Cyber security

Likelihood: fix the common failures first

Most account takeovers start with ordinary events, not exotic attacks:

• a reused or phished password;
• a SIM swap that redirects text-message codes;
• a convincing call from fake support;
• malware from a download or browser extension that steals saved passwords and signed-in sessions;
• a device that missed its updates.

Severity: protect what resets everything else

Your primary email can reset most of your other passwords, and financial and wallet accounts hold the money. The higher the stakes, the more inconvenience is worth accepting:

• hardware security keys on email and financial accounts;
• a dedicated phone or computer for wallet approvals and large transfers, kept free of email and browsing;
• a second person who must approve large transfers, where your provider offers it.

Reversibility: add layers where losses are final

Card fraud can often be disputed and reversed. A wire or crypto transfer usually can't. Where a loss would be permanent, add protection even against unlikely events:

• a list of approved addresses your account will send to;
• a small test transfer before a large one;
• a delay before large withdrawals go through.

Who carries the risk

A hosted service shifts the running of it, and some of the risk, to the vendor; you then depend on its security, audits and uptime. Running a tool yourself reduces that dependence, though you still rely on the software maker's code and updates, and you become responsible for configuration and backups. Either can be the right choice if the part you take on is actually maintained.

Hosted by the vendor

Your vault is encrypted on your device and synced through the vendor's servers.

• Most likely problem: a breach or an outage at the vendor.
• A serious case: stolen encrypted vaults that attackers try to unlock offline by guessing master passwords, plus any details the vendor doesn't encrypt, such as saved website addresses.
• What reduces it: a vendor that publishes independent audits and says which fields it encrypts, and a long, unique master passphrase.

Self-hosted server

You run a compatible server yourself and use the regular apps.

• Most likely problem: the server falls behind on security updates, or is misconfigured.
• A serious case: a compromised server, which exposes the same encrypted vaults to offline guessing, or lost data if backups fail.
• What reduces it: prompt updates, admin pages kept off the open internet, required two-factor sign-in, a long master passphrase, and backups held elsewhere that you have actually restored.

Local encrypted file

The vault is a single encrypted file, often synced through your own cloud storage.

• Most likely problem: a sync conflict, a corrupted file or a lost device that leaves you without a good copy.
• A serious case: someone copies the file, from the cloud account or from any synced device, and guesses offline. How hard that is depends on the master password and on the app's settings that slow down each guess.
• What reduces it: a long master passphrase, a key file or hardware key if the app supports one, two-factor sign-in on the cloud account, and versioned backups. Two-factor on the cloud account protects only the cloud copy, not the file itself.

What usually matters more than the product

How you use a reputable manager usually matters more than which one you pick. Going without one usually means reusing passwords, so one breach can expose every account that shares one. Whichever you choose:

• a unique master passphrase;
• two-factor sign-in on the account that holds the vault;
• no plaintext seed phrase in it, and never a wallet backup stored together with its decryption secret (see onchain security);
• a plan for how someone you trust would get in if you can't.

• Onchain and crypto security

Use a password manager

A password manager lets you use a long, different password for every account. If one site is breached, your other accounts are unaffected.

• Protect it with a long master passphrase you don't use anywhere else, such as five or more random words.
• See the example above for how the hosted, self-hosted and local-file designs compare.

Prefer passkeys, then app or hardware codes

Passkeys and hardware security keys resist phishing because they only work on the real website. Authenticator apps are next best. Text-message codes are the weakest option, because a SIM swap redirects them.

• Turn on the strongest option each account offers, starting with email, banking, brokerage, exchange and wallet accounts.
• Save the backup codes in your password manager.

Secure your primary email first

Whoever controls your email can reset most of your other passwords.

• Give it a unique password and a passkey or security key.
• Review its recovery phone number and recovery email.
• Check for forwarding rules you didn't create. Attackers add them to read your mail quietly.

Treat security questions as passwords

Answers such as a pet's name, a school or a street are often findable online. Use random answers, and store them in your password manager.

Lock your phone number

Ask your mobile carrier to protect the number itself.

• Set an account PIN with your carrier, separate from your phone's passcode.
• Turn on the carrier's number-lock or port-out protection.
• Together these make a SIM swap much harder: someone moving your number to their own phone to receive your codes. No carrier control is perfect, so keep text-message codes off your most important accounts.

Keep devices updated and locked

Turn on automatic updates for the operating system, browser and apps.

• Use a passcode of six or more digits, or an alphanumeric one, with biometric unlock.
• Turn on device encryption (FileVault on Mac; BitLocker or Device Encryption on Windows).
• Turn on Find My or Find My Device, so a lost device can be locked or erased remotely.

Install less

Every app and browser extension can read something.

• Install software only from the official app store or the vendor's own website, reached by typing the address yourself.
• Remove apps and extensions you no longer use.
• Don't install software sent to you in a message, even from someone you know.

Use a dedicated device for high-value accounts

For large balances or wallet approvals, consider a separate phone or computer used only for those accounts.

• Keep email, social media and everyday browsing off it.
• A new computer bought directly from the manufacturer is the cleanest start. Fully erasing and reinstalling a used one removes most risks, but can't rule out tampering below the operating system, in firmware or hardware.

• Onchain and crypto security

At home

Your router protects everything connected to it.

• Use WPA3, or WPA2 with AES.
• Change the router's default admin password, and keep its firmware updated. Replace a router that no longer receives updates.
• Put smart-home devices and guests on a separate guest network.

Away from home

Avoid signing in to financial accounts or approving transactions on public or hotel Wi-Fi. Your phone's own hotspot or cellular data is safer. If you must use an untrusted network, use a reputable VPN.

Back up what you can't replace

Keep important documents and photos in at least two places, one of them offline or in a separate account. Ransomware and account lockouts are much less damaging when a clean copy exists.

Plan for someone else to step in

Write down where your accounts are and how a trusted person would reach them, and keep it somewhere secure. Many providers, including Apple and Google, offer legacy-contact or inactive-account settings for this.