes diagnoses (e.g., 23andMe-style)
Phishing posing as Telus Health appointment reminder

Ce qui vous protège

Strong unique password + 2FA
Use VPN on public Wi-Fi for any telehealth session
Verify telehealth URLs carefully — never click email links
Use private room and headphones for confidentiality

Bonnes habitudes

Confirm vendor stores data in Canada (PIPEDA / provincial residency)
Request data export rights before signing up
Separate accounts per family member (no sharing)
Review account activity logs

TransportVoitures connectées, bornes EV, apps mobilité

Voitures connectées

Connected vehicle (Tesla, Ford, GM, BMW)Risque élevé

Points faibles

Telematics collect location, driving behavior, in-cabin audio
Companion app account compromise enables remote unlock/start
CAN bus attacks via OBD-II port
Wireless key fob relay attacks
Insurance/manufacturer data sharing without clear consent
End-of-life vehicles still report to vendor

Comment les attaques se produisent

Tesla account takeover unlocks and drives away vehicle (multiple documented incidents)
Key fob relay attack enables theft from driveway
Insurance company purchases driving data and raises premiums
Used car still linked to previous owner's account leaks personal data

Ce qui vous protège

Strong password + 2FA on manufacturer account (Tesla, FordPass, etc.)
Use Faraday pouch for key fobs at home
Disable PIN-to-Drive bypass features
Wipe vehicle infotainment + remove account linkage when selling
Review and decline telematics data sharing where allowed

Bonnes habitudes

Cover OBD-II port with locking cap
Be aware of insurance data programs (Drivewise, Snapshot) before opting in
Update vehicle software promptly
Use guest mode for valets and rentals

In-car infotainment & Wi-Fi hotspotRisque moyen

Points faibles

Connected phone exposes contacts, messages, call history (stored in unit)
Public Wi-Fi hotspot exposes occupants
Apps installed in infotainment lack security review
Bluetooth pairing remembered indefinitely

Comment les attaques se produisent

Used/rental car still has previous user's phone data accessible
Compromised infotainment app pivots to vehicle CAN bus
Public hotspot user MITM'd on long road trips

Ce qui vous protège

Always factory-reset infotainment when selling/returning
Decline contacts/messages sync if not needed
Use VPN on in-car hotspot
Remove Bluetooth pairings after use

Bonnes habitudes

Don't pair work phone with rental cars
Disable hotspot when not in use
Audit installed apps periodically
Use guest profile if available

Recharge EV

Public EV chargers (Electrify Canada, FLO, ChargePoint, Tesla Supercharger)Risque moyen

Points faibles

RFID card data captured by skimmers
Charger app account stores payment method
Compromised charger could (in theory) push malicious firmware to vehicle
Plug-and-Charge (ISO 15118) certificate management complexity
Location tracking via charging history

Comment les attaques se produisent

Skimmer on RFID reader captures card credentials
App account takeover drains stored payment method
Driving pattern inference from charging history sold to advertisers

Ce qui vous protège

Use app-based charging over RFID where possible
Strong password + 2FA on charging account
Inspect chargers for tampering
Review charging history privacy settings

Bonnes habitudes

Limit stored payment to a low-limit credit card
Decline marketing opt-ins
Avoid public chargers for sensitive trips (clinics, etc.)
Update vehicle and charger app firmware

Home EV charger (Wallbox, ChargePoint Home, Tesla Wall Connector)Risque moyen

Points faibles

Default credentials on web interface
Wi-Fi connectivity to vendor cloud
Firmware rarely updated by homeowner
Outdoor unit physically accessible

Comment les attaques se produisent

Default-credential exploit takes over charger
Compromised charger enrolled in botnet
Neighbor exploits weak Wi-Fi to use your charger
Vendor cloud breach exposes home charging schedule

Ce qui vous protège

Change default credentials immediately
Place charger on isolated IoT VLAN
Enable auto-updates
Strong WPA3 on charging Wi-Fi network
Lock physical access where possible

Bonnes habitudes

Review installer's default settings before they leave
Subscribe to vendor security advisories
Audit allowed user list quarterly
Disable cloud features if you don't use them

Apps de mobilité

Ride-share apps (Uber, Lyft)Risque moyen

Points faibles

Stored payment method in account
Trip history reveals home/work address
Account takeover enables fraudulent rides
Driver-side app collects passenger data
Phone number visible to drivers (some regions)

Comment les attaques se produisent

Account takeover books rides to attacker's destination charged to victim
Trip history leaked from breach reveals patterns
Stalker driver uses pickup location to locate victim later

Ce qui vous protège

Strong password + 2FA
Use anonymized phone number features (Uber masks both directions)
Set pickup/drop-off slightly off your exact address for sensitive trips
Review trip history privacy settings

Bonnes habitudes

Limit stored payment methods
Use one-time payment cards for rides
Review and remove old payment methods
Report and block any uncomfortable driver interactions

E-scooter / bike-share apps (Lime, Bird, Bixi, Communauto)Risque faible

Points faibles

Account compromise rides at victim's expense
Location tracking of all rides
Identity verification documents stored in vendor cloud
Wallet/credit charges if vehicle 'damaged' fraudulently

Comment les attaques se produisent

Account takeover unlocks scooters and racks up rides
ID document leak from vendor breach (multiple e-scooter vendors breached historically)
Fraudulent damage charge after legitimate use

Ce qui vous protège

Strong password + 2FA
Photograph scooter/bike condition before and after each ride
Monitor for unauthorized charges
Limit stored payment to low-limit card

Bonnes habitudes

Verify vendor data residency
Delete account after extended non-use
Check ride history for anomalies
Use Communauto / Bixi (Canadian) where data residency matters

Cloud & StockageDrives cloud, stockage auto-hébergé, sauvegarde

Cloud grand public

iCloudRisque moyen

Points faibles

By default not E2EE for many data types — Apple holds keys
Family Sharing exposes purchase history and location
Account compromise = full Apple ecosystem breach
Recovery via SMS or email
Photo Stream may sync sensitive content

Comment les attaques se produisent

iCloud account compromise via password reuse leaks photos, contacts, location
Celebrity photo leaks (2014 Fappening) via credential stuffing + recovery flow
Family member accidentally exposed to private content via shared library

Ce qui vous protège

Enable Advanced Data Protection (iOS 16.2+) for E2EE on most data
Strong unique password + hardware key 2FA
Set up trusted recovery contact (not via email/SMS)
Audit Family Sharing permissions

Bonnes habitudes

Review devices signed into iCloud quarterly
Enable Stolen Device Protection (iOS 17.3+)
Disable Photo Stream for sensitive folders
Use Hide My Email for new sign-ups

Google Drive / OneDrive / DropboxRisque moyen

Points faibles

Vendor holds encryption keys (server-side encryption)
Shared link permissions overly permissive (anyone-with-link)
Third-party OAuth apps have persistent access
Sync clients store credentials locally
Old shared files retain access for departed colleagues/partners

Comment les attaques se produisent

Public 'anyone-with-link' file indexed by search engines
OAuth-connected app exfiltrates entire drive
Departed employee retains access via shared folder
Sync client compromise on endpoint exposes all files

Ce qui vous protège

Strong password + 2FA (hardware key for primary account)
Use 'specific people' sharing — never anyone-with-link for sensitive files
Quarterly review of OAuth-connected apps and shared folders
Encrypt sensitive files locally before upload (Cryptomator, age)

Bonnes habitudes

Use a vault tool (Cryptomator) for client-side encryption
Set link expiration where supported
Enable file activity audit logs
Audit external shares quarterly

Stockage auto-hébergé

NextcloudRisque moyen

Points faibles

Default install lacks hardening (HTTPS, fail2ban, headers)
Apps from third-party store unvetted
Outdated PHP / web server
Public sharing links default to long-lived
Server compromise exposes all data

Comment les attaques se produisent

Brute-force on exposed login (no fail2ban)
Compromised app from store steals data
Outdated PHP CVE exploited via web
Server takeover via misconfigured file permissions

Ce qui vous protège

Use HTTPS with strong TLS config (Let's Encrypt)
Enable 2FA for all users
Install fail2ban + reverse proxy with rate limiting
Audit installed apps; remove unused

Bonnes habitudes

Apply security advisories within 24h
Enable server-side encryption
Regular off-site encrypted backups
Document recovery procedures

Synology / QNAP NAS as cloudRisque élevé

Points faibles

DSM/QTS exposed to internet historically heavily targeted by ransomware
Default admin account enabled
DDNS reveals IP location
Quick Connect routes traffic through vendor cloud

Comment les attaques se produisent

DeadBolt, Qlocker ransomware encrypted thousands of NAS units
Brute-force on internet-exposed admin
Vendor cloud breach exposes data behind Quick Connect

Ce qui vous protège

Disable admin account; use named admin with strong password
Enable 2FA
Never expose DSM/QTS port directly to internet — use VPN (Tailscale, WireGuard)
Enable auto-update and apply security advisories same-day

Bonnes habitudes

Immutable / snapshot backups for ransomware recovery
Disable Quick Connect if you don't need it
IP block-listing after failed login
Test restore from backup quarterly

Services de sauvegarde

Backblaze / Arq / DuplicatiRisque faible

Points faibles

Encryption key recovery model varies (some vendors hold keys)
Backup endpoint compromise affects all data
Cost surprises if storage class misconfigured
Restore time can be slow

Comment les attaques se produisent

Vendor account compromise initiates malicious restore
Ransomware deletes both source and backup if backup is online + writable from source
Encryption-key loss = unrecoverable data

Ce qui vous protège

Use private encryption key (Backblaze B2, Arq with passphrase)
Backup to immutable / object-lock storage
Strong password + 2FA on backup account
Test restores quarterly

Bonnes habitudes

Follow 3-2-1 rule: 3 copies, 2 media, 1 off-site
Document encryption key recovery in safe location
Monitor backup completion alerts
Periodic restore drills

IA & ProductivitéChatbots IA, extensions, prise de notes, suites bureautiques

Chatbots & assistants IA

ChatGPT (OpenAI)Risque élevé

Points faibles

Conversations used for training by default (consumer plans)
Memory feature persists data across sessions
Plugins / GPTs grant broad data access
Account compromise exposes conversation history
Sensitive data (PII, code, secrets) routinely pasted in prompts
Custom GPTs may exfiltrate user input

Comment les attaques se produisent

Employee pastes proprietary source code → data leaves organization
Compromised account reveals strategic conversations
Malicious custom GPT exfiltrates user-supplied data via tool calls
Memory feature retains sensitive personal data indefinitely

Ce qui vous protège

Disable training on your data (Settings → Data Controls)
Use ChatGPT Team/Enterprise for work — never consumer for company data
Disable Memory for sensitive accounts
Strong password + 2FA
Treat every prompt as if it could become public

Bonnes habitudes

Establish a personal data-classification rule before pasting
Use API access (no training by default) for sensitive workflows
Quarterly audit of installed GPTs and connected apps
Avoid plug-ins that demand broad scopes

Claude (Anthropic)Risque moyen

Points faibles

File uploads stored on Anthropic infrastructure
Projects feature persists context
API key exposure via desktop apps
Account credential reuse

Comment les attaques se produisent

Sensitive document uploaded to Claude leaks via account compromise
API key leaked in shared screenshot or git commit
Data residency concerns for non-US users

Ce qui vous protège

Strong password + 2FA
Anthropic does not train on consumer chat by default — verify settings
Use API for programmatic access; rotate keys regularly
Be aware data is processed in the US

Bonnes habitudes

Delete sensitive conversations after use
Use Workspaces for organization-level controls
Avoid uploading regulated data (PHIPA, PIPEDA-sensitive) without proper agreements

Microsoft Copilot (M365)Risque moyen

Points faibles

Inherits permissions of user — over-permissioned users now over-permissioned with AI
Surfaces sensitive data from forgotten SharePoint sites
Prompt injection via document content
Audit logs may not capture all interactions

Comment les attaques se produisent

Copilot surfaces HR / salary data the user technically had access to but never opened
Indirect prompt injection in malicious document hijacks Copilot output
Departing employee uses Copilot to mass-summarize sensitive data

Ce qui vous protège

Audit and tighten SharePoint/OneDrive permissions BEFORE rollout (Microsoft Purview)
Enable sensitivity labels and DLP policies
Restrict Copilot rollout by group during initial deployment
Train users on prompt injection awareness

Bonnes habitudes

Enable Microsoft Purview audit logs for Copilot
Establish DLP policies for AI interactions
Quarterly access reviews on shared sites
Have a Copilot acceptable use policy

Extensions navigateur

General browser extensions (Chrome/Firefox/Edge)Risque élevé

Points faibles

Extensions with broad permissions (read/change all data on all sites)
Sold/abandoned extensions push malicious updates
Sideloaded extensions bypass store review
Extension manifest v2 → v3 transition leaves abandoned tools
Companion server reads aggregated user data

Comment les attaques se produisent

Popular extension sold to malicious actor pushes update with credential stealer (multiple documented cases — The Great Suspender)
Extension exfiltrates browsing history to ad broker
Malicious extension reads password manager autofill data
Extension reads internal corporate dashboards

Ce qui vous protège

Audit installed extensions; remove anything unused
Review permissions before install — broad permissions are red flag
Pin extensions and review updates
Use a separate browser profile for sensitive work
Prefer extensions from reputable publishers with active maintenance

Bonnes habitudes

Quarterly extension audit
Disable extension auto-update for high-trust extensions and review updates manually
Use enterprise policy to allow-list extensions in work browsers
Avoid 'convenience' extensions (PDF, screenshot, coupon) that demand broad access

Apps de notes & savoir

Notion / Obsidian / EvernoteRisque moyen

Points faibles

Notion/Evernote: vendor holds keys; cloud sync exposes all notes if account compromised
Obsidian Sync end-to-end encrypted but third-party sync (Dropbox) is not
Public sharing links indexed by search engines
API keys, passwords, secrets often pasted into notes
Workspace member access creep

Comment les attaques se produisent

Compromised Notion account exposes years of personal/professional knowledge base
Obsidian vault synced via Dropbox without encryption is exposed in Dropbox breach
Public Notion page indexed by Google reveals internal docs
Departing employee retains workspace access

Ce qui vous protège

Strong password + 2FA on note app account
For Obsidian: use Obsidian Sync (E2EE) or wrap third-party sync in Cryptomator
Audit shared/public pages periodically
Never paste passwords or API keys into notes — use a password manager
Quarterly workspace member review

Bonnes habitudes

Use a separate vault for sensitive notes
Enable account activity logs
Document workspace ownership transition procedures
Consider local-first apps (Obsidian, Logseq) for highest privacy

Suites bureautiques

Microsoft 365 / Google WorkspaceRisque moyen

Points faibles

Document sharing scopes overly permissive
Macros/scripts in Office documents
OAuth third-party apps with broad scopes
Conditional access misconfigured
Forgotten anonymous links remain valid

Comment les attaques se produisent

Malicious Excel macro installs malware (still common attack vector)
Anyone-with-link document indexed by search engine
OAuth phishing grants attacker persistent mailbox access
Departed contractor retains access via shared drive

Ce qui vous protège

Disable macros from internet sources (Office default since 2022 but verify)
Use 'specific people' sharing — disable anyone-with-link for sensitive content
Quarterly OAuth-app audit (admin console)
Conditional access: device compliance + MFA

Bonnes habitudes

Enable activity audit logs
Use sensitivity labels and DLP
Periodic external-share review
Train users on phishing recognition

Navigation & Vie privéeNavigateurs, VPN, DNS, outils de vie privée

Navigateurs

Chrome / EdgeRisque moyen

Points faibles

Heavy telemetry to Google/Microsoft
Sign-in syncs history, passwords, autofill across all devices
Extension supply-chain risk
Third-party cookies still partially supported
Frequent zero-days (V8 engine targeted)

Comment les attaques se produisent

Compromised Google/MS account exposes browsing history and saved passwords
Malicious extension reads all site data
Zero-day in V8 used in drive-by attack
Cross-device sync leaks work data to personal device

Ce qui vous protège

Update browser within 24h of releases (zero-days are common)
Use separate browser profiles for work / personal / banking
Disable third-party cookies
Audit extensions monthly
Strong password + hardware key on Google/MS account

Bonnes habitudes

Disable telemetry where possible (chrome://settings/privacy)
Avoid signing into the browser if you don't need sync
Use Enhanced Safe Browsing
Review sync data scope carefully

FirefoxRisque faible

Points faibles

Default config still sends some telemetry
Third-party extensions can still be malicious
Sync requires Mozilla account
Older versions on EOL Linux distros

Comment les attaques se produisent

Compromised Mozilla account exposes synced data
Malicious extension via AMO (rare but happened)
Outdated Firefox vulnerable to known CVEs

Ce qui vous protège

Enable Strict tracking protection
Use Firefox Containers to isolate sites (Facebook, Google, banking)
Disable telemetry in privacy.* about:config
Strong password + 2FA on Mozilla account

Bonnes habitudes

Use ESR for stability on managed devices
Enable HTTPS-Only mode
Review extension permissions
Subscribe to Mozilla security advisories

BraveRisque faible

Points faibles

Built-in crypto wallet broad attack surface
Brave Rewards / BAT introduces tracking trade-offs
Tor mode is convenience-only, not full Tor
Chromium upstream zero-days

Comment les attaques se produisent

Brave wallet phishing drains crypto
Chromium zero-day affects Brave too
Misuse of Tor mode believing it offers full anonymity

Ce qui vous protège

Disable Brave Wallet if you don't use it
Disable Brave Rewards for maximum privacy
Use real Tor Browser for actual anonymity needs
Update promptly when Chromium patches release

Bonnes habitudes

Enable Shields aggressive mode
Use separate profiles for sensitive activity
Don't treat Tor mode as Tor Browser

Tor BrowserRisque faible

Points faibles

Exit-node operators can see unencrypted traffic
JS enabled by default on Standard mode introduces fingerprinting
Slow speed encourages users to drop back to Chrome for 'quick' lookups (mixing identities)
Visiting Tor itself is suspicious in some jurisdictions

Comment les attaques se produisent

Malicious exit node injects content into HTTP
De-anonymization via JS-based fingerprinting
User browses logged-in account on Tor → links Tor identity to real identity

Ce qui vous protège

Use Safest security level for anonymity-critical browsing
Never log into real-name accounts on Tor
Use HTTPS sites only
Use bridges if Tor itself is blocked/suspicious

Bonnes habitudes

Combine with VPN for ISP-visibility concerns (VPN-over-Tor or Tor-over-VPN, understand trade-offs)
Don't resize browser window (fingerprinting)
Use Tails OS for highest-stakes work

Clients VPN

Commercial VPN (Mullvad, ProtonVPN, IVPN, NordVPN)Risque faible

Points faibles

Provider can see all traffic — choose carefully
Free VPNs monetize user data
DNS leaks bypass tunnel
WebRTC leaks real IP
Account-based VPNs link identity to traffic

Comment les attaques se produisent

Free VPN sells browsing data to brokers
DNS leak reveals queries despite VPN
Compromised VPN provider hands logs to law enforcement
Phishing site mimics VPN client install

Ce qui vous protège

Choose audited no-log providers (Mullvad, IVPN — anonymous accounts; Proton — Swiss)
Enable kill switch and DNS leak protection
Block WebRTC in browser settings
Avoid free VPNs entirely

Bonnes habitudes

Pay anonymously where possible (Mullvad accepts cash)
Verify provider has been audited and stood up to subpoenas
Use VPN at router level for whole-home coverage
Test for leaks (ipleak.net) regularly

Self-hosted VPN (WireGuard, Tailscale, Headscale)Risque faible

Points faibles

Server compromise exposes all peers
Misconfigured WireGuard peers route traffic incorrectly
Tailscale uses Microsoft/Google/Apple OAuth as identity
Coordination server (Tailscale) sees metadata

Comment les attaques se produisent

Compromised home server pivots to all VPN peers
Tailscale OAuth account compromise gives mesh access
WireGuard config file leaked allows attacker to join network

Ce qui vous protège

Strong server hardening (fail2ban, automatic security updates)
Use Headscale for sovereignty over coordination
Strong password + hardware key on identity provider
ACLs in Tailscale to limit lateral movement

Bonnes habitudes

Audit connected nodes monthly
Rotate WireGuard keys when devices are decommissioned
Use ephemeral keys for guests
Subscribe to upstream security advisories

Résolveurs DNS

NextDNS / Cloudflare 1.1.1.1 / Quad9Risque faible

Points faibles

Resolver sees all DNS queries (browsing intent)
Default ISP DNS even worse — sells data
Provider jurisdiction matters
Encrypted DNS (DoH/DoT) not always enforced

Comment les attaques se produisent

ISP DNS used as advertising data source
Resolver compromise enables mass redirection
Plaintext DNS queries leak browsing despite VPN

Ce qui vous protège

Use NextDNS with custom profile for blocking + privacy
Enable DoH/DoT system-wide (router or device level)
Choose Quad9 (Swiss, no logs) for privacy or Cloudflare for speed
Avoid ISP defaults

Bonnes habitudes

Configure DNS at router level for whole-home
Test with dnsleaktest.com
Use NextDNS for malware/ad/tracker blocking + family filtering
Review NextDNS query logs (or disable logging)

Extensions vie privée

uBlock Origin / Privacy BadgerRisque faible

Points faibles

Manifest v3 transition (Chrome) hampers uBlock Origin filtering
Misconfigured filter lists can break sites
Some content publishers detect blockers and lock content

Comment les attaques se produisent

Manifest v3 reduces extension capability — users get worse blocking on Chrome
Malicious lookalike (uBlock vs uBlock Origin) installs adware

Ce qui vous protège

Use uBlock Origin (by gorhill — verify publisher) — NOT 'uBlock'
On Chrome, monitor v3 transition; consider Firefox for full blocking
Keep filter lists updated

Bonnes habitudes

Combine with NextDNS for redundant blocking
Avoid duplicating blockers (causes site breakage)
Whitelist sites you trust and want to support

Enfants & ÉducationTablettes enfants, EdTech, contrôles parentaux, appareils scolaires

Appareils enfants

Kids tablets (Amazon Fire Kids, iPad with Family Sharing)Risque moyen

Points faibles

Pre-installed apps with broad data collection
COPPA / Bill C-27 (Canada) compliance varies by app
In-app purchase exposure
Social features expose minors to strangers
Camera/mic always available

Comment les attaques se produisent

Child accidentally racks up in-app purchases
Predator contacts child via in-game chat
App over-collects data on minor (multiple FTC settlements)
Compromised parental account enables purchases

Ce qui vous protège

Use Amazon FreeTime / Apple Screen Time strict mode
Disable in-app purchases or require parent approval
Disable social/chat features in apps
Strong password + 2FA on parent account

Bonnes habitudes

Allow-list approved apps only
Daily/weekly screen time limits
Cover camera when not in use
Review activity reports weekly

Plateformes EdTech

School platforms (Google Classroom, Microsoft Teams for EDU, Seesaw)Risque moyen

Points faibles

School-managed account often weak password reset
Account credentials persist after graduation
Activity/grade data sold or shared with third parties (varies by district)
Phishing via official school domains

Comment les attaques se produisent

School account compromise reveals all assignments and communications
Phishing of parent via spoofed school email
Outdated student account abused after graduation
Data broker scrapes 'public' student work

Ce qui vous protège

Enforce strong password + 2FA where school allows
Verify school district's privacy policy and data residency (Canadian provinces vary)
Decommission accounts after graduation
Use a dedicated email for school communication

Bonnes habitudes

Train children on phishing recognition
Review what apps the school requires
Advocate for FERPA/PIPEDA-compliant tools
Audit account activity periodically

Contrôles parentaux

Parental control software (Qustodio, Bark, Apple Screen Time, Family Link)Risque moyen

Points faibles

Software has deep device access — vendor breach exposes child's activity
False sense of security (kids find workarounds)
VPN bypass on tablets
Adversarial co-parent abuse of monitoring tools

Comment les attaques se produisent

Vendor breach exposes detailed child surveillance data
Child uses second device to bypass controls
Co-parent uses parental control to monitor ex-partner
Software updates introduce new tracking

Ce qui vous protège

Use platform-native controls (Apple Screen Time, Family Link) over third-party where possible
Strong password + 2FA on parent control account
Discuss monitoring openly with children (age-appropriate)
Audit data the vendor collects

Bonnes habitudes

Adapt controls to child's age — over-monitoring backfires
Pair with conversations about online safety
Read vendor's data retention policy
Migrate to lighter controls as kids mature

TélétravailVPN entreprise, MDM, collaboration, webcams

VPN entreprise

SSL VPN appliances (Fortinet, Pulse, Cisco AnyConnect)Risque élevé

Points faibles

Heavily targeted by ransomware groups (Fortinet/Pulse/Citrix CVEs)
Slow patch cycles on appliances
Credential stuffing on internet-exposed portals
Split tunneling exposes corporate traffic

Comment les attaques se produisent

Pre-auth RCE in Fortinet/Pulse used by ransomware actors as initial access (well-documented 2021-2024)
Credential-stuffing attack on VPN portal
Compromised VPN account pivots to internal network

Ce qui vous protège

Patch VPN appliances within 24h of advisories
Enforce phishing-resistant MFA (FIDO2)
Move to Zero Trust Network Access (ZTNA) — Cloudflare Access, Tailscale, Twingate
Disable split tunneling for sensitive segments

Bonnes habitudes

Monitor VPN login anomalies (impossible travel)
Subscribe to vendor PSIRT advisories
Decommission legacy VPN access for departed users immediately
Plan migration off legacy SSL VPN entirely

ZTNA (Tailscale, Cloudflare Access, Twingate)Risque faible

Points faibles

Identity provider compromise = mesh compromise
Coordination server sees connection metadata
Misconfigured ACLs allow lateral movement
Personal devices with corporate ACL

Comment les attaques se produisent

Okta/Entra compromise grants attacker access to entire ZTNA mesh
Misconfigured ACL exposes prod database to all employees
Personal device on mesh becomes pivot point if compromised

Ce qui vous protège

Hardware-key MFA on identity provider
Strict ACLs by group/role
Device posture checks (encryption, OS version) before allowing connection
Separate work and personal nodes

Bonnes habitudes

Quarterly ACL review
Enable session logging
Use ephemeral nodes for guests/contractors
Test least-privilege regularly

Appareils gérés MDM

Corporate-managed laptops/phones (Intune, Jamf, Kandji, Workspace ONE)Risque moyen

Points faibles

MDM admin compromise = mass device compromise
Personal use of corporate device blurs data ownership
BYOD enrollment may give employer access to personal data
Lost device + weak passcode

Comment les attaques se produisent

Compromised MDM admin pushes malicious payload to all enrolled devices
Personal data on BYOD wiped during termination
Stolen unencrypted laptop exposes corporate data

Ce qui vous protège

Strong MDM admin RBAC + hardware key MFA
Enforce full-disk encryption + strong passcode policy
Separate work profile on personal devices (Android Work Profile, iOS User Enrollment)
Document acceptable personal use clearly

Bonnes habitudes

Regular MDM admin access reviews
Test wipe procedures
Enforce automatic OS updates
Educate employees on what employer can see on BYOD

Suites collaboratives

Slack / Teams / Discord (corporate)Risque moyen

Points faibles

Sensitive content in DMs persists indefinitely
Public channels indexed if workspace is exported
Apps/integrations have broad scopes
Guest accounts retain access after engagements end
Discord especially weak for corporate use

Comment les attaques se produisent

Slack workspace breach exposes years of internal discussions (multiple high-profile leaks)
Departed contractor retains channel access
Compromised integration exfiltrates messages
Phishing via DM from compromised colleague

Ce qui vous protège

Enable SSO + MFA for workspace
Set message retention policies
Audit and remove unused integrations quarterly
Decommission guest/contractor accounts immediately on engagement end
Use Discord only for community — never corporate IP

Bonnes habitudes

DLP scanning for sensitive data in messages
Review channel public/private settings
Ban credentials/secrets in messages — use password manager sharing
Train users on what belongs in chat vs ticketing/docs

Webcams & micros

External webcams & USB micsRisque moyen

Points faibles

No physical privacy shutter on many models
Always-on standby with mic enabled
Cheap brands ship with vulnerable firmware
USB-attack surface (BadUSB)

Comment les attaques se produisent

Compromised laptop activates webcam without indicator (rare but documented)
Cheap webcam with backdoored firmware exfiltrates video
BadUSB-style mic poses as keyboard

Ce qui vous protège

Use webcam with physical shutter (or apply tape/sliding cover)
Disconnect mic when not in use
Buy from reputable brands with firmware update support
Watch for indicator LED activity

Bonnes habitudes

Use OS-level camera/mic permissions (macOS, Windows 11)
Audit which apps have camera/mic access monthly
Mute mic in collaboration apps by default
Replace EOL devices

VoyageWi-Fi hôtel, eSIM, hygiène frontières, routeurs voyage

Wi-Fi hôtel & public

Hotel Wi-Fi & captive portalsRisque élevé

Points faibles

Captive portal can MITM TLS via fake CA prompt
Other guests on same VLAN sniff traffic
Hotel staff IT often unmonitored
Compromised hotel network is common (DarkHotel campaign targeted execs)

Comment les attaques se produisent

DarkHotel-style targeted attack on traveling exec via hotel Wi-Fi
Captive portal pushes fake software update
Same-VLAN guest scans your laptop for open shares

Ce qui vous protège

Always use VPN before any other traffic on hotel Wi-Fi
Disable file/printer sharing while traveling
Refuse any prompt to install hotel CA certificate
Use cellular data for sensitive work

Bonnes habitudes

Use a travel router with built-in VPN
Enable firewall on laptop (set network as 'Public')
Forget hotel Wi-Fi when checking out
Avoid logging into banking/email on hotel networks

eSIM & apps SIM voyage

eSIM apps (Airalo, Holafly, Nomad)Risque faible

Points faibles

Account stores travel patterns (where/when)
Payment method stored
ICCID stored against your identity
KYC documents required by some carriers
Second eSIM line bypasses primary security

Comment les attaques se produisent

Account breach reveals travel itinerary
Stolen ICCID enables minor service fraud
KYC documents leaked from breach

Ce qui vous protège

Strong password + 2FA on eSIM app
Delete eSIM profiles after trip
Use prepaid card for purchases
Decline marketing data sharing

Bonnes habitudes

Choose providers with clear data policies
Avoid linking eSIM apps to social logins
Review installed eSIM profiles periodically
Consider local prepaid SIM for highest privacy

Hygiène aux frontières

Device search at border (CBSA, US CBP)Risque élevé

Points faibles

Border officers can demand device unlock (CBSA: limited grounds; US CBP: broader powers)
Cloud accounts accessible from device may be searched
Disk encryption doesn't help if device is unlocked
Refusal can mean device seizure or denied entry

Comment les attaques se produisent

CBP forensic copy of unlocked device retained for years
Cloud documents accessed via signed-in apps
Sensitive client data (legal, journalism, medical) seized
Encrypted disk powered down and unmodified is your best protection

Ce qui vous protège

Travel with a clean 'travel laptop/phone' that contains minimal data
Sign out of all cloud services before crossing
Power down devices fully before approaching border (cold-boot resists most attacks)
Know your rights (CBSA grounds vs CBP discretion)

Bonnes habitudes

Carry data via encrypted cloud, download after crossing
Use a separate eSIM/phone profile for travel
Document any device search incident
Consult lawyer if you carry privileged data (legal/medical)

ePassport & biometric border controlRisque moyen

Points faibles

RFID chip in ePassport readable at short range
Biometric (face/fingerprint) data in government databases
Biometric data is irrevocable
Cross-border biometric sharing agreements

Comment les attaques se produisent

RFID skimming of ePassport (limited data but possible)
Border agency database breach exposes biometrics permanently (OPM precedent)
Biometric used beyond declared purpose

Ce qui vous protège

Use RFID-blocking passport sleeve
Understand biometric collection rights at each border
Know what data is on your ePassport (ICAO 9303)

Bonnes habitudes

Request RFID-blocking cover from travel retailer
Stay informed on CBSA/IRCC biometric policy changes
Decline optional biometric programs unless needed

Routeurs voyage

Travel routers (GL.iNet, Slate AX)Risque faible

Points faibles

Default credentials
Firmware updates lag
Misconfigured Wi-Fi repeater leaks main credentials
Some firmware bundles unwanted services

Comment les attaques se produisent

Default-credential exploit on hotel-deployed router
Outdated firmware exploited via known CVE
Wi-Fi repeater leaks original SSID/password to anyone within range

Ce qui vous protège

Change default credentials immediately
Update firmware before each trip
Use built-in OpenVPN/WireGuard client to tunnel all traffic
Disable unused services (USB sharing, etc.)

Bonnes habitudes

GL.iNet with custom OpenWrt firmware for trust
Use as your only network on hotel Wi-Fi
Reset to factory before disposal
Subscribe to OpenWrt security advisories

Homelab Pro/ProsumerHyperviseurs, conteneurs, SIEM auto-hébergé, reverse proxies

Hyperviseurs

Proxmox VERisque moyen

Points faibles

Web UI on port 8006 often left exposed
Default root login enabled
Missing 2FA setup
VM-to-host escape via misconfigured devices/PCI passthrough
Backup target without immutability

Comment les attaques se produisent

Brute-force on exposed Proxmox web UI
VM escape via vulnerable QEMU CVE
Ransomware encrypts both VMs and PBS backups

Ce qui vous protège

Place Proxmox UI behind reverse proxy + VPN
Disable root login over web; use named admin
Enable TOTP 2FA
Apply security advisories within 48h
Use Proxmox Backup Server with immutable retention

Bonnes habitudes

Network-segregate management interface (vmbr0 separate VLAN)
Subscribe to Proxmox security mailing list
Test VM restore monthly
Enable cluster fencing if HA

VMware ESXiRisque élevé

Points faibles

Heavily targeted by ransomware (ESXiArgs, Akira, Black Basta)
SLP service vulnerabilities
Web UI exposed to management network
Stale snapshots accumulate

Comment les attaques se produisent

ESXiArgs ransomware encrypted thousands of internet-exposed ESXi hosts in 2023
SLP CVE-2021-21974 exploited mass-scale
Compromised vCenter pivots to all hosts

Ce qui vous protège

Disable SLP
Never expose ESXi/vCenter to internet
Patch within 24h of advisories
Use jump host + MFA for admin access

Bonnes habitudes

Migrate to supported alternative (Proxmox, Nutanix) given Broadcom licensing changes
Immutable backups
Monitor host logs for anomalies
Decommission unused VMs and snapshots

Plateformes de conteneurs

Docker / Docker ComposeRisque moyen

Points faibles

Containers run as root by default
Bind-mounting /var/run/docker.sock = root on host
Pulling :latest tags = unpredictable supply chain
Privileged containers escape easily
Exposed Docker API (port 2375) is critical

Comment les attaques se produisent

Compromised container with docker.sock mount escapes to host
Malicious public image (Docker Hub typosquat) installs cryptominer
Exposed Docker API on internet → instant takeover

Ce qui vous protège

Run containers as non-root user
Never mount docker.sock unless absolutely necessary
Pin images to specific digests, not tags
Never expose Docker API to internet — use SSH
Use rootless Docker or Podman

Bonnes habitudes

Scan images with Trivy/Grype before deploy
Subscribe to image vendor security advisories
Use private registry for production
Apply seccomp/AppArmor profiles

Kubernetes / K3sRisque élevé

Points faibles

Misconfigured RBAC grants over-broad cluster-admin
kubelet exposed without authentication
Secrets stored unencrypted in etcd by default
Public container registries pulled without verification
Compromised pod with hostPath escape

Comment les attaques se produisent

Tesla cluster cryptojacked via exposed Kubernetes dashboard (2018 — still relevant pattern)
etcd theft exposes all cluster secrets
Compromised admission controller deploys malicious workloads

Ce qui vous protège

Enable etcd encryption at rest
Strict RBAC: namespace-scoped roles, no cluster-admin for humans
Network policies (Calico/Cilium) for pod isolation
Image signing (Sigstore/cosign) and admission control (Kyverno/OPA)
Disable anonymous kubelet access

Bonnes habitudes

Regular cluster security scan (kube-bench, kube-hunter)
CIS Kubernetes Benchmark compliance
Audit logs forwarded to SIEM
Patch within 30 days of advisories

SIEM & monitoring auto-hébergés

Wazuh / Security OnionRisque faible

Points faibles

Manager exposed to agent network on management ports
Default credentials on Kibana/dashboards
Index growth fills disk quickly
Agent compromise pivots to manager
Alerting fatigue masks real incidents

Comment les attaques se produisent

Wazuh manager compromised via exposed API
Disk full causes log loss during active incident
Default Kibana credentials grant full visibility to attacker

Ce qui vous protège

Change all default credentials (Kibana, indexer)
Place dashboards behind reverse proxy + auth
Enforce mTLS between agents and manager
Enable index lifecycle management to prevent disk fill

Bonnes habitudes

Tune detection rules to minimize alert fatigue
Forward critical alerts to email/Slack/Teams
Test detections quarterly
Document incident response playbooks

Reverse proxies & ingress

Caddy / Traefik / Nginx Proxy ManagerRisque faible

Points faibles

Default config may not enforce HSTS / security headers
Wildcard certs cover too much surface
Misconfigured upstream exposes admin panels
ACME DNS-01 token leaks from CI

Comment les attaques se produisent

Misconfigured proxy exposes Nextcloud admin to internet
Stolen wildcard cert enables MITM across all subdomains
ACME token in public git repo allows attacker to issue certs

Ce qui vous protège

Enable HSTS, CSP, X-Frame-Options by default
Use per-service certs (Caddy auto-handles this)
Restrict admin-panel ingress by IP allow-list or VPN-only
Rotate ACME credentials regularly

Bonnes habitudes

Subscribe to proxy security advisories
Audit exposed routes monthly
Use Cloudflare Tunnel or Tailscale Funnel for safer ingress
Test with securityheaders.com

Émergent & WearablesLunettes AR, BCI, drones, apps robotaxi

Lunettes AR

Meta Ray-Ban / Apple Vision Pro / Snap SpectaclesRisque élevé

Points faibles

Always-on cameras / mics in public — bystander privacy concerns
Indicator LEDs can be defeated or ignored
Captured imagery synced to vendor cloud
Tied to broader vendor ecosystem account
Facial recognition concerns (Meta Ray-Ban + AI integration)

Comment les attaques se produisent

Bystanders unknowingly recorded; criminal liability in two-party-consent jurisdictions (Quebec)
Compromised vendor cloud exposes recorded imagery
AI-on-glasses identifies strangers in real time (privacy concern)
Stolen glasses access cloud-synced library

Ce qui vous protège

Disable cloud auto-upload of media
Respect local recording laws (Quebec requires consent)
Use Lockdown Mode (Vision Pro) for high-risk targets
Strong account password + 2FA

Bonnes habitudes

Visibly indicate when recording
Decline AI features that identify people
Review captured media before any sharing
Be aware of evolving Canadian privacy law on always-on cameras

Drones

Consumer drones (DJI, Skydio, Autel)Risque moyen

Points faibles

Telemetry sent to vendor (DJI especially scrutinized — US ban context)
Captured imagery uploaded to vendor cloud
Geo-fencing can be bypassed
Live video feed unencrypted on some links
Drone broadcasts Remote ID (publicly readable)

Comment les attaques se produisent

DJI telemetry shared with foreign government concerns
Compromised vendor account exposes flight history and footage
Live video intercepted via SDR
Remote ID enables tracking of operator location

Ce qui vous protège

Disable vendor cloud sync if possible
Local SD card storage only
Strong account password + 2FA
Comply with Transport Canada drone regulations (RPAS)
Be aware of Remote ID broadcasts

Bonnes habitudes

Choose Skydio/Autel if DJI vendor risk is concern
Update firmware before flights
Maintain flight logs locally
Respect privacy of overflown areas

Interfaces cerveau-machine

Consumer BCIs (Muse, Neurable, future Neuralink)Risque moyen

Points faibles

Neural data is the most intimate biometric — irrevocable
Wireless transmission of neural signals
Vendor cloud stores meditation/cognitive patterns
Limited regulation of neural data privacy
Side-channel inference of intent/emotion

Comment les attaques se produisent

Vendor breach exposes detailed cognitive/mental-state data
Insurance discrimination based on inferred neural patterns
Coercive use in workplace/legal contexts (early-stage concern)

Ce qui vous protège

Use BCIs that store data locally only
Decline cloud sync and research opt-ins
Strong account password + 2FA
Stay informed on Canadian neural-data regulation development

Bonnes habitudes

Treat as highest-sensitivity health data
Demand transparency on data retention
Advocate for Bill C-27 neural data protections
Choose vendors with clear privacy commitments

Robotaxi & autonome

Robotaxi rider apps (Waymo, Cruise, future Tesla Robotaxi)Risque faible

Points faibles

Trip history reveals home/work/medical addresses
In-cabin cameras record passengers
Account stores payment method
Data shared with municipal authorities (incident reporting)

Comment les attaques se produisent

Account breach exposes detailed trip history
In-cabin footage subpoenaed in legal proceedings
Vendor data sale reveals movement patterns

Ce qui vous protège

Strong password + 2FA
Drop-off slightly off home address for sensitive trips
Review trip history privacy settings
Decline marketing data sharing

Bonnes habitudes

Verify in-cabin recording disclosures
Limit stored payment methods
Use one-time payment cards
Stay informed on regulatory developments (Canada lags US on robotaxi)

Physique & Chaîne d'appro.Appareils USB malveillants, tokens, chaîne firmware, déchets électroniques

USB & câbles malveillants

Malicious USB devices (Rubber Ducky, O.MG cable, Bash Bunny)Risque élevé

Points faibles

Looks like legitimate cable/drive but injects keystrokes or exfiltrates data
Found-USB attack remains effective (60%+ pickup rate in studies)
Charging cables can be malicious (O.MG cable indistinguishable)
Conference giveaway cables/drives are untrusted

Comment les attaques se produisent

Found USB in parking lot plugged in by curious employee
Malicious O.MG cable received as 'gift' enables remote keystroke injection over Wi-Fi
Conference USB swag installs cryptominer
Public charging port (juice jacking)

Ce qui vous protège

Never plug in unknown USB devices
Use USB data blocker for charging in public
Buy cables only from known brands and direct sources
Disable USB auto-run / autoplay
Use endpoint protection that blocks HID-class device anomalies

Bonnes habitudes

Carry your own charger and cable when traveling
Wall power > USB charging in public
Train employees on found-USB risks
Consider USB port-blocking policy on sensitive workstations

Tokens matériels

YubiKey / Titan / FeitianRisque faible

Points faibles

Counterfeit keys from unauthorized resellers
Lost key without backup = lockout
Some older firmware vulnerable to side-channel (YubiKey 5 ECDSA pre-2024)
Physical coercion to tap key

Comment les attaques se produisent

Counterfeit YubiKey from marketplace contains backdoor firmware
Lost sole key locks user out of every account
Side-channel attack on stolen key extracts ECDSA private key (2024 EUCLEAK research)

Ce qui vous protège

Buy direct from vendor (yubico.com, store.google.com) only
Always register at least 2 keys per account
Store backup key in fireproof safe / safety deposit box
Update firmware where supported

Bonnes habitudes

Use FIDO2 with PIN for presence + knowledge factor
NFC keys for mobile compatibility
Periodically test backup key works
For highest assurance, use newest hardware revisions

Chaîne d'appro. firmware

IoT firmware & supply-chain attacksRisque élevé

Points faibles

Firmware signed with stolen vendor keys (D-Link, Asus historic precedents)
OTA update channels themselves can be hijacked
Outsourced manufacturing introduces backdoors
Vendor SDK vulnerabilities propagate across hundreds of brands
Counterfeit chips with modified firmware

Comment les attaques se produisent

SolarWinds-style supply-chain attack on consumer router vendor
Compromised OTA pushes malicious firmware to thousands of devices
Counterfeit electronics with hidden backdoors (multiple US DoD findings)
Vendor SDK CVE affects every product using it

Ce qui vous protège

Buy from reputable vendors with active security lifecycle
Verify firmware signatures where possible
Keep firmware current via official channels only
Subscribe to vendor security advisories
Replace EOL devices — no patches = unfixable risk

Bonnes habitudes

Maintain inventory of devices and their firmware versions
Network-segment IoT devices
Plan device replacement before EOL
Avoid no-name brands for sensitive contexts

Déchets électr. & assainissement

Old devices, drives, smartphonesRisque moyen

Points faibles

Factory reset insufficient on many flash storage devices
SSD wear leveling leaves data recoverable
Phones with non-removable storage retain data after reset
E-waste recyclers may resell devices with data intact
Trade-in programs do not always wipe properly

Comment les attaques se produisent

Recovered drive from recycler reveals years of personal/business data
Resold smartphone contains accessible photos and accounts
Donated laptop with quick-format leaks tax records
Office equipment lease return retains scanned documents

Ce qui vous protège

For HDDs: secure erase via tool (DBAN, manufacturer utility) or physical destruction
For SSDs: vendor secure-erase tool, then ideally physical destruction
For smartphones: full factory reset → encrypt → reset again; remove SIM/SD
Use a certified e-waste recycler (Recycle My Electronics in Canada)

Bonnes habitudes

Maintain disposal log for sensitive devices
Physical destruction (drill, shred service) for highest sensitivity
Sign out of all accounts before reset
Remove from Find My / vendor account before disposal
For business: certificate of destruction from recycler