We want to welcome as our latest long-term sponsor Art Authority, co-founded by Alan Oppenheimer. He went from being one of the creators of AppleTalk, running an Internet service provider, and developing a Mac firewall to creating iPhone, iPad, and Apple TV apps whose mission is to make all the world’s art accessible to everyone. Art Authority has also acquired several companies that sell reproductions of masterpieces as fine art prints and museum store items.

We’ve mentioned Art Authority’s apps a number of times over the years, and the company’s latest announcement is a virtual museum—Art Authority Museum.

The Art Authority Museum is a groundbreaking new immersive art museum, with a collection of thousands of history’s most important artworks created by hundreds of the most significant artists of all time. You’ll not only experience these works just as in a brick-and-mortar museum (without the crowds), but you’ll soon be able to personalize that experience in ways we all can only begin to imagine.

Why the teaser? The Art Authority Museum is a free Vision Pro app, and for the moment, it provides only pre-opening tours of its lobby, where users can experience dozens of the world’s most historically significant artworks. Art Authority plans a grand opening later this year when its full collection—tens of thousands of artworks—will be available. Users will be able to create their own galleries, and Art Authority has numerous other features in the works, such as being able to get as close to the art as you like, something that tends to trouble guards in physical museums, and custom audio overlays to inform or entertain as you immerse yourself in the art.

(Ironically, Alan said they wouldn’t be able to visit their own museum for a few days because their Vision Pro hardware doesn’t arrive until later this week. Apple says there are over 600 apps available for the Vision Pro right now, and I bet we see a lot of quick updates as developers get to see how their apps look and work in a real Vision Pro rather than just a simulator.)

If you’ve purchased a Vision Pro, I encourage you to give the Art Authority Museum app a try. And if you’re waiting for a future Vision Pro built into standard glasses, check out Art Authority’s other apps: Art Authority for the iPad, Art Authority for the iPhone, and Art Channel for the Apple TV.

Apple’s new Vision Pro headset is here (see “Apple Vision Pro Arrives 2 February 2024,” 8 January 2024). As always, Apple seeded some select reviewers with pre-release units. You could easily spend several hours reading and watching them all, and unless you’re highly intrigued by the Vision Pro, that may be more time than you have. Plus, the reviewers largely agreed about most things, so it’s not as though there are many different perspectives. That’s not unexpected—the Vision Pro is so new and so unusual that most people are just trying to explain the basics for now.

The Reviews

To get started, watch the video by Joanna Stern of the Wall Street Journal. It’s less than 9 minutes long, but she puts the Vision Pro through its paces in a real, if slightly contrived, environment, and her work is always insightful and entertaining.

Once you’ve watched Joanna Stern’s video to get a sense of what the Vision Pro looks like and what a user would see, you have the necessary visual background to read the 7250-word review by John Gruber of Daring Fireball. Gruber’s description and analysis are careful and thoughtful, which is good because they’re backed with only a single still image.

After that, you have a choice. If you’d like to read more, Nilay Patel of The Verge penned a 9000-word review illustrated with numerous still images. He’s the least positive of all the reviewers and the one who most emphasizes that wearing a headset is inherently isolating. And he’s not happy about it messing up his hair. The Verge’s video is impressively produced, but content-wise, it’s essentially Patel reading the text of his article (though you get to see the effect of the Vision Pro on his hair).

YouTuber Marques Brownlee of MKBHD created three videos about the Vision Pro. The first is a 19-minute unboxing video, and while I skimmed some of the early parts, once he’s explaining all the parts and pieces, it’s helpful and informative. He followed that up with another well-done 38-minute video about using the Vision Pro that’s more in-depth than Joanna Stern’s. But the best one is the third video, in which he shares opinions about how well the Vision Pro hardware and software work.

After that, I was honestly a little burned out on learning more about the Vision Pro, but if you want to press on, you can read a 5000-word review from Mark Spoonauer of Tom’s Guide or a 7000-word review from Scott Stein of CNET. For more video coverage and the most enthusiastic review, watch iJustine’s 32-minute video that combines unboxing and usage. Note her warning that the videos of what the reviewer sees look very fast and jumpy but don’t reflect what’s being experienced.

Initial Impressions

After consuming all these reviews, I came away with some impressions about the Vision Pro:

• It’s an amazing VR headset: All the reviewers were blown away by the level and amount of technology that Apple has shoehorned into the Vision Pro. They say every aspect of the experience is better than what they’ve experienced with other VR headsets. The Vision Pro may be expensive, but it doesn’t feel like Apple is overcharging based on what’s inside.
• It’s more expensive than we thought: The $3499 list price is just the beginning. That model has 256 GB of storage; 512 GB costs $3699 and 1 TB is $3899. Given the size of 3D content, apps, and your Photos library, 256 GB may not be enough. Many will also need the Zeiss optical inserts: $99 for readers or $149 for prescription lenses. Apple’s padded carrying case for travel runs another $199, and AppleCare+—almost certainly essential—costs $499. You could also pay $199 for a backup battery pack and $199 for another light seal cushion if someone else in your household wants to try it. You could spend nearly $5000 on a kitted-out Vision Pro.
• It’s heavy: Everyone commented on the weight. Even though Apple has done a good job with the design and provided two types of head straps, the Vision Pro still puts 650 grams (1.4 pounds) on the front of your face. That’s ergonomically problematic (and would have been worse if Apple had integrated the battery pack), so if you’re buying the Vision Pro, I urge you to increase session time slowly to avoid overloading your neck muscles.
• EyeSight is weird: EyeSight, which displays a digital representation of your eyes on the front of the Vision Pro, is weird and ineffective. The resolution and brightness are much lower than Apple’s marketing suggested. The eyes don’t look natural, and if you have dark skin, like Marques Brownlee, they’re hard to see. This is disappointing since Apple made such a big deal about how EyeSight would help make others feel more comfortable with you when you’re wearing goggles. Perhaps most people will remove the Vision Pro when others are around.
• Personas are deeply unsettling: Personas, which give you a digital avatar from the chest up, are even more disconcerting. They’re highly accurate representations that are still profoundly wrong, which lands them deep in the uncanny valley. Apple says Personas are still in beta, but it’s hard to imagine them improving enough to climb out of the valley.
• Guest mode, but seemingly no multi-user support: Several reviewers briefly mentioned that there’s a Guest mode that lets someone else try out a Vision Pro, and iJustine has a friend test it. From what I can tell, though, it’s designed for demos, not for regular sharing with someone else in your family.
• You can have just one 4K Mac display: Everyone liked displaying a Mac’s screen within the Vision Pro environment, and you can expand it. However, that screen is limited to 2560-by-1440 pixels, and you can only have one. Although you can arrange native Vision Pro and compatible iPad apps next to the virtual Mac screen, it’s not exactly the “infinite canvas” Apple has been promoting.
• A physical keyboard is essential for being productive: If your aim is to get work done, you’ll need a Bluetooth or laptop keyboard. The visionOS virtual keyboard is fine for inputting passwords and other short bits of text, but that’s it.

Final Thoughts

The most important thing to remember about the Vision Pro is that it’s not for “the rest of us.” It’s not even clear who the Vision Pro is for—there is no killer app yet. Apple is planting seeds for developers, early adopters, and the tech curious who are willing to spend big to be on the bleeding edge. To be sure, Apple also wants to get ahead of Meta and other companies that may want to stake out similar territory. The hope is that the Vision Pro will provide everyone—Apple, developers, and users—with the experience necessary to work toward a point where the technology has evolved sufficiently that it can become a mainstream product at an affordable price.

Or, rather, that’s my analysis of the situation, which matches that of many experienced tech industry watchers. But it’s not what you’ll hear from Apple’s marketing machine, which has to pretend that the Vision Pro is for everyone and solves real-world problems today. Apple can’t say out loud that the initial Vision Pro is a necessary first step toward an imagined future, but when you compare it to everything Tim Cook has said about AR and VR, it’s pretty clear that’s what is happening.

Perhaps the second-generation Vision Pro will be half the weight, the third-generation model will integrate the battery, and the fourth-generation will be actual glasses rather than a VR headset with passthrough video. (And surely we’ll get a “Vision Air” at some point.) The promise is compelling, if dangerously close to science fiction—a Vision Pro could one day supplant every other Apple product. Who needs an iPhone, Mac, Apple Watch, or Apple TV if a pair of glasses (contact lenses would be science fiction) could provide all the same processing, communications, recording, and virtual display options? That may be looking too far into the future, but regardless, I’d prefer Apple’s vision—and implementation—of what comes next to those of any of today’s other tech giants, who would likely bombard you with ads, track your every eye movement, and try to sell you more stuff.

Reporting on its Q1 2024 financial results, Apple has announced profits of $33.9 billion ($2.18 per diluted share) on revenues of $119.6 billion. The company’s revenues were up 2% compared to the year-ago quarter, and profits rose by 16% (see Apple Q1 2023 Revenues Slowed by Exchange Rates, COVID, and Inflation, 3 February 2023). Apple executives made a point of noting that this quarter’s results were based on 13 weeks of activity compared to 14 weeks in last year’s first quarter. That’s good news compared to the four fiscal quarters of slight revenue drops in 2023, and the results make Q1 2024 Apple’s second-highest quarter ever in both revenues and profits behind only Q1 2022.

The largest wedges in the quarterly revenue pie chart were once again the iPhone, which accounted for 58% of Apple’s revenues, and Services, which posted an all-time record and was 19% of the quarter’s revenue; together, the two categories contributed 77%. Of the remaining segments, the Mac held its ground at about 7% of the mix, but the iPad and Wearables both dropped, each accounting for 2% less of the pie than they did last year (see “Apple Q1 2023 Revenues Slowed by Exchange Rates, COVID, and Inflation,” 3 February 2023).

iPhone

The iPhone performed particularly strongly. Even though its performance trailed the 2022 record high, Apple still brought in $69.7 billion in iPhone revenues, up 6% from 2023. Although the iPhone 15 line was a relatively minor evolutionary update, Apple claimed that its customer satisfaction reached 99% and said the number of iPhone upgraders hit an all-time high.

Mac

The first quarter of 2024 saw the introduction of the M3-equipped versions of the 24-inch iMac, the 14-inch MacBook Pro, and the 16-inch MacBook Pro, helping drive Mac revenues slightly higher than last year’s first quarter results—less than 1%—even though (as Tim Cook again emphasized) this year’s first quarter was a week shorter than the same quarter last year.

iPad

It’s hard to say that the iPad is struggling, given that it still brought in $7 billion in revenue. Nonetheless, that was a 25% drop from the product’s “difficult compare” to 2023’s revenues, which were unusually high because of the late 2022 release of the M2 iPad Pro models and Apple catching up with pent-up demand from previous supply disruptions due to factory shutdowns. But it was also the lowest iPad revenue number since 2020. Because Apple released no new iPads last year, it seems likely that the next new model will boost iPad revenues significantly.

Wearables

As with the iPad, a “difficult compare” with last year’s results in the Wearables category led to an 11% drop in revenues, even including sales from the just-released Apple Watch Series 9 and Apple Watch Ultra 2 models. In coming quarters, Apple’s new Vision Pro will be included in the Wearables category, but given its small initial production run, it can’t make a big revenue difference for a while. Nonetheless, Apple emphasized the interest enterprise customers are expressing in the device. When pressed by an analyst, Cook refrained from comparing the likely sales trajectory of the Vision Pro to any previous Apple product, saying that “each product has its own journey.”

Services

Once again, the Services category was a bright spot in Apple’s revenue picture, notching an 11% increase year-over-year, the highest of Apple’s reporting segments. With 2.2 billion Apple devices now in the installed base, the company’s opportunity to provide those devices with services bodes well for continued growth in this category.

Regional Results

Revenues from Greater China were down 13% year over year, but the rest of the world helped compensate for that downturn, with Cook expressing pleasure at Apple’s performance in emerging markets, such as Latin America and the Middle East. The Americas squeezed out a revenue increase of 2% compared to the one-week-longer quarter a year ago. Even better, the Europe and Asia-Pacific region revenues hit all-time records, up 10% and 7%, and revenues were up 15% in Japan.

Looking Ahead

Although Apple continues to be highly profitable and has returned to growth, the company has its work cut out for it in the months ahead, what with slowing sales in China and the unknown effect of Apple’s grudging efforts to meet the new EU app distribution requirements (see “The EU Forces Open Apple’s Walled Garden,” 29 January 2024). On the plus side, new iPads will surely emerge later this year to bolster that segment, and it seems likely that Apple’s iPhone and Services segments will continue to perform well.

At some point, most of our communications switched from analog to digital: letters and phone calls transitioned to emails, texts, calendar events, and cellular, Internet, or video calls. With analog methods, we expected our secrets to remain largely safe. It was both difficult and illegal (other than for governments) to wiretap a phone line or steam open a letter. We could assume that our private communications would nearly always stay private.

The Internet made exploitation possible on a worldwide basis. No longer did someone need to pull your particular letter out of the mail stream or get physical access to a phone trunk line or switching center. Most experts underestimated how unprotected digital communications were for the longest time. It’s only relatively recently, starting over a decade ago, that the full reckoning began on what sensitive information we were unintentionally sending in the clear or storing at rest without protection, whether on our own hardware or remote server drives.

Activists, journalists, politicians, union organizers, and business executives have borne the brunt of these issues because they have a high risk of exposure revolving around what they say in private, the people with whom they’re communicating, their physical location, and their financial and medical details. Even seemingly banal conversations need to be protected because of what they could reveal, and such people should put significant thought into their communication habits and tools.

But most people and most topics don’t require strict privacy. We prefer it—we don’t want an email thread organizing dinner next week to be published for the world to see or even have it read by someone it wasn’t intended for, no matter how mundane it might be. For everyday communications, existing digital tools already provide sufficient privacy, and the consequences of any of that data being revealed are nil.

Yet, even those of us who are not high-value targets regularly need to share information that could damage our psyches, relationships, careers, or finances if it were to fall into the wrong hands or be publicly posted. Passwords are perhaps the most obvious—the entire point of them is that they’re secret, so if you have to share one, you want to make sure that only the intended recipient can access it. Once someone has a password, they may be able to view, extract, and modify all sorts of information related to you.

Protecting other kinds of data can be more challenging if they cross accounts and systems. Financial information ranks high on the list. You willingly provide your credit card information to e-commerce sites because you know—or at least expect—that they provide secure HTTPS connections and store the information with the care it deserves. But emailing your credit card details to reserve a restaurant for a group dinner feels deeply wrong. It’s probably fine most of the time, but you have no idea who can access the restaurant’s email account or if they’ll delete the message after moving the data to their payment system.

Other scenarios may involve sharing broader financial information such as bank account details, tax preparation materials, retirement planning sheets, etc. You don’t have to be attempting to hide assets to be uncomfortable with people you don’t know examining your assets, knowing your account numbers, and discovering other details. Whatever you think about Hunter Biden, imagine what it would be like to have the contents of your laptop extracted and displayed for all the world to see.

Then there’s health-related information. We might gripe about our aches and pains at a cocktail party but be legitimately concerned about transmitting documents relating to mental health or chronic illness through insecure channels. While it sounds quaint to talk about rivals and enemies, people face challenges in divorce, at work, and in competitive environments where exposure of private health information could be damaging.

Data at Rest and in Transit

What should you do when faced with the need to share sensitive information over the Internet? The answer depends on the nature of the information you’re sharing, the systems available to you, and the technical capabilities of the recipient. Curious about others’ approaches, I started a discussion on TidBITS Talk that generated lots of helpful advice.

Before I delve into the possibilities, consider how the information you’re sending will be protected in transit and when it’s at rest at the source and destination:

• In transit: To ensure security in transit and prevent eavesdropping, focus on communication channels that are encrypted between you and a destination.
  • Between your app and a server: Nearly all the apps we use to connect to Internet services rely on SSL/TLS to protect connections. Such connections include both any kind of account-based resource (anywhere you maintain files or information of your own) and most information-based services (like a newspaper website). A lock in a Web browser’s address bar before a domain indicates HTTPS. You can also press Command-L in any browser and look for https at the start of the URL.
  • End-to-end encryption: Better yet is end-to-end encryption, which ensures that not even the organization managing the service can decrypt the traffic. Encryption keys are specific to you and often locked away within each of your devices. iMessage (blue-bubble conversations in Apple’s Messages app), WhatsApp (in some configurations), and Signal (in all versions) are end-to-end encrypted. Most or nearly all of your iCloud data is also end-to-end encrypted, depending on whether you’ve enabled Advanced Data Protection (see “Apple’s Advanced Data Protection Gives You More Keys to iCloud Data,” 8 December 2022). Chat systems like Slack are encrypted, but not usually end-to-end encrypted, so your data is protected from eavesdroppers but not from employees of the service or server administrators. SMS messages (green-bubble conversation in Messages) are not encrypted at all.
• At rest: Data is considered at rest when it’s stored at a destination, like an SSD on your computer, your and your correspondent’s mail servers, or a cloud storage service’s data center. Many services encrypt data at rest, though I don’t believe that’s common with IMAP email. Regardless, if an account is compromised, at-rest encryption is largely irrelevant. There are two ways of dealing with this concern:
  • Per-file or per-message encryption: You could encrypt the data before sending so it can’t be decrypted without a password you set. This prevents someone who hijacks an email account or cloud storage account from gleaning valuable details from its content. To protect data like this, you must send the password to the recipient out-of-band: use a completely different communications channel, like a phone call or end-to-end encrypted chat. That way, someone who could access an encrypted file attachment in Gmail can’t also access the password sent in Messages.
  • Time- or use-expiration: If you’re concerned about a file residing for an extended period somewhere, regardless of the likelihood that might be stolen, you could instead send a link to the information that expires after a short time. That drastically shrinks the window during which a breach could happen. Some services can also send links that can be accessed only a set number of times, rendering them useless afterward.

Solutions for Sharing Information Securely

Combining all this into a specific solution requires that you put thought into four areas:

• Audience: Who are you sharing with, and what are their technical capabilities? Email doesn’t reliably offer the protection of encryption in transit or at rest unless you require your recipients to opt into a security system (PGP is the most common)—decades of trying haven’t made that happen broadly yet. Yet email is usually the easiest way to communicate with a technically unsophisticated recipient. Messages is easy and secure, but only when you can rely solely on iMessage, which limits its use to those who use Apple devices. WhatsApp and Signal are also fine, but only if both you and your recipient use them.
• Content: What do you want to share? Sharing a tiny bit of information like a password is different than the overhead of sharing a document, and how you share a document can vary if it can be turned into a PDF versus having to stay in a native format like a spreadsheet.
• Importance: How problematic would it be if the sensitive information you’re sharing fell into the wrong hands? There’s a world of difference between credentials to your retirement account and the password to an account that lets you edit your community center’s WordPress site.
• Persistence: How long does your recipient need the data? Do they need to glance at something and then delete it? Do they need to retain a copy permanently? While you can’t delete files from someone else’s devices, you can make sure the data doesn’t remain accessible in places used for transfers.

Here then are my recommendations:

• Secure service like DocuSign: If you’re working with a doctor, lawyer, accountant, or other professional who needs to receive sensitive information from clients regularly, they’ll often use a secure portal for messages and file transfers. It may be a custom system—many have been developed as solutions for these industries—or they may rely on a broadly available commercial offering, like DocuSign, for uploading confidential documents. Regardless, stick with whatever they require unless you have good reason to believe their IT staff is technically incompetent.
• iMessage/Signal/WhatsApp: When sharing something sensitive, there’s nothing wrong with using Messages with iMessage or an equivalently secure service like Signal or WhatsApp. (Read up on WhatsApp to ensure you aren’t exposing chat archives.) Still, I prefer to use them to share information that isn’t useful on its own. For instance, if you need to send someone a password, give them the login URL and username in email, along with any necessary instructions, but send the password separately in Messages.
• 1ty.me or One-Time Secret self-destructing link: For sending someone a username and password to a non-critical site, I often use 1ty.me or One-Time Secret to create an encrypted link containing the text. I then share that link via email and tell the recipient to open it right away. Once they view the encrypted link, the server deletes the data, and the link self-destructs—it’s dead and can’t be used again. An attacker could eavesdrop on the communication or access the email before it was read, but if the recipient is told that the link has already self-destructed, they would know it has been compromised and could alert me. The odds are very low that anyone not in a high-risk category would ever encounter this. A more likely problem would stem from an email system that scans messages and follows links to protect against malware, causing the link to self-destruct prematurely.
  
• 1Password limited link: When I need to share a password to an account I use, not one created for someone else, I use 1Password’s sharing feature to get a link like what 1ty.me creates. 1Password lets you set an expiration date, limit the link to only those whose email addresses you enter, and cause it to self-destruct after being viewed once. Other password managers may have similar sharing features.
  
• Password-protected PDF: Sharing a sensitive document that could be printed is best done by creating a password-protected PDF. To do that from any app, choose File > Print > PDF > Save As PDF. Click the Security Options button, click “Require password to open document,” and enter a password. Creating a strong password is critical because many online services can remove weak passwords from PDFs. Save the document and share it however you like, but make sure to share the password in a different channel.
  
• Password-protected disk image: For files that aren’t easily turned into a PDF or to share a collection of files, creating a password-protected disk image can work well with Mac users. (Users of other platforms can open Mac disk images, but it may be difficult or require particular software or settings when creating the disk image.) In Disk Utility, create a new compressed disk image (File > New Image > Image from Folder is easiest), choose one of the two options from the Encryption pop-up menu (use 256-bit for more sensitive information), and enter a strong password when prompted. Again, share the password in a different channel.
  
• Password-protected Zip archive: A password-protected Zip archive serves the same purpose as a password-protected disk image and may be easier for someone using Windows or another platform to extract. When downloaded from its website (not the Mac App Store), Keka can create password-protected Zip archives for free; if you make these regularly, look at BetterZip. The fastest approach, however, is to create a password-protected Zip archive on your desktop from the command line. Follow these steps:
  1. 1. Open Terminal.
     2. Type zip -er ~/Desktop/desiredfilename.zip and press the Space bar once.
     3. Drag the file or files you want to share into the Terminal window.
     4. Press Enter.
     5. Enter your desired password and confirm it when prompted. Type carefully; you won’t see the characters you’re entering.
• Cloud storage link that can be expired: I don’t know how widespread this feature is, but some cloud storage services offer the option of a time-expiring link. That would enable you to share a file with someone else while ensuring the link goes away after a specified time to prevent it from being discovered in a breach and used later. Dropbox supports such links if you have a Dropbox Professional account. (Also, I haven’t used Linkly, which looks like a full-featured link-shortening service, but you could theoretically use it to create a time-expiring link that points to a shared file on a cloud storage service.)
  

As you can see, there’s no one-size-fits-all solution when it comes to sharing information securely over the Internet. Whatever your needs are, one of the options above should suffice.