Protect Yourself First¶
Before you learn to hack things, learn how people actually get hacked. A huge number of successful attacks start with something much simpler than a zero-day: stolen credentials, phishing, reused passwords or social engineering — not clever exploits.
Your email account is worth more than you think¶
It might not feel like there's much in it worth protecting. But email is usually the recovery path for everything else — if someone gets into your email, they can often reset their way into your banking, socials and anything else tied to that address.
Your sent items folder matters too. If you've ever emailed a scan of your ID, your TFN, a payslip or proof of address to apply for a job, a course, a rental or a loan, there's a good chance it's still sitting in there. Worth a look — and worth deleting once you don't need it anymore.
Have I Been Pwned lets you check whether an address has already appeared in a known breach — but the more useful move is subscribing for free notifications, so you find out the moment a new one includes you, not months later.
Password managers¶
Stop reusing passwords.
A free password manager can generate and store unique passwords for every account.
One strong master passphrase unlocks the vault. Everything else can be random and unique.
Passkeys¶
Passkeys use cryptographic credentials stored on your device rather than a password that gets typed into a website.
They're designed to resist phishing because the credential is tied to the legitimate site or service.
Where a reputable service offers a passkey, it's generally worth considering.
MFA¶
Turn it on everywhere it's offered:
- Gaming accounts
- Social media
- Banking
- Work accounts
- Cloud services
Don't know where to start?
Most vendors publish their own walkthrough. Googling "how to set up MFA for [whatever you're using]" usually turns up clear, step-by-step instructions — it looks more intimidating the first time than it actually is.
Prefer passkeys, hardware security keys or authenticator apps over SMS where practical.
A password manager like Bitwarden can also store the MFA code itself right alongside the password it belongs to, synced across every device — one less app to juggle.
Save your recovery codes somewhere safe.
Learn to Spot the Human Side of Security¶
Security isn't just computers.
A huge part of the job is understanding how people are manipulated.
The general pattern¶
A lot of scams contain the same ingredients:
The general pattern
Urgency + emotion + a request to do something unusual.
Slow down.
Thirty seconds of thinking can defeat a surprisingly large number of scams.
Common examples¶
Discord / gaming scams
Fake Nitro, giveaways, game currency or support messages can lead to fake login pages designed to steal credentials.
Account takeover
A compromised friend's account asks you to "send me the code you just received."
That code may actually be the login code for your account.
Never give someone an authentication code because they asked for it.
Fake cheats and mods
"Aimbot", "mod menu", "free skins" and similar downloads are a common way of getting malware onto gaming PCs.
If software tells you to disable your antivirus before it will work, that's a massive red flag.
Sextortion
Someone builds trust, obtains intimate images or video, then threatens to distribute them unless you pay or send more.
If this happens to you or someone you know, see If Something Actually Goes Wrong for what to do.
AI voice cloning
A convincing voice isn't proof that someone is who they claim to be.
For genuinely important requests, independently contact the person using a known number or another channel.