opsec for friends 🔒

A short, no-nonsense checklist to make you a much harder target for identity theft and account takeovers. Everything here is free.

Do Part 1. It takes about an hour total and stops most real-world attacks. Part 2 is for when you're done and want more.

Part 1: Everyone should do this

1. Password manager + unique passwords

One reused password = one breach away from losing every account that shares it. Any reputable one works: Apple Passwords, Google Password Manager, 1Password, or Bitwarden. Pick one and let it generate a different password for every site.

• Check whether your email already leaked: Have I Been Pwned. Change those passwords first.

2. Two-factor on everything important, but not by text

Turn on two-factor for your email, Apple/Google account, bank, and anything that holds money. Use an authenticator app or passkeys, not SMS codes (see #3 for why).

3. Lock down your phone number (SIM swap protection)

If someone calls your carrier pretending to be you ("hi, I lost my phone, please move my number to this new SIM"), they get your texts, which means your SMS codes and password resets for every account tied to that number.

• Log in to your carrier account, turn on its number-transfer / SIM-change lock, and set an account PIN that isn't your birthday or the last 4 of your SSN. Look for AT&T Wireless Account Lock, Verizon Number Lock, T-Mobile SIM Protection, or Google Fi Number Lock.

4. Freeze your credit at all four bureaus

A freeze stops anyone from opening new credit in your name. It's free, doesn't hurt your score, and you can lift it temporarily when you need credit. Do all four; one does nothing for the others. Save each login in your password manager.

5. Get an IRS Identity Protection PIN (US)

A 6-digit PIN the IRS requires before it accepts a return with your SSN, so nobody can file a fake one and steal your refund. Get an IP PIN.

6. Phone theft protection

• iPhone: Turn on Stolen Device Protection, so a thief who watched you type your passcode still can't change your Apple Account password.
• Android: Turn on theft protection.

7. Auto-updates on (and actually restart)

Most hacks hit bugs that were already patched. Turn on automatic updates for your OS, browser, and apps, and restart about once a week so they actually install.

8. Don't take the bait

Unexpected "urgent" texts, emails, or DMs asking you to click, log in, or read back a code are the #1 way accounts get taken. Don't click. Open the real app or type the real website yourself. More from CISA.

If you hold crypto

Crypto theft is usually permanent.

• Keep meaningful amounts on a hardware wallet, and never type, photograph, or cloud-save your seed phrase. Whoever has the seed has the money.
• For larger amounts, use a multisig wallet (like Safe): several keys, each on its own hardware wallet and stored in a different place, have to approve every transaction (for example 2 of 3). One stolen, lost, or phished key can't drain it on its own.
• Before sending, check the first and last characters of the address. Scammers plant lookalike addresses in your history.
• Never sign mystery transactions or install a "wallet update" from a link someone sent you.
• Never download files or "demos" from someone you just met online, even on a convincing video call. Keep crypto signing on a separate, dedicated device from your everyday one.

Worth reading if you hold a lot:

• Don't store crypto at home by @owocki, on designing your setup so nobody can force you to move funds quickly.
• Two rules for self-custody by @0x_Osprey, on hardware-wallet-only keys and a dedicated signing computer.

Part 2: Only the paranoid survive 🕶️

Real protection, a bit more effort.

Security keys

Hardware keys (like YubiKeys) can't be phished at all. Buy two and keep one somewhere safe as a backup.

• Apple: Security keys for your Apple Account, plus Advanced Data Protection to end-to-end encrypt iCloud. Set up a recovery contact first, because Apple can't recover your data for you.
• Google: Advanced Protection locks your account to security keys. Also run a Security Checkup.
• Once a key or authenticator is set up, remove your phone number as a recovery option where you can.

The freezes people forget

Banks, phone companies, and some lenders check other databases.

Bonus: OptOutPrescreen.com stops pre-approved credit card offers showing up in your mailbox.

Claim your accounts before someone else does

• Create a my Social Security account so nobody else can with your SSN.
• Sign up for USPS Informed Delivery to see your mail before it arrives and notice if it's being redirected.

Separate your money email

Use a separate email or an email alias service (like Apple's Hide My Email) for financial accounts, so a breach of some random shopping site doesn't expose your financial logins.

Harden your computer

On a Mac, work through the 10 Minute Mac Security Checklist by @0x_Osprey.

Everything else

• Use Signal for private conversations.
• Every few months, review signed-in devices and connected apps on your important accounts, and remove anything you don't recognize.

Already hacked? Start here

IdentityTheft.gov walks you through an official recovery plan step by step. Report scams at ReportFraud.ftc.gov.

Not legal or financial advice, just stuff that works. Stay safe out there.