Personal security hygiene

• Keep your software up to date. If you get pwned by a 0-day, that’s kinda cool. If you get pwned by a known vulnerability, that’s pretty embarrassing. Make sure the programs you use (whether on mobile, desktop, Apple Vision Pro, etc.) have all the latest patches.

• Don’t click random links. Unless you’re a big, big deal, it’s unlikely that an attacker will waste their million-dollar Chromium bug on hacking your computer from a web page. But websites can still

  • download files onto your computer,
  • exploit bugs in other online services you use, and
  • track you around the web.

  Better to stay safe and private.

Password managers and multi-factor authentication

• Securely being on the internet—where you’re bound to have many accounts on many services—is completely infeasible without a password manager, like 1Password or Bitwarden. This is because passwords…
  • …need to be high-entropy. They should be random and long.
  • …cannot be reused. If my email password is used somewhere else, and it gets hacked, then both accounts might be compromised! Trivial differences (like “samepassword-google” and “samepassword-twitter”) are not enough.
• Letting passwords be a single point of failure is not a good idea.
  • DO USE TOTP ****with Google / Microsoft Authenticator, Authy, etc.
  • DO USE **(prefer, even!) ****Hardware authentication devices like Yubikey, Titan, etc.
  • AVOID using SMS-based 2FA, because of SIM swapping attacks.
  • AVOID using the TOTP from inside your password manager, unless your password manager also has MFA. This might be a hot take, but storing your authentication codes next to your passwords turns 2FA into 1FA.

Email

• Use a reputable email provider: Gmail, Outlook, and Proton Mail all are good choices. Don’t use a self-hosted Roundcube.
• Make sure that your emails aren’t being forwarded to an unknown address. Check here for Gmail, here for Outlook, and here for Proton Mail.
• As always, enable secure MFA on your email account. It’s likely that nearly all your accounts rely primarily on your email, so if your email gets compromised, everything else will, too.

Twitter

• Many, many Twitter accounts have been compromised due to SIM swap attacks and a lack of MFA. Make sure to protect your Twitter account by
  • removing your phone number from your Twitter account,
  • enabling (non-SMS!) MFA,
  • revoking permissions from unnecessary applications,
  • revoking unnecessary delegated access, and
  • enabling password reset protection.
• For more details about why these protections are important, check out this page from the DeFi Security Alliance: Twitter Security Self-Audit

Telegram

• For the associated phone number, prefer carriers like Google Fi, Verizon, Efani, who have good track records when it comes to SIM swapping. Conversely, avoid providers that historically have SIM swapping issues (like T-Mobile) and VoIP in general.
• Enable two-step verification. By default, Telegram handles login by texting a one-time code to the associated phone number. Adding a password can improve your security posture.
• Maintain separate accounts for work and personal use. If you have employees, require them to do this.
• This is less security-related, but Telegram has a tendency to randomly ban accounts. Purchasing Telegram premium for a few dollars a month tends to prevent these issues.

Discord

• Require MFA for moderators and admins. The sanctity of #announcements depends on the security of your weakest link.

  Here’s where they’ve currently put the switch.