Enable 2FA (also called MFA) on everything. Listed from least to most secure:

• SMS / Email Code — Most common, least secure, but still better than nothing. A VOIP number is safer than your cell (see Section 2).
• Authenticator Apps — More secure and convenient. I use Proton Authenticator and Yubico Authenticator. Also recommend Duo Mobile. These generate time-based 6-digit codes (TOTP) that change every 30 seconds.
  Your password manager can also manage TOTP codes — but use a separate Authenticator to protect the password manager itself. Protect your password manager with a passkey or physical security key wherever supported.
• Physical Security Keys — Very secure. Small USB-like devices; touch a button to authenticate. I use the Yubikey 5NFC (USB-A + NFC) and Yubikey 5Ci (USB-C + Lightning). Browse models at Yubico, or compare options in the NYT Wirecutter security-key guide.
• Passkeys 🆕 ★ Top Tier ★ — The gold standard when supported. A passkey replaces both your password and 2FA code with a single cryptographic key stored on your device (or in your password manager). There is no code to intercept, no phishing vector, and no server-side password database to breach.
  • Your device (phone, laptop, or security key) proves your identity using public-key cryptography. You authenticate with Face ID, Touch ID, or a PIN — nothing is ever sent to the website.
  • Where to use passkeys: passkeys.directory lists every site that currently supports them. Major adopters include Google, Apple, Microsoft, GitHub, PayPal, Amazon, and 1Password.
  • How to set them up: go to a supported site's security settings → look for 'Passkey' or 'Passwordless sign-in' → follow the prompt. Your password manager (1Password, Bitwarden, Proton Pass) can store passkeys alongside regular credentials.
  • When a site offers a passkey, choose it over any other 2FA option. Keep a physical security key as backup for your most critical accounts.

• Hides your IP address and physical location.
• Encrypts your web traffic, preventing man-in-the-middle attacks and blocking your ISP from seeing your activity.
• Acts as a second (or third) barrier between your home network and hackers or identity thieves.
• Quality VPNs include a mobile app for your smartphone.

• Backblaze — great for a single computer.
• iDrive — more economical for multiple computers.
• Set your own encryption key so only you can decrypt your data, even if the service is compromised.

Avoid Google Chrome and Microsoft Edge. Recommended alternatives:

• Firefox and Brave — preferred browsers, both founded by privacy advocates.
• DuckDuckGo and Brave Search — preferred search engines. Brave Search is the default, native search engine built into the Brave browser, so if you already use Brave you're using it by default.
• SwissCows — family-friendly engine that automatically filters adult content.
• Enable Global Privacy Control (GPC): GPC Guide

• Running the latest Windows Defender? The free version of Malwarebytes is sufficient for most people — no separate paid anti-virus needed.
• Paid suites like Norton, Bitdefender, and McAfee add value through bundled VPNs, child safety tools, and multi-device support. This added value can come at a cost: sometimes significant bloat that reduces speed and battery life.

A credit freeze is one of the most powerful defenses against identity theft. Unless you're actively applying for credit, keep it frozen.

• Equifax · TransUnion · Experian
• Free to freeze and unfreeze, as often as you like.
• You can and should also freeze your minor children's credit.
• Check your report: AnnualCreditReport.com is the free, official site that gives you one copy of your credit report from each of the three big bureaus (Equifax, Experian, TransUnion). Use it to spot accounts you didn't open. New v1.7

• Apple Pay / Google Pay — Masks your real card number with a one-time code, protecting your info in vendor databases.
• Privacy.com and Cloaked — Virtual card services. Cards are locked to specific vendors, can have spending limits, and can be deactivated any time.

Security habits work best when the whole household shares them. These protocols address the unique challenges of protecting children, teens, and elderly family members online.

Children & Teens

• Freeze every child's credit at all three bureaus the moment they receive a Social Security Number. Child identity theft often goes undetected for years.
• Use a family password manager (1Password Families, Bitwarden Organizations, or Proton Family) so parents can monitor and help children without sharing master passwords.
• Create child accounts under parental supervision on all devices. On iOS use Screen Time; on Android use Family Link. Set app download approvals and daily limits.
• Install a family-safe DNS filter on your home router: NextDNS (free tier available) or CleanBrowsing block adult content and malware domains before they load.
• Teach children never to share their full name, school, address, or location in games, apps, or social media. Make this a regular conversation, not a one-time lecture.
• Enable 2FA on gaming accounts (Roblox, Fortnite, Minecraft, Steam) — these are frequently targeted for credential theft.
• For teens on social media, review privacy settings together annually. Use the NYT Social Media Privacy Guide as a checklist.

Elderly Family Members

• Set up a password manager for them and offer to manage it. Proton Pass or Bitwarden have simple, clear interfaces. Store their recovery codes somewhere you both can access safely.
• Enable 2FA on their email and bank accounts — these are the two highest-value targets for elder fraud.
• Brief them on the most common elder scams: IRS/SSA imposters, Medicare fraud calls, grandparent scams, and romance scams. A simple rule: any caller demanding gift cards or wire transfers is a scammer, always.
• Register their numbers on the National Do Not Call Registry and check it yearly. Consider a call-screening app like Nomorobo or their carrier's built-in spam filter.
• Set up USPS Informed Delivery for them (see Section 2) so you or they can monitor physical mail for fraud.

Shared Household Practices

• Hold an annual family security review — see the Annual Audit Checklist in Section 4.
• Create a shared family emergency document (stored encrypted in your password manager) with: key account logins, who to contact if someone is locked out, and steps to take if a device is lost or stolen.
• Use a guest Wi-Fi network for smart home devices (TVs, thermostats, cameras). Keep personal computers and phones on the main network. Most modern routers support this with a simple toggle.

• Google Voice — Free secondary phone number, works from phone or computer.
• MySudo — ~$1/month for an anonymous number and email.
• Cloaked — Paid; includes masked email and phone.

VOIP numbers are more resistant to SIM-swapping attacks and let you keep your real number private.

• Signal — Free, end-to-end encrypted, third-party audited. My top recommendation.
• Also recommended: Wire Threema
• WhatsApp — Usable for non-sensitive messaging, but feeds data directly to Meta. It remains a major tool for international messaging.
• Telegram — ⚠ Popular, but regular chats are not end-to-end encrypted by default (only "Secret Chats" are, and only one-on-one). Don't treat it as a private messenger.

• Proton VPN — The only free VPN I recommend.
• NordVPN — Well-regarded paid option.

You only need one good content blocker — stacking several slows your browser and can break sites.

• uBlock Origin — The gold standard: free, open source, blocks ads, trackers, and known malicious sites. Full version works on Firefox, Brave, and Edge. Install it only from your browser's official extension store, and check the developer page before installing — copycats exist.
• On Google Chrome: Chrome no longer supports the full extension; use uBlock Origin Lite (a reduced version) — or better, switch to Firefox or Brave (see the browsers topic in Section 1). Brave also has strong blocking built in, no extension needed.
• Privacy Badger — Optional companion from the EFF that learns to block sneaky trackers. Fine to run alongside uBlock Origin.

• USPS Informed Delivery — Preview your mail digitally before it arrives. Free. FedEx and UPS have similar programs.
• iPostal1, USGlobalMail, TravelingMailbox — Real physical addresses (not P.O. boxes) that can forward, shred, or scan your mail on demand.

Have I Been Pwned is a great starting point, but a layered approach gives you much earlier and broader coverage. The sources below monitor different parts of the breach ecosystem.

Free Monitoring Tools

• Have I Been Pwned (HIBP) — The original. Checks your email against thousands of known public breaches. Enable free email alerts to be notified of new ones automatically.
• Mozilla Monitor — Built on HIBP data but integrates directly into Firefox. Also surfaces data broker exposure and guides you through fixes. Free.
• Proton Sentinel — For Proton Mail subscribers. Monitors your Proton account for suspicious access patterns and can lock it down automatically.
• Experian — Includes a built-in free dark web monitoring service through its Protection Center. Scans the dark web for your personal info and alerts you to exposures.

Proactive Steps When You Find a Breach

• Change the breached account's password immediately using your password manager to generate a new unique one.
• If the breach included a password you reused elsewhere, change it on every affected site. This is why unique passwords per site matter so much.
• If financial data was exposed, place a fraud alert with one credit bureau (it notifies all three) and consider a full credit freeze if you haven't already.
• If your SSN was exposed, file an identity theft report at IdentityTheft.gov and consider enrolling in IRS Identity Protection PIN to prevent fraudulent tax returns.
• Monitor your accounts daily for a few weeks after a breach using Credit Karma (free) or your bank's alerts.

• Have I Been Pwned — Check if your email or accounts have been in a data breach.
• Norton SafeWeb — Check any website for malware, phishing, or virus activity.
• CyberInsider — General privacy resource; great reviews of VPNs, browsers, cloud storage, and more.
• IntelTechniques — Run by security expert Michael Bazzell. Excellent opt-out guides, credit freeze guides, podcast, and books.
• NYT How to Dox Yourself — Open-access guide to finding and removing your own info online.
• FTC Identity Theft Site — Comprehensive U.S. government walkthrough for responding to identity theft.
• FTC Online Privacy & Security — Covers phone safety, malware, secure Wi-Fi, passwords, and scam avoidance.
• National Do Not Call Registry — Block unwanted marketing calls.
• Privacy Rights Clearinghouse — Nonprofit resource to assess your privacy exposure.
• Home Network Security — Advice on securing your home router and network.

Primary Data Brokers (PDBs) gather online data from apps, websites, lenders, utilities, commercial entities, and social networks, then sell it to people-search sites and advertisers. Opting out of these PDBs is a critical step toward long-term improvement of your digital privacy. This step essentially shuts off a lot of the flows of information that people-search sites use to populate their files on you.

People-search sites aggregate data from Primary Data Brokers and public records. Opting out significantly reduces your online presence.