Protect Yourself First¶
Before you learn to hack things, learn how people actually get hacked. A huge number of successful attacks start with something much simpler than a zero-day: stolen credentials, phishing, reused passwords or social engineering — not clever exploits.
Learn to Protect Yourself¶
Before learning how to hack things, learn how people actually get hacked.
A huge number of successful attacks start with something much simpler than a zero-day: stolen credentials, phishing, reused passwords or social engineering.
Password managers¶
Stop reusing passwords.
A free password manager can generate and store unique passwords for every account.
One strong master passphrase unlocks the vault. Everything else can be random and unique.
Passkeys¶
Passkeys use cryptographic credentials stored on your device rather than a password that gets typed into a website.
They're designed to resist phishing because the credential is tied to the legitimate site or service.
Where a reputable service offers a passkey, it's generally worth considering.
MFA¶
Turn it on everywhere it's offered:
- Gaming accounts
- Social media
- Banking
- Work accounts
- Cloud services
Prefer passkeys, hardware security keys or authenticator apps over SMS where practical.
Save your recovery codes somewhere safe.
Learn to Spot the Human Side of Security¶
Security isn't just computers.
A huge part of the job is understanding how people are manipulated.
Common examples¶
Discord / gaming scams
Fake Nitro, giveaways, game currency or support messages can lead to fake login pages designed to steal credentials.
Account takeover
A compromised friend's account asks you to "send me the code you just received."
That code may actually be the login code for your account.
Never give someone an authentication code because they asked for it.
Fake cheats and mods
"Aimbot", "mod menu", "free skins" and similar downloads are a common way of getting malware onto gaming PCs.
If software tells you to disable your antivirus before it will work, that's a massive red flag.
Sextortion
Someone builds trust, obtains intimate images or video, then threatens to distribute them unless you pay or send more.
If this happens to you or someone you know, see If Something Actually Goes Wrong for what to do.
AI voice cloning
A convincing voice isn't proof that someone is who they claim to be.
For genuinely important requests, independently contact the person using a known number or another channel.
The general pattern¶
A lot of scams contain the same ingredients:
The general pattern
Urgency + emotion + a request to do something unusual.
Slow down.
Thirty seconds of thinking can defeat a surprisingly large number of scams.