Security Newsletter | 1/1/26

• 🏆🎖️ Test Your Security Skills
• 🫆 Privacy & Security New Year’s Resolutions 📱
• 💻 Glossary of Cybersecurity Terms 🔐
• 🍎📱 Security Updates from Apple 🍎

Lock Down Your Accounts with Strong & Unique Credentials

Your most important accounts, like your bank account or your Apple Account, should be locked behind strong, unique passwords that cannot be easily guessed. The best way to do this is by using a password manager and allowing it to create your passwords for you. Of course, your password manager itself needs to be locked with a strong password. For this, we recommend using a passphrase, which is a string of four random words, usually connected by hyphens.

You should also secure your iPhone with a difficult-to-guess passcode, so don’t use your birthday or an anniversary. In fact, if you want to be extra secure, you can change your iPhone passcode to an alphanumeric password and use a passphrase to lock it.

Use Multi-Factor Authentication Wherever Possible

These days, passwords alone are not enough to protect yourself. You need to secure your accounts with some form of two-factor or multi-factor authentication. The best form of multi-factor authentication is a physical key. Though if you can’t or don’t want to use a physical key for fear of losing it, there are also authenticator apps that use push notifications to verify your identity, such as the Microsoft Authenticator app. These time-based authenticator apps are also a viable option after physical keys. If SMS-based authentication codes are your only option, they are not quite as secure, but better than nothing.

Watch Out for Scam Emails

Everyone gets spam emails. It’s an unfortunate fact of life, and sometimes it can be difficult to determine which emails are legitimate. Thankfully, there are some telltale signs you can keep an eye out for, such as checking the sender. Emails from Apple are likely to come from an “@apple.com” domain, not a random Gmail address. You should also be wary of emails that use panic-inducing language. Emails that tell you that you have been charged hundreds or thousands of dollars for a product you don’t remember purchasing and instruct you to call a phone number to cancel the purchase are likely to be scams.

When you get emails like the ones described above, you can almost always ignore and delete them. If you’re worried that the email could be legitimate, always visit the sender’s official website and contact support from there. For example, if you get an email from your bank telling you that there’s fraud on your account, don’t call the phone number in the email or click any links. Instead, open a new tab and visit your bank’s official website, and look for the phone number for customer support.

Protect Each of Your Devices

Keeping malicious apps off your devices is vital to your digital security. One way to help do this is to use privacy-focused web browsers, like Safari, Firefox, or DuckDuckGo, along with an ad blocker, such as NextDNS, Ghostery, or uBlock Origin. Besides your ad blocker and your password manager, you should not use any other browser extensions, as extensions require extraordinary access in order to function and make a tempting target for hackers.

Speaking of malware, on your Mac or PC, you should install anti-malware software, such as Malwarebytes. Your iPhone should be safe from malware, as long as you don’t jailbreak it and only download and install reputable apps. Apple curates the App Store to ensure malicious apps don’t make it to your devices, but those protections aren’t infallible. Practice caution when installing new apps.

Last, but not least, lock down your Wi-Fi router with a unique password for your Wi-Fi network itself, as well as for the admin dashboard (accessing the admin dashboard varies depending on the manufacturer of your Wi-Fi router; check your owner’s manual to find out how to access yours). The default admin login for most routers is simply “admin” as the username and “password” as the password. Needless to say, you should change that as soon as possible.

• Key material: Credentials. Usually, this term is used in the context of low-level computers talking to other computers.
• Password Manager/Vault: The place you keep all your credentials.
• OTP: An ambiguous term that can refer to either recovery codes or TOTP codes (see below). It can stand for One-Time Pad, which is an old but still effective form of cryptography, or for One-Time Password.
• Recovery Codes or One-Time Passwords: Codes that can be used once and only once to regain access to an account in the event that the usual password is lost. These codes are generated when you create the account, and are meant to be printed out and stored somewhere safe.
• TOTP: Time-Based One-Time Pad, or sometimes Time-Based One-Time Password. A code you are either sent or generate yourself to supplement your primary credential as part of a multi-factor authentication process. Note that, despite being called a One-Time Password, a TOTP is always a randomly generated code, not a word.
• MFA: Multi-Factor Authentication. The practice of requiring more than one credential to affirm an identity. For most websites, a username and password form the basic credentials. Since passwords can be guessed or stolen, additional identifying factors are required for an account to remain secure. MFA has become standard practice, but its adoption is not universal.
• 2FA: Two-Factor Authentication. Essentially, a synonym for MFA.

The correct answer is 2. disorder-prize-describe-pin. In the past, it was common (though not recommended) to create passwords you could easily remember, like a dog’s name or a favorite sports team, along with a number that is also easy to remember, like a birthdate or anniversary. Then, just change some of the letters to symbols. However, hackers can crack these types of passwords in seconds, simply by finding out more information about you. Anyone with enough determination can find out your birthday or the name of your dog.

Instead, the example used above is composed of four random words with no relation to each other or the user. That means it’ll be much harder for hackers to guess, since they would need to run through every word in the English language and every possible combination of four words to find the right password.

Of course, if you use this method for every password you ever make, it’ll be impossible to remember them all! That’s why you should use the four random words method to create the master password for your password manager, and then let it create and remember randomized passwords for you. This year, make it a priority to start using a password manager if you’re not using one already.

Interested in keeping your iPhone secure in the new year? Check out:

• Protect Your iCloud Data
• Can iPhones Get Viruses?
• How to Use Lockdown Mode