Practical Directives.

1. Install a reputable password manager
2. Generate unique passwords for every account
3. Replace any password you have reused
4. Enable passkeys where offered

Reused passwords are the most common cause of cascading breaches.

1. Enable multi-factor authentication everywhere
2. Prefer app-based or hardware factors over SMS
3. Store recovery codes offline and encrypted
4. Audit your account recovery methods

A second factor stops most stolen-password attacks cold.

1. Assign purpose-specific email aliases
2. Separate financial, social, and throwaway accounts
3. Avoid social sign-in for sensitive services
4. Keep work and personal identities distinct

Boundaries contain the damage when one service fails.

1. Review app and browser extension permissions
2. Revoke access you no longer use
3. Disable unnecessary location and contact sharing
4. Terminate stale active sessions

Every granted permission is standing exposure.

1. Delete abandoned accounts
2. Skip optional form fields
3. Request deletion of retained data
4. Decline tracking when you can

Data that does not exist cannot be leaked.

1. Distrust manufactured urgency
2. Verify senders through a second channel
3. Never enter credentials from a link in a message
4. Keep software and devices updated

Most attacks target the human, not the machine.