Digital security for normal people

You are a target — just not personally

Almost nobody gets hacked by a genius who chose them. You get hacked by automation: a password leaked from some forum in 2019 gets tried against your email, your bank, and your Amazon login by a script testing millions of accounts an hour. That is credential stuffing, and it works because people reuse passwords. Phishing runs the same economics — a million emails cost the attacker nothing, so a 0.1% click rate pays the bills. The attacks are industrial, not personal, and that tells you the defense: be more expensive to crack than the next account, and the automation moves on.

One semi-targeted attack is worth knowing by name: the SIM swap. An attacker convinces your carrier to move your phone number onto their SIM, and from that moment YOUR text messages — including login codes — arrive on THEIR phone. More on why that matters below.

One scope note: our off-grid networking guide covers mesh radios and comms when the towers are gone. This guide is the other half — keeping the accounts, devices, and home network you use every day out of other people's hands.

One password per site, and let software remember them

Credential stuffing only works when a password is reused, so the fix is structural: a unique random password for every site, stored in a password manager. You memorize one strong passphrase; the manager generates and fills the rest. This is not a power-user move — it is the baseline, and the built-in managers in modern browsers and phones are good enough to start today.

Passkeys are the next step and worth adopting wherever offered: instead of a password, your device holds a cryptographic key that only answers the real site. There is nothing to reuse, nothing to leak in a breach, and nothing a fake login page can steal — which quietly kills the two biggest attacks at once.

MFA: the app beats the text

Multi-factor authentication means a login needs something beyond the password, and any MFA beats none. But the flavors are not equal. SMS codes travel through your phone NUMBER, and a SIM swap steals the number without ever touching your phone. An authenticator app generates codes on the device itself — the secret never rides the carrier network, so there is nothing for a SIM swap to intercept.

The priority order: turn on MFA everywhere money or email lives, prefer an authenticator app (or a passkey) over SMS, and protect your primary email account hardest of all — it is the reset button for everything else you own.

Phishing: urgency plus a login page equals stop

Phishing works by borrowing a real company's look and adding manufactured pressure — your account is locked, your package is held, your boss needs gift cards NOW. Urgency is the mechanism: it is there to make you act before you think. The reliable tell is the combination — a message that both demands speed AND wants you to log in or pay.

• The rule that beats all of it: never log in through a link someone sent you. Open the app or type the address yourself.
• Real companies survive you taking ten minutes. Pressure to act immediately is the attacker's signature, not the bank's.
• A voice on the phone claiming to be your bank gets the same treatment: hang up, call the number on your card.
• Fell for one? Change that password NOW, from a device you trust, and turn on MFA. Speed of response matters more than embarrassment.

Your home network, hardened in an afternoon

The router is the front door for everything in your house, and most people never touch it after setup. The afternoon checklist:

• Update the router firmware, and turn on auto-update if it exists. Old routers carry known, published holes that scanners probe for constantly.
• Change the admin password from the default. Default credentials are in public lists; a factory-password router is an unlocked door.
• Use WPA2 or WPA3 with a long Wi-Fi passphrase. If the router is old enough that it can't, the router is the thing to replace.
• Put smart-home gadgets on the guest network. A $20 bulb gets security patches for a year and lives in your house for ten — isolation means a compromised gadget can see the internet but not your laptop.
• A prosumer setup (UniFi and similar) buys you the same ideas with better tooling: real network separation by VLAN, visibility into what every device is talking to, and gear that actually receives updates for years. Nice, not necessary — the checklist above is 80% of the value.

Updates are the single highest-value habit

Almost every mass compromise exploits a hole that was already patched — the victims were just running last year's software. An update is the vendor closing a door attackers already know about, which means delaying updates is choosing to leave it open. Turn on automatic updates for your phone, computer, browser, and router, and let reboots happen. It is the least glamorous habit in security and it outperforms every gadget in this guide.

Backups: the 3-2-1 rule

Ransomware, theft, house fire, and a failed drive all become the same minor event if your data exists somewhere else. The standard is 3-2-1: three copies of anything that matters, on two different kinds of storage, with one copy offsite (cloud counts). An automatic cloud backup plus an occasional external drive gets you there. The mechanism matters against ransomware specifically: an attacker who encrypts your files can't encrypt the copy that isn't connected. Test a restore once — a backup you've never restored from is a hope, not a plan.

What you post is a pattern

Privacy hygiene is the digital version of not advertising. Your public posts aggregate: the gym check-ins map your schedule, the vacation photos announce an empty house in real time, the gear photos tell a burglar exactly what is inside it. None of these matter alone — the PATTERN is the leak, and attackers (and plain old thieves) read patterns.

The fixes are boring and effective: post the trip after you're home, keep accounts that show your daily rhythm private, and strip location data from photos before sharing. This is grey man thinking applied to your feed — our grey man guide covers the in-person half.