OPINION I write a weekly column called PWNED, about how poor security practices can lead to serious damage. Usually, there’s something funny in the malfeasance, like a CEO who kept every employee’s password in an Excel file on his desktop. 

However, I wasn’t laughing back in May when professional thieves invaded my 84-year-old mother’s entire financial life and managed to make off with $30,000 from her bank accounts alone. And they wouldn’t have gotten in if her financial institutions required multi-factor authentication (aka MFA or 2FA), a step too many institutions won’t take.

One day in May, Mom got a call from the institution that runs her retirement savings account, who had identified a suspicious transaction and asked her if it was legit. She said no and they immediately protected her account.

Then she checked her bank account at a different institution to see if it was compromised and found thousands of dollars transferred out of her checking and savings accounts. The thieves knew exactly how much they could withdraw each day, and used both withdrawals and transfers to a strange account. But the financial institution hadn’t flagged the fraudulent activity. 

The thieves were so slick that they broke into her Gmail account and created spam filters to filter any mail from her bank or retirement savings provider to the trash so she wouldn’t get alerts about the transfers or about the fake accounts they made in her name.

She spent hours on the phone reporting the theft to an unhelpful and incredulous fraud department who asked “Are you sure a relative didn’t do this?”

We don’t know for certain how the crims got into my mom’s accounts, but we know she used the same or similar passwords on all of her accounts, and at least one of her accounts was part of a data breach a few years ago, so that info was probably available somewhere online. The miscreants then could have used this info to get into her retirement account, her bank, and her Gmail. 

None of this would have been possible if she had MFA enabled on those accounts, but neither Google nor her financial institutions require it.

“Many consumers assume every bank requires 2FA, but that’s not the reality,” said Gregory Shein, CEO of Nomadic Soft, a SaaS company that serves fintech clients. “Some financial institutions still treat it as an optional feature because they’re balancing security against friction. Every extra login step can reduce conversions, increase support tickets, and frustrate less technical customers.”

Indeed, while some banks such as PNC require MFA, others such as Bank of America, Chase, Capital One, and Citibank leave it as optional. Google’s accounts are also MFA-optional.

Fortunately, after they spent hours telling my mom that someone in her family could have done the deed, and repeatedly putting her on hold, then forcing her to navigate a labyrinthine phone tree, the bank eventually agreed to investigate.

A few weeks later, they restored the stolen funds. 

A not entirely happy ending

My mother was lucky, because if money is stolen from your bank account, there is no guarantee that you will get it back, at least in the US.

According to the Consumer Financial Protection Bureau, you have 60 days from the date of a bank statement to dispute any transactions. The bank also has 45 days to investigate, unless your bank account was just opened in the last 30 days or the fraudulent transactions took place outside the US. 

But the bank could very well decide that those fraudulent transactions look legitimate and refuse to reimburse you. If the bank doesn’t agree to reimburse you, your next step is to get a lawyer and attempt to sue. A quick search revealed dozens of lawyers in my area who specialize in dealing with this problem.

It would be easy to blame my mom for being robbed. Using the same password in multiple places left her wide open for exploitation. However, her bank’s lack of a required second authentication factor also contributed. The bank doesn’t let you transact without a password, and it doesn’t issue you an ATM card without a PIN, because it knows that there has to be a required minimum level of security.

Banks and other financial institutions know better. Google knows better. But they’re all putting convenience ahead of security when it’s your money that’s on the line.

“Different segments of the population adopt technology faster or slower. If I’m a bank, I have to consider that very closely because I don’t want to lose any banking relationships.” Andrew Shikiar, CEO of the FIDO Alliance, an industry association that advocates for stronger login security, told me in an interview.  “So I think there’s some concerns around friction that have held some banks and other service providers back from really pushing this more aggressively.”

How effective is MFA?

According to a 2019 article from Microsoft, MFA prevents 99.9 percent of attacks on your accounts. However, other experts say this number is exaggerated, as there are many ways to get past MFA if you’re a criminal, including social engineering and interception.

One of the most common types of MFA, issuing a one-time passcode via an SMS message or an email, is inherently flawed. A determined thief can use social engineering to get a SIM card with your phone number on it, then get to your texts. And if your email itself isn’t perfectly secure and it is receiving an OTP, they can get to that too. Phishers can also trick you into giving up your OTPs by creating a fake website that looks like your bank’s login page. 

The right way to do MFA today is with a passkey. Passkeys are cryptographic key pairs where there’s a private key on the user’s device and a public key on the server. To access the key on the device, the user must either enter a PIN, touch a physical security key like a Yubikey, or enter a biometric login such as their face or fingerprint.  Passkeys cannot be phished or intercepted, which is why they are known as “phishing-resistant MFA.”

Unfortunately, a lot of banks are sticking with their OTPs. For example, when I went to set up MFA for a family member’s account with US bank Chase, using its website.

Chase offered the chance to receive an OTP via email, SMS, or a phone call. The bank is rolling out passkeys, according to the FIDO Alliance. So are Wells Fargo, US Bank, and Bank of America. 

Some banks may be using better MFA only within their mobile apps. Chase’s app, for example, asks users to use a fingerprint or facial recognition at login, even though the website does not. However, if a thief wants to log in at Chase’s website, there will be no biometric challenge. And if a user doesn’t have MFA enabled at all, it’s even easier for thieves to get in.

“OTP is just another password. So it’s a shorter-lived one, but it really is just another password,” Shikiar said. “And there’s also usability issues. You’re juggling between your mobile and your desktop. It’s insecure, inefficient, and a really inadequate user experience.”

What banks don’t seem to understand is that you’re only as secure as your weakest entry point. If security controls only exist on mobile apps, it doesn’t help with web-based attacks. If a level of security is optional, the majority of people won’t enable it. Thieves will take the path of least resistance, so service operators need to lock down all entry paths equally by default.

Unfortunately, an approach that favors convenience over security will lead to a lot more people losing their money. And, ultimately, banks will lose money when they have to reimburse people for those fraudulent transactions.

“I don’t expect banks to be mandating passkeys and only passkeys for some time, but the more they push them, the more comfort there is,” Shikiar told us. “The sooner we’ll get to that point where it becomes a de facto default and then becomes really something that’s either required or essentially required.”

That time should be now. ®

We’re big fans of NotebookLM around here, so much so that it received our Editor’s Choice Award. But it’s not the only AI tool out there that can synthesize your data to better understand it. In fact, there are a lot of options out there, it’s just that none are quite as approachable as NotebookLM. 

Maybe you need a more specific type of output, or just don’t want Google handling your data. Not all of the following tools have nifty features like the Audio or Video Overviews that helped give NotebookLM its reputation today. Instead, they may offer a more tailored set of capabilities, whether you’re a student, an analyst or someone who simply prefers more privacy.

Below, we’ll detail a few other AI learning tools that have similar features but might be better suited for you depending on what you’re trying to do, your profession or your workflow.

Atlas.org launched in 2024, and its team consists of current students, recent graduates and former educators. Its sole purpose is to help you with your schoolwork, and it’s organized as such. 

When you first sign up and log in, you’ll be presented with a series of options, each tailored to the learning experience. The three primary sections are for studying, homework and taking notes, and each of those subsections has different options to dig in deeper. 

For studying, you can create a study guide, a quiz or flash cards. You can automatically create lecture notes from recorded audio or help get detailed answers to questions on your homework. 

The information you upload to Atlas.org is retained forever, so you’ll have a continuously growing knowledge base about your schoolwork, and you can create dedicated spaces for different topics. Like NotebookLM, it also has a mobile app for iOS and Android that allows you to learn on the go. 

Atlas is free to try out, but the free tier comes with some fairly steep limits. You can upgrade to the Pro version for $18 per month. 

Yes, another tool with Atlas in its name, but Atlas Workspace is pretty specific with its functions. It specializes in knowledge and semantic mapping and is aimed towards scientists and research analysts. It essentially allows you to create a full knowledge base on its servers and map out exactly what you want to see when you want to see it. The more sources you upload, the more you’ll get out of it, and since it’s a collective database of your sources, you don’t need to remember where you saved a specific piece of information. This is in contrast to NotebookLM’s Notebooks, where the sources remain isolated as individual projects. 

When you upload a source such as a PDF, Atlas Workspace will automatically begin building a knowledge map, breaking down the core components of your source — and you can start asking specific questions from there. You can also view a semantic map to get a more visual representation of your sources and how you’ve interacted with the tool.

Atlas isn’t going to be for everyone, and that’s because not everyone needs this type of tool. To get the most out of it, you’ll need to spend a lot of time working with it, and there’s a fairly steep learning curve to it. However, the Atlas Workspace blog has several in-depth comparisons between its competitors that might be helpful for people still on the fence. 

The free version of Atlas Workspace allows for 10 total sources and five lifetime AI chats, but you’ll have access to unlimited projects, which are similar to NotebookLM’s Notebooks, but Projects can connect concepts across projects, keeping up with the compounding knowledge aspect. If you opt for the $20 per month Pro plan, your source count gets boosted to 1,000 and you’ll have unlimited AI chats. 

OpenNotebook

We’ve covered OpenNotebook in depth before, and it’s fairly close to a lot of the functionality NotebookLM carries with it. However, you’ll need to know what you’re doing to set it up, which can feel incredibly involved if you don’t consider yourself a “tech” person. However, once it’s set up, there’s a lot it can do. 

As you’d expect, you can upload your sources to OpenNotebook and chat with AI about it, but what makes this tool special is that you can pretty much choose whatever AI model you want. This will require more work and, depending on the model, may require a paid API key. You can even use a local LLM if you so choose. 

Something standout about OpenNotebook is that it’s very privacy-friendly. Your data stays with you, and you decide what you share. OpenNotebook is also free and open-source. 

I’ve been writing about fitness tech for years, and we’re finally at a point where more affordable fitness trackers are now every bit as capable as models that would have cost hundreds of dollars or pounds, little more just a few years ago. That’s not to say premium options don’t have their place too, but many of the standouts this year have certainly been on the cheaper end.

Whether it’s screenless devices showing less can be more, the latest iteration of the popular Oura Ring, or a pair of Amazfit options that can cut it with much more expensive models, here are the best fitness trackers in 2026 so far, in no particular order.

1. Google Fitbit Air

In the 1970s, American Fireworks, a family-run pyrotechnics company in Hudson, Ohio, used a “home run box” to offer quick and easy fireworks displays for the Cleveland Indians (now the Cleveland Guardians) baseball games.

The red wooden crate had metal silos to store the rockets. Each switch on the control panel allowed the operator to set off a different firing sequence. This setup instantly triggered the display whenever a Cleveland batter hit a home run. Before computerized firing systems became common, panels like this represented the state of the art. But they did not eliminate human error. On 15 September 2015, the technician in charge of the Indians’ pyrotechnics accidentally set off the fireworks when the opposing team hit a home run. The embarrassed technician was caught on camera holding his head in his hands.

This home run box and control panel [left] were used to launch fireworks during Cleveland Indians games. The rockets were housed in metal silos within the box.Left: Jahna Auerbach/Science History Institute; Right: American Fireworks

The Early History of Fireworks

Fireworks are one of the many Song Dynasty inventions that migrated from China through the Middle East and into Europe by way of trade routes. Around 200 B.C.E, the Chinese invented small firecrackers by simply tossing pieces of bamboo into a fire. The air inside the bamboo would expand and crack the wood, and the pop supposedly scared away evil spirits. After the invention of gunpowder—a mixture of sulfur, charcoal, and potassium nitrate—about a thousand years later, some clever person thought to pack the powder into the bamboo tubes and ignite them, launching the first fireworks—and the first rockets—into the sky.

John Bate’s popular 1634 book on fireworks described fire wheels [left] and a flying dragon [right], consisting of a dragon-shaped rocket that sped along a rope. SSPL/Getty Images

By the Renaissance, specialized schools for pyrotechnics had emerged across Italian city-states, and European craftsmen began creating large spectacles for royal occasions and religious celebrations. In 1634, John Bate published the four-volume series The Mysteries of Nature and Art, the second of which described how to create all manner of fireworks. Woodcut illustrations showed fire wheels (now called pinwheels or Catherine wheels), as well as the more ambitious flying dragon—a rocket shaped like a dragon that emitted sparks while speeding across a rope strung between two buildings.

During the 18th and 19th centuries, chemists and alchemists discovered new chemical compounds and isolated new elements that expanded the palette for fireworks. Adding barium nitrate produced green, for example, and strontium nitrate produced red. Chemists also mixed in metal particles to create sparkles.

The 1880s saw the introduction of the loud screech or whistle that precedes the exploding boom. Amédée Denisse, a graphic artist by trade and a fireworks hobbyist, discovered that a cardboard tube containing potassium picrate added that satisfying auditory effect to his fireworks display.

How Did Fireworks Become a 4th of July Tradition?

British colonists brought fireworks to the Americas. In 1608, Captain John Smith set them off to celebrate the founding of Jamestown, Virginia, the first permanent English settlement in what would become the United States. More than a century and a half later, while the Continental Congress was meeting in Philadelphia in July 1776, future U.S. president John Adams speculated in a letter to his wife that Independence Day would be celebrated “with pomp and parade, with shews, games, sports, guns, bells, bonfires and illuminations from one end of this continent to the other.”

Although Adams got the day wrong—he mistakenly thought the committee would complete the revisions to the Declaration of Independence by the 2nd of July—he was correct in foreseeing that Independence Day would be celebrated with lots and lots of fireworks. Just a year later, on 5 July 1777, the Pennsylvania Evening Post reported on the grand exhibition of fireworks the previous night, which began and concluded with 13 rockets representing the 13 colonies.

It’s safe to say that the United States is still obsessed with fireworks. According to the American Pyrotechnics Association, the country spends about US $3 billion on fireworks each year; it’s also the leading importer of fireworks. As the U.S. gears up to celebrate its 250th birthday this 4th of July, expect to see fireworks displays everywhere, from kids with sparklers running in backyards to ambitious professional displays for huge crowds.

Modern fireworks displays like the Macy’s 4th of July celebration in New York City are computer choreographed and controlled. Roy Rochlin/Getty Images

Fireworks today are an engineering marvel. State-of-the-art displays are computer controlled with precise digital timing, often tied to musical accompaniment. Designers can spend weeks choreographing complicated patterns and assigning launch times, shell types, and colors. The completed script is uploaded to an electronic firing system, which consists of the control panel and hundreds or thousands of firing modules that connect to the rockets. It can take days to set up the launch site for a large-scale display that lasts just minutes.

For example, last year more than 60 licensed pyrotechnicians worked for 12 days to arrange more than 80,000 shells for the Macy’s 4th of July Fireworks in New York City. Each of the firework shells measured up to 25 centimeters in diameter and weighed more than 13 kilograms—a far cry from their bamboo ancestors. More than 120 kilometers of wire connected the bundles of explosives to twelve computers. All that for a 25-minute display.

As much as I unabashedly love fireworks, they’re not for everyone and they do have a downside. The explosions can trigger PTSD for military veterans, and they can also upset animals. Every year, thousands of people are injured by mishandled or damaged fireworks. Known to set off wildfires, fireworks are often banned during droughts. Scientists who’ve studied the environmental impact of fireworks displays have noted their tendency to disperse airborne metallic particles and other harmful particulates.

A drone light show over Busan, South Korea, shows a member of the K-pop band BTS.Hwawon Ceci Lee/Anadolu/Getty Images

Perhaps to counter those drawbacks, or maybe it’s just the next technological evolution in aerial display, companies are now offering drone light shows. Fleets of hundreds or thousands of LED-toting drones can be programmed to hover in the air and fly in formation, forming logos and other designs that are more stable than exploding fireworks.

These exquisitely choreographed light shows are truly impressive. And yet I relish the full sensory experience of fireworks, including the booms, the smoke, and the smell. So whether you’re celebrating your country’s birth, Guy Fawkes Day, Saint Sylvester’s Night, New Year’s, Diwali, or simply cheering a home run from your favorite team, I hope you get to enjoy this millennia-old technological marvel.

Part of a continuing series looking at historical artifacts that embrace the boundless potential of technology.