10 Simple Changes to Improve Your Digital Privacy

Most online security guides are written for people who have a team of system administrators. After all, you’re just one person with a phone and a couple of dozen accounts, so you want something brief. These ten suggestions have been culled from the most helpful resources, and represent relatively simple changes with the most impact. None of them require technical expertise, and the first three can be accomplished in an afternoon.

1. Use a password manager

If you can remember it, it’s not a good password. The problem with remembering passwords is that you tend to reuse them, because coming up with something new that you can remember is a pain. If one of your accounts is compromised, the bad guys will try the same username/password on your other accounts. A password manager solves this by generating a long, random string of letters and numbers for every account, which you only need to remember for the master password. Bitwarden, 1Password, and your browser or phone OS all have built in password managers. Just pick one and stick with it.

2. Enable two-factor authentication

Start with your email, since compromising that gives access to most of your other accounts. Then enable it for your bank, cellular provider, and any other accounts that have a card linked to them. An authenticator app is more secure than SMS, which can be redirected if the attacker convinces your cell carrier to port your number to their phone. SMS is better than nothing, though, so don’t put it off while you wait to set up the authenticator app.

3. Check if your email has been breached

Go to haveibeenpwned.com and enter your email address. This site will tell you which breaches contain your email address. If you have any accounts that have the same email, you should change their passwords as well, especially if you reused a password. You’ll probably find some information here that you weren’t aware of; I know I always do.

4. Think twice before clicking on links or opening attachments

Phishing works because you’re being tricked into giving up information; you’re never being asked directly for money or personal information. Common examples include “your ‘gift card’ is about to expire”, “you need to empty your bank account or the IRS will sue you”, and “your boss is requesting a reimbursement via Venmo”. If it’s an urgent request, that’s a red flag; respond politely but ask them to clarify via the company email or app. The same goes for “you have a toll tag violation” texts that ask you to open a link. Use the app or website directly, or type it in rather than using a provided link.

5. Keep your devices updated

Software updates are annoying, but that’s a deliberate choice. Your updates often include crucial security fixes that roll out after vulnerabilities are discovered. Enable auto-updates for your smartphone, computer, and browser, then go about your day.

6. Limit the information you share publicly

Birthdays, hometowns, pets, and mother’s maiden names are potential answers to security questions, and many people post this information online without thinking. Go through all your social media accounts and make them private, then adjust your settings so only your friends can see your future posts. You may also want to avoid sharing things like your birthday, or photos of your boarding pass or hotel room.

7. Freeze your credit

In the United States, this is a must for anybody who’s the slightest bit concerned about their privacy. It prevents identity thieves from opening credit cards, applying for loans, and taking other actions in your name. You’ll need to contact all three of the credit agencies, but it only take about ten minutes per call. The freeze is permanent until you lift it, which you can do when you apply for credit yourself.

8. Be careful about the permissions you give to apps

If it’s not necessary for the app to access your social media accounts, disable it. Remove permissions for apps that you no longer use, and try to limit the number of apps on your phone. A permission like “contacts” might seem innocuous for a flashlight app, but it’s a way for the app to gather information about you.

9. Get a separate email address

Use your “secure” email for anything that requires signing up with an email in exchange for a discount, newsletter, or some other information. This keeps your primary email address cleaner and less likely to be found in breach databases. Some email services allow you to create “aliases” that forward to your primary address but appear on breaches as the alias instead. Gmail, Outlook, and ProtonMail all offer similar services and can be used for this.

10. Be careful about unsecured public networks

Most airports, cafes, and other public places have free Wi-Fi. It’s generally safe to browse the web on these networks, since most traffic is encrypted. That doesn’t include banking and other sensitive information though, so avoid checking emails or making purchases over a public network. Your phone’s hotspot or a trustworthy VPN is a safer option. Avoid networks that have a suspicious name or no password if you expect a password.

Advice you can ignore

Changing your password every 90 days is old security advice. According to the National Institute of Standards and Technology (NIST), the US government’s security agency, you should only change your password when it has been compromised. Incognito mode only prevents your browser from saving cookies; you can still be tracked if you log into a website. The same goes if you use your cell carrier’s DNS or another service like Google. You don’t need a premium antivirus subscription to maintain good security as long as you have built in OS protections (Windows Security or macOS Defender) and you keep your software up to date. You should also avoid downloading potentially malicious software in the first place.

FAQ

Is a password manager secure?

Yes, as long as you use a strong password and enable two factor authentication, which most password managers support. Reputable managers also use encryption to protect the information stored, so the only person who can access it is you. It’s always a good idea to enable two factor authentication for your password manager.

What should I do if I find my information has been compromised?

Change the password for that account, and any other account that used it if you reused it. Enable two factor authentication for those accounts, as well. Keep an eye on your bank accounts for fraudulent charges, and cancel any credit cards if necessary. If the breach involved your social security number, place a fraud alert with the credit bureaus or freeze your credit.

Do I need a VPN?

While a virtual private network (VPN) does provide additional security, you don’t need one for day to day browsing. A VPN encrypts your traffic and hides it from prying eyes, like your internet service provider. It can be useful on a public network or for avoiding geo-restriction, but it doesn’t make you anonymous online, and free ones may sell your information. If you do use a VPN, try a paid provider with a good reputation.

How can I identify a scam?

Scams work by frightening you or tricking you into giving away money or information. They may threaten you if you don’t click on a link or call a number, or claim to be from a bank or governmental agency and ask you to transfer money. Don’t click on any links in the message, and instead go to the website or call the number for the organization directly. You can always look up the phone number on your cell carrier’s website or the company website itself.

What should I do if I’m a victim of identity theft?

Report it to identitytheft.gov in the United States, which contains a detailed recovery plan. Place a fraud alert or freeze with the credit bureaus and change the passwords for your accounts as soon as possible. Report it to your banks as well.

Start with the first three steps. Pick a password manager, enable two factor authentication for your email, then check if your email has been compromised. That should take about an hour and address most of the security concerns.