Welcome to The Nonlinear Library, where we use Text-to-Speech software to convert the best writing from the Rationalist and EA communities into audio. This is: Not Getting Hacked, published by jefftk on December 21, 2022 on LessWrong.
A lot of people get hacked or phished, and being completely secure is somewhere between difficult and impossible, especially if someone trying hard to hack you in particular. But there are several simple things you can do that decrease your risk a lot:
Use a password manager that fills in fields automatically.
Configure 2FA with security keys.
Read "sign in with provider" (oAuth) screens carefully.
Encrypt your laptop.
Be cautious with inbound communication.
Why these things? You can make computers do stuff random other people normally can't: transfer your money, post to social media as you, read your private documents, control your employer's systems, etc. If an attacker can trick the right systems into thinking the are you, they can take your money, exploit your secrets, or use you to get to others.
A strategy of putting in a lot of mental effort to always make the right security decision in the moment doesn't work well for humans: we make mistakes, especially when we're doing routine things or are distracted, tired, hungry, etc. Instead:
Use tools so you can't mess up even if you're not paying
attention.
Understand the remaining cases where you do need to take
special care.
Password managers, laptop encryption, and security keys are examples of the former, while being careful with 2FA codes, oAuth screens, and inbound communication are examples of the latter.
In the most common attacks someone gets a copy of what the computer checks to make sure you are you (your "credentials"). For example, if your email is protected only with a password then if they can get your password they can log into your email.
The most common way for someone to learn your password is using the same one on multiple sites. Say you use "hunter2" everywhere and you create an account on "Joe's Shoes and Wallpaper" to buy sneakers. They later get hacked, their passwords get cracked, and now the attacker knows you used "hunter2". They try this on your email account, learning your address from Joe's records, and it works. This is an especially worrying scenario because you probably have a lot of other accounts that will send password resets to your email, and now the attacker can control those as well.
Remembering passwords for hundreds of sites isn't practical, so you want something that lets you generate a random password for each site and then stores it for you: a "password manager". But this isn't enough on its own, because the second most common risk to passwords is fake login pages. If you click on a link and get:
You want to enter your username and password if this is
accounts.google.com but not if it's
accounts.google.com.evil. Closely examining the URL to make sure it's the right one helps, but humans make mistakes. Instead, you want a password manager that, in addition to remembering your passwords, only provides them to login pages on the correct domain.
I use Google's password manager which is integrated into Chrome and Android; if you're fully in the Apple ecosystem you might use Apple's
Keychain. Firefox also has one. Stand-alone password managers include Bitwarden and 1Password; if you use one of these make sure you set up browser integration so you're not pasting passwords, protecting you against fake login pages. Use separate password managers (or separate "vaults" within a single manager) for work and personal accounts so that when you eventually leave you can separate them cleanly.
Even with an autofilling password manager there will be occasional times when it doesn't work and you need to copy-paste: be very careful that the URL is correct when doing that, because this is exactly the problem you would run into if someone was trying to get your password.
Another layer of protection here is ensuring that ...