Hygiene 101 of Digital: A Blueprint for Passwords, Two-Factor Authentication and Scam Protection

With your personal information, money, and business entangled together in the world wide web, it is impossible to ignore the significance of cybersecurity. Not many breaches take place because of any attacks on the system like what you see in Hollywood movies; rather, most of them occur due to manipulation of your human psychology and basic mistakes.

Developing good digital hygiene does not mean being paranoid; it means implementing some basic practices that will render any attempts to target you as pointless and wasteful for the attacker. And here’s how to start.

1. The Foundation: Password Managers and Zero-Knowledge Security
It is difficult to imagine an average user of the internet who has only a few online accounts – typically, there are dozens and even hundreds of them. It is not possible to memorize hundreds of different and randomized passwords, consisting of 16 or more characters. As a result, the majority of users opt for one of two major security problems:

<> Using the same password for all accounts.

<> Adding a digit or another symbol to the previous password.

If there is any problem with the third party service, bots start trying all such variations on all websites (email, bank account, cloud storage, etc.).

The Solution: Password Manager
Instead of relying on human memory and using cryptography, special password manager (such as Bitwarden, 1Password or KeePass) performs the following functions:

<> Master Key: All that you should memorize is a single strong password, which can be created with a help of several random words, like 'orbit-blanket-copper-whistle'.

<> Password Complexity: Software automatically generates a unique and complex password for each account.

<> Phishing Protection: Each password manager checks the name of the domain on a web browser and refuses to auto-fill any suspicious website.


2. Two-Factor Authentication (2FA): Go Beyond SMS
Password authentication involves something you know. With 2FA, there is added security layer which can be either something you have (device or token) or something you are (biometric).


SMS based 2FA (still better but vulnerable):
A code sent through text messages to your cell phone can easily become a victim to SIM swapping (in which case an attacker makes the mobile operator redirect your phone number to his/her phone number) or interception.

Authenticator apps (ideal standard):
An authentication app like Google Authenticator, Aegis or 2FAS creates Time-based One-Time Passwords (TOTP). These expire in 30 seconds and thus are immune to any cellular attacks.

Hardware security keys (best practice):
FIDO2/WebAuthn hardware keys (like YubiKeys) connect to your device using physical means or Near Field Communication (NFC). These bind your login token to the URL of the website. Hence remote phishing becomes technically impossible.

Task: Enable 2FA on your anchor accounts – primarily your main email account (since this helps you reset passwords of all other accounts), banking sites, and cloud backups.

3. Detecting Phishing and Social Engineering
While technology prevents technological attacks, social engineering manipulates your psychological triggers such as fear, urgency, curiosity or authority figures. The attackers create situations that make you react without engaging your rational mind.

Some Common Signs To Be Aware Of:
False Sense of Urgency: “Your account will be suspended in 2 hours” or “Unrecognized transaction made, click here to resolve the issue”.

Impersonation of Authority Figures: Pretentious messages that come from your CEO, IT team, banking fraud prevention team or even government tax departments.

Typosquatting: Email addresses or URL links that look familiar but have some typographical errors (micros0ft.com or paypaI.com where capital ‘i’ is used instead of ‘l’).

Defensive Practices That Actually Work:
Bust the Urgency Cycle: Always hesitate when you receive a message that asks you to take immediate action. The bad guys know how to induce fear and use it to short-circuit common sense.

Handle Out-of-Band Requests: Never click on any verification link or dial any number that came through a notification that you have not requested yourself. Instead, launch a new web browser, go to the service provider's official website, or dial the customer service number on your credit card.

Trust No Internal Requests: In case you get a request from an executive or a co-worker asking you to send some money, buy gift cards, or provide sensitive files, always verify such requests using a secondary form of communication.

The Minimalist To-Do List
In order to significantly increase your safety right away, follow these three rules:

<> Get a password manager and let it create a random password for your email account.

<> Activate two-factor authentication on apps for your main email, cloud storage, and financial accounts.

<> Be skeptical: Assume that all urgent messages are scams unless proven otherwise.