Easy-to-follow "cookbook" of security tips you can apply in < 60 seconds:

🔒 Password Reuse

Many people reuse passwords across multiple services. When one service suffers a data breach, attackers can test the leaked credentials on other sites, gaining access to additional accounts. Stolen login data often sells for $6 on the dark web. You can check if your information has appeared in a leak by visiting Have I Been Pwned.

🥷 Guessable Passwords

Humans tend to choose passwords that are not truly random. Attackers often rely on common password lists, such as rockyou.txt. This technique that doesn’t require sophisticated hacking tools—just patience and a large dictionary of frequently used passwords.

🛠️ Less Secure Methods of Two-Factor Authentication

While two-factor authentication (2FA) is essential, not all 2FA methods are equally secure. In fact, the Cybersecurity & Infrastructure Security Agency explicitly advises against using SMS-based 2FA because it can be intercepted via SIM swapping, SS7 exploits, and sophisticated phishing methods. Researchers from Google found that SMS-based 2FA only provides about 76% protection against targeted attacks.

💻 Outdated Software

Hackers regularly exploit known vulnerabilities in software that hasn’t been updated. This includes operating systems, web browsers, and even plugins or extensions. Once a vulnerability becomes public, cybercriminals quickly incorporate it into their toolkits.

🔑 Lack of Compartmentalization

Compartmentalization means spreading your security across multiple, independent “boxes.” The lack of compartmentalization in practice—the trend of storing passwords and two-factor authentication (2FA) codes within the same password manager, essentially putting all your eggs in one basket—can create a single point of failure.

📱 Insecure Mobile Apps

Downloading apps from unofficial sources—or skipping vital software updates—creates opportunities for cybercriminals to infiltrate your device. Malicious apps can quietly harvest credentials and personal data.

🛡️ Weak Security Questions and Recovery Options

Many account recovery processes rely on easily guessed security questions or secondary email addresses—information that can sometimes be found on social media. If these methods are weak, hackers can reset passwords and take over your accounts.