Most people think about cybersecurity only after they have been hacked. Meanwhile, protecting your data online is much easier than it seems — no special knowledge is needed, only three habits that take less than an hour to set up.
Habit 1: Switch From SMS Codes to Passkeys or an Authenticator App
If you still receive an SMS code to sign in to your accounts, that is the weakest protection link available. SMS codes can be intercepted through a SIM-swap attack, where an attacker transfers your number to their own SIM card without physical access to your phone.
What to do instead:
- Passkeys are the newest and most reliable sign-in method, fully replacing passwords. They are already supported by all major platforms — Google, Microsoft, Apple, Amazon, PayPal, GitHub. Sign-in happens through Face ID, Touch ID or the device PIN, and an attacker cannot intercept a password that simply does not exist.
- If passkeys are not yet supported by a service, use an authenticator app (Google Authenticator, Microsoft Authenticator, Authy) instead of SMS. The codes are generated directly on the device and do not pass through the mobile operator’s network.
According to the U.S. cybersecurity agency CISA, multifactor authentication reduces the likelihood of account compromise by about 99%.
Habit 2: Use a Password Manager Instead of Memorizing Passwords
The old advice to “change your password every month and add special characters” is now officially outdated — modern recommendations (including updated NIST standards) emphasize not password complexity, but uniqueness for every service.
The problem is that physically memorizing dozens of unique passwords is impossible — which is why people develop the habit of using one password everywhere. This is the main reason behind mass account compromises: if one service’s database leaks, attackers automatically try the same login-password combination on other sites.
A password manager solves this in one move: it generates a unique, complex password for every site and fills it in automatically, leaving you to remember only one master password for the manager itself.
Habit 3: Regularly Check Whether Your Data Has Been “Leaked”
Even with perfect protection on your side, your data can leak through a breach of the service you use — and you may not know about it for years.
Once every few months, it is worth checking your email through specialized breach-checking services — it takes a minute and immediately shows whether your address has appeared in any known leaked-data databases. If it has, immediately change the password for the specific service where the breach happened, and for all other services where you used the same password.
Bonus: Why Free Wi-Fi Networks Are Dangerous
A separate topic worth mentioning is public Wi-Fi in cafes, airports or shopping malls: it is convenient, but potentially risky. An open network without a password means that traffic between your device and the router can theoretically be intercepted by other users on the same network.
Practical steps that reduce the risk:
- Avoid logging in to banking apps or entering passwords on open Wi-Fi unless absolutely necessary
- If possible, use a VPN — it encrypts traffic even on an unsecured network
- Check that the sites you use work over HTTPS (the lock icon in the address bar) — this is already a basic layer of protection even on a public network
- Turn off auto-join for open Wi-Fi networks in your phone settings so the device does not connect to suspicious access points automatically
In Brief: The Key Points
- SMS codes are the weakest form of 2FA because of the risk of SIM-swap attacks; switch to passkeys or an authenticator app
- Passkeys are supported by all major platforms — Google, Microsoft, Apple, Amazon, PayPal, GitHub
- MFA reduces breach risk by ~99%, according to CISA
- A unique password is more important than a complex one — a password manager solves this problem automatically
- Check data breaches regularly — once every few months is enough
- On public Wi-Fi — avoid banking without a VPN and turn off auto-join for open networks
FAQ
What are passkeys and why are they better than passwords? Passkeys are a sign-in method using biometrics (Face ID, Touch ID) or the device PIN instead of a password. They cannot be stolen through phishing or intercepted, because there is no password to steal in the first place.
Is an SMS code safe for two-factor authentication? It is better than nothing, but it is the weakest 2FA option — SMS can be intercepted through a SIM-swapping attack. An authenticator app or passkeys are more reliable.
Is it safe to use a password manager? Yes, reputable password managers use strong encryption. The risk of losing passwords through a single point of entry is much lower than the risk of reusing one password across all sites.
How often should passwords be changed? Modern NIST recommendations advise not changing passwords on a schedule, but changing them only if a breach is suspected — instead, focus on password uniqueness for each service.
Why are free Wi-Fi networks dangerous? Open networks without a password can theoretically allow other users on the same network to intercept traffic. Reduce the risk with a VPN, HTTPS checks and disabled auto-join for open networks.
The article was prepared by the TechVisor team — practical IT media for people.
