Many years ago, my wife and I wrote a book about online security.<\/p>\n\n\n\n
In case you\u2019re thinking of doing the same thing, allow me to gently counsel you against it: DON\u2019T BLOODY DO IT! Things in the technology space move so quickly, the information in the book went out of date during the milliseconds while the \u201cPublish\u201d button was being clicked. This is not the topic on which to write a timeless classic and have future generations of your family live pretty off the royalties.<\/p>\n\n\n\n
Anyway, commercial disaster aside, I\u2019ve maintained an interest in the online security space. It\u2019s the perfect intersection of two of my main interests: technology and distrust of my fellow humans.<\/p>\n\n\n\n
Happily, I can report that the security measures that come \u201cbaked in\u201d to consumer tech have got a lot better over the years. For example, almost every website you use will now have a little padlock symbol next to its name in the browser bar. That means your connection to the site is encrypted, so nobody can intercept the information (like credit card details) that pass between your device and the server the site sits on. Before this became the norm a couple of years ago, you needed to be aware of the potential problem and install your own piece of software to encrypt your connection.<\/p>\n\n\n\n
So with that taken care of for you, the main security problem you\u2019re likely to face these days is having your passwords stolen<\/strong>. There are two main ways in which this can happen.<\/p>\n\n\n\n Either of these events can be an annoyance at best, or a total catastrophe at worst. If hackers manage to use your password to get into one of your investment accounts, that\u2019s not good. If they get into your email account, from which they can reset passwords for all your other accounts and gather endless information about the details of your life\u2026that\u2019s really not good.<\/p>\n\n\n\n Luckily, you only need to do two simple things to make your accounts almost 100% safe.<\/p>\n\n\n\n By using a different password on every site, it means even if one site gets hacked and your password is leaked, it won\u2019t compromise your security on any other site.<\/p>\n\n\n\n The ideal password looks something like this: MuPmolQa4tc$IyxCl6eoBYj^5<\/strong><\/p>\n\n\n\n That\u2019s a combination of uppercase and lowercase letters, numbers and symbols that doesn’t contain any dictionary words and is at least 16 characters long.<\/p>\n\n\n\n And remember: you need a different one for every single site you interact with. Hope you\u2019ve got a good memory!<\/p>\n\n\n\n Actually, you don\u2019t need that at all: all you need is a password manager<\/strong>.<\/p>\n\n\n\n A password manager is a piece of software that sits in your browser and remembers all your passwords for you. All you need to do is…remember your password for the password manager itself.<\/p>\n\n\n\n (This is not<\/em> the same as when some browsers offer to remember passwords for you, which isn\u2019t secure and doesn\u2019t help you when you switch between devices.)<\/p>\n\n\n\n So you can set a separate, ludicrously strong password for every site you use, yet you only end up with just one password to remember. This isn\u2019t just more secure \u2013 it\u2019s more convenient too, because the software will auto-insert the password when it notices you\u2019re on a site it has the login details for so you don\u2019t even have to do any typing.<\/p>\n\n\n\n It\u2019s actually much<\/em> more convenient than what appears to be the lazy option: using the same “mrsquawks65” password on every site. When you attempt to use the same password, many times you won\u2019t be able to: some sites will insist on a password of a certain length, or using a certain combination of characters, or will insist on there being symbols (or there not being symbols). These rules mean you\u2019ll need different versions of your \u201cone password\u201d that you’ll then need to somehow remember when you don’t have the password criteria in front of you anymore, which defeats the object of convenience while still not being secure.<\/p>\n\n\n\n At this point, I\u2019d be disappointed if you weren\u2019t thinking \u201cerrr but what if the password manager gets hacked and all<\/em> my passwords get stolen?\u201d This is a good point. However, these services use a “zero knowledge” cryptographic system that means neither your “master password” nor your many individual passwords are stored on their servers in a form that would mean anything to a hacker.<\/p>\n\n\n\n Basically, given that the entire point of their business is to keep passwords safe and their reputation would be ruined if they failed, I have far more faith in their security than that of random other sites. Nevertheless, it’s always theoretically possible.<\/p>\n\n\n\n All password managers are much of a muchness, and cost a small annual amount. The most popular ones are:<\/p>\n\n\n\n Get one of those set up, and you\u2019re ready to move on to the second and final step…<\/p>\n\n\n\n Now you\u2019re making optimal use of passwords, there\u2019s no risk of a breach of one website exposing your password on every site you use. But there\u2019s still the risk of a password for a single, important site being compromised.<\/p>\n\n\n\n A strong password makes it almost impossible for a malicious person to crack it by brute force, but if they know a few details about you (maybe you\u2019ve been binning bank statements without shredding them\u2026) they could call your bank and persuade them to reset that beautiful 30-character beast of a password of yours.<\/p>\n\n\n\n And remember when you\u2019re setting up an account and it gets you to set \u201cbackup\u201d questions like the city you were born in and the name of your first pet? Do you think it\u2019d be impossible for a sufficiently motivated person to figure those out?<\/p>\n\n\n\n The solution to avoiding this (or any other) kind of attack is two-factor authentication<\/strong> (2FA) \u2013 which, as the name implies, introduces a second factor:<\/p>\n\n\n\n Suddenly, an attack becomes exponentially more difficulty: a malicious person would need to obtain your password and<\/em> get access to your chosen device at the same time<\/em>. It\u2019s not impossible, but it\u2019s far less likely. And if a website gets hacked and exposes everyone’s password, no biggie: if they try to get into yours, they’ll fail because they don’t have the device.<\/p>\n\n\n\n For this reason, it\u2019s actually more secure to have a weak password plus 2FA than to just have a strong password alone.<\/p>\n\n\n\n You probably already have 2FA set up for certain sites already, because they insist on it \u2013 online banking being the most common. When logging in, after you put in your password they\u2019ll send an SMS to your phone with a code you need to enter.<\/p>\n\n\n\n This is better than nothing, but not perfect for a few reasons:<\/p>\n\n\n\n For these reasons, it’s safer and more convenient to use an authenticator app. <\/strong>This is an app you install that generates a security code (usually six digits) on the device itself without a reliance on SMS. This overcomes the risk of a SIM swap attack, and has you covered even when you don\u2019t have mobile phone reception.<\/p>\n\n\n\n You only need to download a single app once: once you’ve got it, you can set it up to receive codes for an unlimited number of sites you have accounts with.<\/p>\n\n\n\n The best authenticator app, in my opinion, is Authy<\/a><\/strong>. The main reason is that it allows you to sync your sites between devices <\/em>\u2013 so you could have it simultaneously set up on your phone, an iPad and a laptop, and if you add a site on one it magically appears on the others.<\/p>\n\n\n\n This is important not just for convenience, but also to keep access if you lose your phone<\/strong>.<\/p>\n\n\n\n For example, say you only had an authenticator app set up on one mobile phone. If you lost it or had it stolen\u2026then what? You\u2019re locked out of everything, and even getting your phone number back doesn\u2019t help because the app is linked to the device itself rather than your number.<\/p>\n\n\n\n (In practice, most sites give you a few backup codes that will get you back in if you don’t have access to your phone. But then you have to store those<\/em> safely, and it’s all a bit of a faff.)<\/p>\n\n\n\n But with Authy synced across more than one device, you\u2019re fine. If you lose your phone, you can get access to your sites from the version you have installed on your laptop or tablet until you get a new phone. Then when you do, you can install Authy again and sync it up with your account. No problem at all.<\/p>\n\n\n\n The app you\u2019ll most commonly see referenced \u2013 Google Authenticator<\/strong> \u2013 doesn\u2019t allow this synchronisation (at the time of writing, at least), so for me Authy is clearly a better choice.<\/p>\n\n\n\n Oh, and it’s free.<\/p>\n\n\n\n Just go to authy.com<\/a> and follow the download instructions from there.<\/p>\n\n\n\n It doesn’t matter whether you start with your phone, laptop, or tablet \u2013 just pick one to get started with, and we’ll add it on the others in a moment.<\/p>\n\n\n\n (If you only ever use one device \u2013 like conducting all your internet activity through a mobile phone and not owning a laptop \u2013 then I don’t fully understand the way you choose to live your life. But in any case, it’s fine to just install Authy on one device: you just lose the benefit of being able to sync across devices for easy recovery if you lose or change it.)<\/p>\n\n\n\n1: Use a different strong password on every website<\/h2>\n\n\n\n
2: Enable two-factor authentication<\/h2>\n\n\n\n
The best type of 2FA<\/h3>\n\n\n\n
Setting up Authy<\/h2>\n\n\n\n
1: Install Authy on one of your devices<\/h4>\n\n\n\n
2: Install Authy on your other devices<\/h4>\n\n\n\n