Digital Security and Privacy for Normal People

This is a guide for individuals who are interested in improving their digital security/privacy. Only basic knowledge of how to use your computer and mobile device is required.

Low-hanging fruit

Everyone should do these. You only need to set them up once, are high value for relatively low effort, and there is little/no downside. Instructions are linked, where possible. You can of course skip any that aren’t relevant to you.

Browser(s)

This goes for desktop and mobile.

• Enable HTTPS-only mode in all browsers you use regularly.
  • Chrome - see “Always use secure connections”
  • Firefox
• Delete extensions you don’t use.
  • Chrome
  • Edge
  • Firefox
  • Safari

Devices

Do these for all of your computers, phones, tablets, etc.

• Lock your device, using fingerprint/PIN/passcode/whatever.
  • Android
  • iOS
• Set them to auto-lock after a short period of time (less than five minutes).
  • Android
  • iOS
  • Mac
  • Windows
• Enable automatic updates. Update your operating systems and software early and often.
• Enable automatic backups.
  • Android
  • iOS
  • Mac
  • Windows
• Delete apps you don’t use.
  • Android
  • iOS
• Review your apps’ permissions, and revoke anything an app doesn’t need, like location, contacts, or microphone access.
  • Android
  • iOS
• Turn on “find my device”, so you can locate, lock, or erase a lost or stolen one.
  • Android
  • iOS/Mac
• Lock your SIM card. The instructions will be specific to your provider.
  • AT&T
  • Google Fi
  • T-Mobile
  • Verizon

Messaging

• iPhone: Enable RCS on the devices you use the Messages app from.
  • iOS
  • Mac

Important accounts

Prioritize securing services that you frequently use for communication, or that have sensitive information like your contacts, financial, payment, or health information. In other words, which accounts do you have that, if hacked, would be a Big Deal? Examples of services that might be at the top of that list:

• Bank(s)
• Ecommerce
• Email
• Social media

We’ll refer to this in subsequent sections.

Security Checkups

Some services have a built-in Security Checkup tools, walking you through various account settings. Go through them for:

• Google
  • Review My Google Activity. Are you ok with Google knowing all of that about you?
  • Remove the Results About You
• Meta (Facebook, Instagram, etc.)

Account recovery

Attackers often get into an account through its recovery options, not its password. For each of your important accounts, especially email:

• Make sure the recovery email address and phone number are yours and current. Remove old ones.
  • Google
• Review the devices that are signed in, and sign out any you don’t recognize or use.
  • Google

Passwords

• Set strong passwords on all of your important accounts and devices.
  • Otherwise, hackers can get into your account(s) extremely easily. Different services have different requirements around passwords.
  • This is easier if you set up a password manager.
• Use passkeys instead of passwords wherever a service offers them. They can’t be phished or reused, and you sign in with your fingerprint, face, or device PIN.
  • Apple
  • Google

Multi-factor authentication

• Enable multi-factor authentication (MFA) on all of your important accounts.

Also known as two-factor authentication (2FA). All major services offer MFA.

When enabling MFA, using one or more of the following is recommended. Passkeys and security keys are the strongest, since they can’t be tricked by a fake login page. Text messages are the weakest, since they can be intercepted or redirected through a SIM swap.

• Passkeys or physical security keys
• Biometrics (Apple Face ID, fingerprint, etc.)
• An app to generate codes that synchronizes:
  • 1Password - paid, but is a full-fledged password manager
  • Authy - free
  • Google Authenticator - free
• The service’s app, when it supports push notification for MFA. For example:
  • Apple ID
  • Google
• Text messages (SMS)

Ongoing habits

Unlike the above, these can’t be checked off. They’re things to keep doing, since scammers pretend to be a company or someone you know, and better security settings don’t help if you’re talked into giving access away.

• Don’t act on unexpected, urgent messages that ask for a login, code, or payment. Instead of using the link or contact info in them, go to the company’s site or app yourself, or call a number you know is real.
• Never share an MFA code with anyone who contacts you. Legitimate companies don’t ask for them.
• If a family member calls in an emergency asking for money, hang up and call them back on their usual number. Scammers can clone a voice from a short clip. Agreeing on a code word with your family ahead of time also helps.
• Repeat the app permissions review every six months. You’ll have installed new apps since, and may have granted more access along the way.
• Act on data breach alerts. If you signed up for them and one says your information was exposed, change that account’s password right away, and the password on any other account where you reused it.

Next steps

Great work! Your personal security and privacy are now waaaay above average.

Eager/willing to do more?

Keep going

Privacy vs. security

In short, security is like having bars on your windows: hackers can’t get in, but they can see through. Privacy is like having blinds, where they can’t see in, but they can reach their hand in and unlock the door. You’ll need a combination of protections to address both.

Glossary

• Data breach: When a company or organization’s systems are accessed without permission, exposing the information it holds about its customers or users, such as email addresses, passwords, or payment details.
• Data broker: A company that collects personal information about people from public records, apps, and other sources, then sells or licenses it to others, typically for advertising, marketing, or background checks.
• Hack: To get into a device, account, or system without permission, or to make it do something its owner didn’t intend. Someone who does this is a hacker.
• Multi-factor authentication (MFA): A service requiring more than just a password to log in.
• Passphrase: Synonym for password.
• Personal health information (PHI): Information about your health, such as diagnoses, medications, and medical or insurance records. Healthcare providers and insurers in the US are legally required to protect it, but apps and websites often aren’t.
• Personally identifiable information (PII): Details that can be used to identify you, such as your name, address, phone number, date of birth, or Social Security number. Scammers use it to impersonate you.
• Privacy: Controlling who can see information about you and what you do. See Privacy vs. security.
• Pwned: Slang for an account or device that has been compromised, or whose password has appeared in a data breach.
• Security: Protecting your devices and accounts from being accessed by anyone who shouldn’t. See Privacy vs. security.
• SMS: Short Message Service, also known as “text messages”.
• Two-factor authentication (2FA): See multi-factor authentication.

Disclaimer

This guide makes no guarantees that, even with following all steps of this guide, that your digital security/privacy will not be compromised. If you think you might be of particular interest to hackers, law enforcement, or nation-states, because you’re:

• An activist
• A celebrity
• An executive
• A journalist
• A politician
• A system administrator

…then you should do everything in this guide, but it won’t be enough. See the additional resources.

If you’re a high-profile target, consult a security professional for additional actions.