Dekrypt Security

Personal security you can finish in a weekend: passwords, 2FA, backups

· 5 min read

Most people know they should use a password manager, turn on two-factor authentication and back up their files. Few do all three, because it feels like a big project. It isn't. Split into steps, it fits into a weekend, and each step makes you safer on its own.

This is the plan I'd walk you through. It is advice for individuals and small teams, not a guarantee: it lowers your risk a lot, but it cannot remove it.

Saturday morning: a password manager

Why

Reused passwords are the main problem. When one site leaks, attackers try the same email and password everywhere else. The fix is a different password for every account, which is only practical with a password manager.

US guidance agrees on what makes a password good. NIST's digital identity guidelines, SP 800-63B, tell services not to impose composition rules (such as "one symbol, one number") and not to force periodic password changes, only to require a change when there is evidence of compromise. Length and randomness matter more. CISA's advice to the public, Use Strong Passwords, is: long (at least 16 characters), random, and unique, created with a password manager.

Steps

  1. Pick a password manager. Use a well-known one that works on all your devices. The one built into your phone or browser is fine to start with if it syncs everywhere you need it.
  2. Create one strong master password. This is the one password you remember. A passphrase of several random words is easier to type and remember than a jumble of symbols. My password and passphrase generator creates one in your browser; nothing leaves your device.
  3. Write the master password down once and keep the paper somewhere safe at home until you have memorised it. A paper note in a drawer is far safer than a reused password.
  4. Install the manager on your phone and computer and turn on autofill.

Change the important passwords first

Do not try to change every account today. Start with the accounts that unlock the others:

  1. Your main email account. Whoever controls it can reset almost every other password.
  2. Your phone's account (Apple ID or Google account).
  3. Banking and payment apps.
  4. Cloud storage, where your photos and documents live.
  5. Work accounts and anything with admin rights.

For each, let the manager generate a new password, save it, and log in again to check it works. Change the rest as you log in to them over the following weeks.

Saturday afternoon: two-factor authentication

Why

Two-factor (or multi-factor) authentication means a stolen password is not enough on its own. CISA's MFA guidance lists the common forms, from text-message codes through authenticator apps to phishing-resistant methods, and recommends turning it on first for email, financial services, social media, and online stores.

Which kind

From weakest to strongest, roughly:

MethodNotes
SMS or voice codeMuch better than nothing. Can be intercepted or redirected if someone takes over your number.
Authenticator appCodes generated on your phone. A good default.
Push approvalConvenient. Only approve prompts you started yourself.
Passkey or security keyPhishing-resistant: it will not work on a fake site. Best where supported.

Use the strongest method each service offers that you can manage reliably.

Steps

  1. Turn on 2FA for the same priority list: email, phone account, banking, cloud storage, work.
  2. Save the recovery codes each service gives you. Store them in your password manager, and print the codes for your main email account and keep them with your master password note.
  3. If you use an authenticator app, check whether it can back up to a new phone. If it can't, losing your phone means using recovery codes for every account.

Sunday: backups

Why

Phones get lost, laptops die, and ransomware encrypts files. A backup is the only thing that fixes all three.

A simple rule from CISA's paper on data backup options is 3-2-1: keep 3 copies of important files (the original and 2 backups), on 2 different types of media, with 1 copy stored offsite. The UK's NCSC backup guidance puts the scope simply: back up anything that would inconvenience you if you could no longer access it.

A practical 3-2-1 for one person

  1. Original: your phone and laptop.
  2. Backup 1, cloud: turn on your phone's cloud backup and a cloud sync for your documents and photos. It runs automatically.
  3. Backup 2, offline: an external drive. Copy your important folders to it once a month, then unplug it. A drive that is always connected can be encrypted by ransomware along with everything else.

The offline drive at home and the cloud copy elsewhere give you the "1 offsite".

Test a restore

A backup you have never restored is a hope, not a backup. Pick one file from each backup and open it on another device. If you can't, fix it now.

For files you copy to a drive, you can check they arrived intact by comparing checksums. On Linux or macOS:

cd ~/Documents
find . -type f -exec shasum -a 256 {} + | sort -k 2 > /tmp/originals.txt
cd /path/to/backup/Documents
find . -type f -exec shasum -a 256 {} + | sort -k 2 > /tmp/backup.txt
diff /tmp/originals.txt /tmp/backup.txt && echo "Backup matches"

No output from diff and "Backup matches" means every file is identical. The hash and file checksum tool does the same for single files in your browser.

Sunday evening: quick wins

If you have time left:

  • Turn on automatic updates on your phone, computer and browser.
  • Lock screens with a PIN or biometrics.
  • Remove apps and browser extensions you no longer use.
  • Check account recovery details: make sure the recovery phone number and email on your main accounts are current.

What this does not cover

This setup protects against the most common problems: reused passwords, stolen passwords, and lost files. It does not protect against a targeted attacker, a compromised device, or every scam. If you think an account has already been taken over, use the service's official account recovery process first.

If you would like help doing this on your own devices, that is what the personal security setup sessions are for.

Sources