How to build better security habits for your digital life

Most people rely on a handful of passwords that they have used for years across dozens of different websites. This creates a significant vulnerability because a single data breach at one company can expose every account linked to that same password. If a small online forum loses its database, attackers can immediately attempt to use those same credentials to access your email, your banking, or your social media profiles. This method of attacking is efficient for criminals because it requires very little effort to test stolen combinations against popular services.

Use a dedicated password manager

The most effective way to stop reusing passwords is to stop trying to remember them. Human memory is not designed to store hundreds of unique, complex strings of characters. Instead, use a password manager to generate and store long, random passwords for every single service you use.

A password manager acts as a secure vault. You only need to remember one very strong master password to gain access to everything else. Most modern managers can also detect if a website you are visiting is a fake version of a real site, which helps prevent phishing attacks. When choosing a manager, look for one that allows you to store emergency access information for a trusted person, just in case you lose your master password.

By using a manager, you move away from predictable patterns like adding a year or a special character to the end of a common word. Each account becomes an isolated island. If one island is compromised, the others remain secure because they do not share any connection to the first.

Enable multi-factor authentication everywhere

Even with a strong password, accounts can still be compromised through sophisticated methods. Multi-factor authentication, or MFA, adds a second layer of protection that requires something you know (your password) and something you have (a physical device or a code).

Whenever a service offers MFA, it should be turned on. However, not all forms of MFA are equal. SMS-based authentication, where a code is sent via text message, is better than nothing, but it is vulnerable to a technique called SIM swapping. In this scenario, an attacker convinces a mobile provider to port your phone number to a new SIM card, allowing them to intercept your codes.

For higher security, use an authenticator app or a physical security key. Authenticator apps generate time-based codes locally on your device, which are much harder to intercept. Physical security keys, which you plug into a USB port or tap against your phone using NFC, provide the strongest level of protection currently available for most consumer accounts.

Audit your app permissions and connected services

Security is not just about what you type into a box; it is also about what you permit third-party software to do. Many people use the "Sign in with Google" or "Sign in with Apple" features to avoid creating new passwords. While this is convenient and can be more secure than a weak password, it creates a web of interconnected permissions.

Periodically check which apps and services have access to your primary accounts. Go to your security settings in your email or social media accounts and look for "Connected Apps" or "Third-party access." You will often find old games, defunct shopping sites, or forgotten productivity tools that still have permission to read your contact lists, see your location, or access your files.

Revoking access to these unused services reduces your digital footprint. If one of those old, poorly secured apps is breached, the attackers cannot use that connection to pivot into your main accounts. It is a regular maintenance task, similar to cleaning out a physical filing cabinet.

Practice cautious clicking in your inbox

Phishing remains one of the most common ways for attackers to bypass technical defences. They do not always try to break your password; often, they simply trick you into giving it to them. These messages often create a sense of urgency, claiming there is a problem with a delivery, a suspicious login, or an unpaid invoice.

When you receive an unexpected email, do not click any links or download any attachments immediately. Instead, look at the sender's actual email address. Often, the name displayed might look legitimate, but the address behind it is a string of random characters or a slightly misspelled version of a real domain.

If an email claims there is an issue with your bank or a service you use, leave the email and go directly to the official website by typing the address into your browser yourself. Never use the links provided in a suspicious message to log in. This simple habit ensures that even if a message looks perfect, you are interacting with the real service rather than a fraudulent copy.

Things to try this week

• Install a reputable password manager on your phone and computer.
• Turn on multi-factor authentication for your primary email account and your most important banking app.
• Spend ten minutes reviewing the "Connected Apps" list in your Google or Apple account settings and remove anything you no longer use.
• Check your most important accounts to see if they have been involved in any known data breaches.