I wrote You Are Wrong About Your Stupid Account about eight years ago, and since then I have had more than a few friends use it as a guide to upgrade their account security, although a few of them turned to the posting after an exploit that could have been prevented. The world has changed a bit, and I thought it was time to post an update to address some of the newer attacks and ways to protect yourself from them.
If you just can’t make it through 1,194 words and are quitting here, the most important thing is protecting your email account and your phone number. These are usually easy pathways exploiting your other accounts, so invest in keeping them secure.
I start with the new things and then cover updates from the original (which is still a good posting and very relevant today, so check it out if you want more the basics of account security and more context for this update).
Bank and Credit Card Locking
The financial cards you keep in your wallet (Visa, ATM) almost always have a mobile app you can use to manage your account. One of the nicer features a lot of these apps offer is the ability to lock your card, effectively disabling all new transactions on it until you unlock the card, and this is generally instantaneous. So, if you’re like me and go to the ATM once every eight months, you can get extra security by locking these infrequently-used accounts until you need them.
Locking your cards can be particularly comforting if you’ve ever needed to use a sketchy ATM or worry about card skimmers… if your card number and code are stolen, it becomes relatively useless to the attacker.
Finally, most of these apps also offer the ability to add notifications to transactions, so turning this on for all transactions is a great way to detect unauthorized access on your account, which is later that ideal, but catching it fast minimizes the impact.
Phone SIM Protection
Unfortunately a lot of the technology that powers our cell phone systems was created when the world was a much different place, and the use cases were quite different. As a result, there are some exploitable aspects of the systems, like the ability to fraudulently take over someones phone number by having the carrier point it to a different device (SIM swapping). The SIM (Subscriber Identity Module) is basically an ID for your phone and these started off as physical chips, although a lot of phones now generate a Soft SIM (aka Virtual SIM) in software, no chip needed. If a carrier associates your phone number with a different SIM, your calls and text messages now go to the device with that SIM, and this exploit is more common than it really should be.
Most carriers offer some form of protection from this… Verizon and Google Fi refer to this as “Number Lock”, and it prevents the port or transfer of your number. Any popular carrier likely offers the same functionality… turn this on. Really. Really really.
The big risk here is your phone number is often associated as a way to reset your accounts, and in some cases, your phone number is your account, so an attacker taking over your number not only provides pathways to taking over your accounts, at the same time you will be blocked from recovering your accounts. Lock this down.
Note: to make this a little more confusing, many phones offer “SIM lock” on the phone (not from the carrier), which requires a code to enable usage of the SIM (e.g. connect to network, make calls, text). “SIM lock” does not protect you from SIM swapping, other than possible somebody stealing your physical SIM card. You probably do not want to turn this on.
Password Manager Update
Password managers continue to be great, although I’m a little more opinionated on which password manager to use, and generally recommend 1Password. While all password managers mostly do the same thing (you have a master password to get to all of your complex, impossible to remember passwords), that master password can be the achilles heel if anyone is able to get access. And here is where 1Password stands out… for a new device (computer, phone, tablet) to access your 1Password account, it needs to have a key that is only accessible from your unlocked account. So even if your credentials fall into malicious hands, they still can’t access your passwords.
1Password works across websites and mobile apps quite nicely, and also has pretty good group accounts and family plans, making it easy to share specific accounts with the family for things like Netflix, so that everyone has access when one person makes a password change.
One thing I am mixed on is 1Password also offering 2FA (two-factor authentication) on your accounts that support it. While this is very convenient, the whole point of 2FA is requiring two things to access your account (generally, something you know and something you have). If using both password and 2FA functionality for an account through 1Password, this reduces the efficacy (although it is still far better than not using 2FA at all). I have found a use case where this is incredibly useful, where I have an account that is password and 2FA and occasionally I need to share access with someone, and 1Password makes it easy to do temporary sharing and this works great. However, other than that use case, I use separate tools for two-factor authentication.
Two-factor Authentication Update
I’m a little shocked that 2FA (two-factor authentication) hasn’t advanced more over the past 8 years. On the bright side, it is far more common to see in sites, and I have seen more sites with sensitive or valuable data require 2FA. However, there is still an overwhelming number of sites, including banks, that only offer SMS for 2FA, where they text a code to your phone. A major problem with this is your phone number can be stolen through SIM swapping, and this can happen from thousands of, miles away, it does not require access to your phone.
I adopted dedicated hardware 2FA for my more critical accounts (email, password manager, financial). These are generally USB keys that generate the necessary response when challenged, and can be used with computers, phones, tablets, etc. The YubiKey 5C NFC is a good example of one that supports modern authentication protocols and can also tap NFC readers instead of plugging in. The downside of hardware keys is they are slightly less convenient, and you really will want to make sure you have two of them and associate them with each account, so that if you lose your physical key, you have a backup and are not locked out and having to go through a likely time consuming process to recover your account.
For a general purpose 2FA app, I am still a fan of Google Authenticator and it has only gotten better, with huge improvements in migrating to a new phone / device, which was pretty painful before.
Some applications legitimately need elevated permissions to provide the service they offer, like inbox management, automatic scheduling, or even shopping deal comparisons. Many of these apps only access your data in the way necessary to provide the service, but there are many that take full advantage of access to your data and leverage your data for their benefit. According to articles on 
In addition to granting companies access directly, web browser extensions can expose data from every website you visit. These Extensions in Chrome, and Add-Ons, Extensions, and Plugins in Firefox, provide enhanced functionality from password management to page translation, ad blocking, and simple video downloads. To provide these services, many extensions get access to everything you do in the browser. For example, a news feed reader has permission to “Read and change all your data on the websites you visit” – this means every page visited and all content on that page is accessible by the news reader extension… your web mail, your Facebook messages, your dating sites, medical issues you research… all available to some company that organizes news headlines for you.
Installing applications and linked account creation on websites is simpler than ever. The downside to this ease of access is users typically spending little time scrutinizing the application. If you are giving access to your private data, spend the time to understand who is getting access, and how they will use your data. A simple web search for the application and “security” or “trust” can reveal what others experienced. If the company doesn’t have a website with the ability to contact them, and a published policy about handling your private data, there is a good chance securing your private data isn’t a real concern for them, and it should be for you!
Within 24 hours of the breach I started receiving emails that threatened to release the customer data and publicly announce the breach if we didn’t pay a sum of money. My response to the blackmail was letting them know I would consider their proposal, but ultimately the damage they would do is to customers that didn’t deserve to be exploited, and to employees, good people that already feel a ton of weight from the responsibility. They gave me a few days to make a decision.
Okay, Brett… fine, ISPs can do this shifty stuff, but this sounds like tinfoil hat territory. Well, maybe, but 
An ISP is closer to the phone company as a utility – while you may have some choice in which ISP you use, frequently these choices are very limited and, if selling private customer information is a standard practice, your only alternate choice is not having Internet access. If you found out that the phone company listened in on your conversations and sold transcripts to other companies, you’d likely be outraged.
Security must be balanced with convenience. When being secure is a hassle, people naturally find (unfortunate) workarounds that make things less secure. If you require a password that is 20 characters long and random, look around the person’s desk for the PostIt (or possibly worse, in their “passwords.txt” file on their desktop). The sweet spot is a mild inconvenience that dramatically improves security. I find there’s a few easy practices that fit into this sweet spot…
My point is, there is almost certainly going to be an overlap of your family’s online account footprint, and when one person gets hacked it will likely be a vector for the rest of your family. Sharing documents in Dropbox, G Suite (Google Docs), or Amazon family all provide opportunities for a hack to spread. Protect your accounts by having those close to you keep their accounts secure (and… that is the real reason I wrote this post – pure selfishness as I protect my own accounts).