7 easy steps to beef up your personal cyber security

You have to take care of your cyber security to keep everything you do online safe. Here are some easy, basic steps.

This is you after you read and implemented this guide.

Hey everyone, thank you so much for the positive feedback so far. I started this weekly newsletter purely for myself, to keep “showing up” every week, to have an outlet for whatever is on my mind. I don’t have a goal for this project other than to publish a weekly newsletter around stuff I care about. If you have any feedback, recommendations, or wishes whatsoever, don’t hesitate to reply to this email or reach out to me via Twitter. Thank you, and have a great rest of the week!

Raphael

In terms of securing your online presence, you can go the extra mile, like putting your whole home network behind a VPN or setting up decoy addresses and accounts (you can find links about this stuff at the end of this newsletter). But that’s not what I want you to know here. With scams, phishing etc., on the rise, it’s crucial for anyone using the Internet to be aware of the dangers and take steps to protect themselves. So here’s a list of things anyone can pull off and implement, no matter the tech-savviness.

1. Use random passwords

The two most important rules: Always use random passwords and never use the same password twice. The biggest threat for your life online is to use two or - even worse - one password for each service. It also doesn’t help to have slight variations (classic example: passwordemail, passwordtwitter, etc.). So how do you manage to remember dozens or even hundreds of random passwords? The answer is: You don’t. That’s because you use an open-source password manager like Bitwarden (I recommend the paid option). More advanced users can go with the free, open-source password manager KeePassXC, which is less user-friendly than Bitwarden but more versatile. With those password managers, you need to remember one master password (which should be solid and random as well … this is the one password you must memorise).

2. Activate 2FA everywhere

The most essential and fundamental step to make your life online more secure is to activate Two-Factor-Authentication (2FA) wherever you can. In simple terms, it’s another layer you add to your password for each service you use. Use Google Authenticator or Authy on your smartphone, write down backup codes by hand and store them somewhere safe. And by the way: Never use text messages for 2FA as your SIM card is an attack vector (via SIM swaps). The only exception is when text messages are the only option, and then you should still activate text message 2FA.

3. Get a Yubikey

Unlike using a 2FA app like Google Authenticator or Authy, this is not free. Yubikeys are made by the Swedish company Yubico, and they are 100% worth their money. The concept is simple: You can activate a Yubikey as an additional layer of security (just like 2FA above) for services like password managers, your Google account, cryptocurrency exchanges and more. You can find a complete list of supported services on their website. Personal recommendation: Order two YubiKey 5 NFC directly in the Yubico shop (NFC is important also to be able to use it with your Smartphone). Activate both wherever you can, put one on your keychain and store the second one in a safe place if you lose the one on your keychain.

4. Enroll in Google’s Advanced Protection

Privacy die-hard fans probably disagree here, but I like using Google’s services. For me and probably most people, their Google account represents a huge chunk of their lives: emails, calendars, documents and pictures in the cloud, and more. So imagine how hard it would suck if this accountgott hacked by an attacker. Luckily, Google does not only offer regular 2FA but also has an “Advanced Protection Program”.  It’s completely free, and I strongly recommend activating it (as long as you use Google services as heavily as I do). As a security key, you can either use your smartphone or your YubiKey (I recommend the Yubikey).

5. Get a hardware wallet

This is pretty much a no-brainer for anyone investing in Bitcoin, but you should get a hardware wallet. I recommend Trezor, and as with the YubiKey, you should order it directly in the official store. Both models are great, and the Model T offers some additional features like FIDO2-compatibility, which means that it could also be used as a YubiKey substitute.

6. Make yourself familiar with common scams

You for sure have heard of the “Nigerian prince scam”, aka the advance-fee scam. The basic idea is that someone has a lot of money for you, but you need to give them some money in advance to get it. This is just one example, and there are countless variations and other methods aiming to scam money out of other people (often older people). Unfortunately, the only actual countermeasure is to educate yourself and your family and friends on this stuff. Ideally, by reading up on how those scams can look like. I recommend checking official sources or watching some YouTube videos, especially in your language or region.

7. Cultivate a healthy sense of paranoia

This is something you can’t implement on a technical level. As the Internet and its services grow and develop, so do criminals and scammers who try to exploit people’s goodwill and/or naivety. In addition to the tip above, you should educate yourself and practice a healthy sense of paranoia.

Here’s where you can dig deeper:

• Get a copy of Michael Bazzell’s excellent book Extreme Privacy. He also hosts a weekly podcast. The steps he describes and recommends are way more extreme (hence the book’s title) than the stuff I suggested above. But it’s still interesting to see what you could do to take it to the next level.

• Read Nathaniel Popper’s NYT article on how a Bitcoin Evangelist disappeared. This is an interesting article on which steps you could take to disappear as an individual literally. Again I see it more as an inspiration and less as an actual manual.

Like what you read? Send this newsletter to a friend, subscribe (if you haven’t yet) and follow me on Twitter. 

Photo by Josh Rakower on Unsplash.