Personal Cyber Security CHECKLIST — part 2

Authentication (verifying user identity) & Passwords Continuation of the checklist. A few of you reached out with extra tips, thanks! I'll add them gradually and then publish the whole thing as an e-book.

1. Use a long, strong, unique password for every account — find out how strong your password is *1.
2. I'm not in favour of frequent password changes if your passwords are unique, long, and ideally protected by two-factor authentication. Change passwords immediately if you suspect a leak.
3. Use a secure password manager to encrypt, store, and fill credentials — for example BitWarden or KeePass / KeePassXC. I'll leave it up to you whether you trust passwords to a cloud service or use a solution fully under your control. One thing is certain: without a password manager you can't manage this *2.
4. Don't store passwords in the browser.
5. Subscribe to leak alerts and update passwords on compromised accounts *4.
6. Enable two-factor authentication where available, and use an authenticator app or hardware token (e.g. YubiKey). You can use Google Authenticator, Microsoft Authenticator, or pick an open-source one *5.
7. When you enable MFA, you'll usually get backup codes. Store them ideally on paper or securely offline (a disk in a safe). I wouldn't store them in the password manager.
8. If you use a PIN instead of a password, avoid 4-digit numeric codes. People love to use their birth year :-).
9. Don't sign in on someone else's device. If you have to, use private/incognito mode (Ctrl+Shift+N / Cmd+Shift+N).
10. Never answer security questions truthfully (mother's name, birthdate, etc.). Ideally don't use this feature at all.
11. Watch out — when you enter a password, is a camera filming you?